💻 computer science

Profiling Resilient to Change in Probe Position

This paper proposes a method for training a single neural network on electromagnetic traces from multiple probe positions to detect leakage across a larger chip area, demonstrating its effectiveness through a dual-lab evaluation where a model profiled on data from one laboratory successfully attacks traces from another.

Original authors: Elie Bursztein, Michael Gruber, Karel Král, Jean-Michel Picod, Matthias Probst, Georg Sigl

Published 2026-04-28

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Elie Bursztein, Michael Gruber, Karel Král, Jean-Michel Picod, Matthias Probst, Georg Sigl

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to listen to a very quiet conversation happening inside a locked room (the computer chip). To hear it, you have to hold a super-sensitive microphone (an electromagnetic probe) very close to a specific spot on the wall.

The Problem: The "Perfect Spot" Trap
In the past, if you wanted to eavesdrop on a secret code being processed by a chip, you had to find the one perfect spot on the chip where the "conversation" was loudest. Once you found that spot, you had to memorize exactly where your microphone was.

The problem? If you tried to listen to a different chip (even an identical model from a different factory), you'd have to find that exact same spot again. If you were off by even a tiny fraction of a millimeter, the signal would vanish, and your listening attempt would fail. It was like trying to copy a recipe by tasting a dish, but if you moved your spoon even a millimeter to the left, the flavor changed completely. This made it very hard to prove that security research was reproducible or to test chips efficiently during development.

The Solution: The "Chorus" Approach
This paper introduces a new way to listen. Instead of trying to find the single "perfect" spot, the researchers trained a computer brain (a neural network) to listen to the chip from many different spots at once.

Think of it like this:

Old Way: You train a student to recognize a song only if it's played on a specific piano in a specific room. If they hear the song on a different piano or in a different room, they can't recognize it.
New Way: You train the student to listen to the song played from ten different angles in the room. Now, even if the music is coming from a slightly different angle or a different room entirely, the student can still recognize the tune because they learned the "shape" of the sound, not just the exact location.

What They Actually Did
The researchers didn't just simulate this; they built it in the real world with a massive collaboration:

Two Labs, Two Countries: One team in Munich, Germany, and another in Zurich, Switzerland, worked together without ever visiting each other's labs. They used different equipment and different chips.
The Grid: They didn't just pick one spot. They moved their probes in a grid pattern (like a checkerboard) over the chips, capturing data from dozens of different positions.
The Training: They fed all these different "angles" of data into a single AI model. The model learned to ignore the noise caused by the probe's position and focus on the actual secret information leaking from the chip.

The Results

Portability: The model trained in Zurich could successfully "crack" the secrets of a chip measured in Munich, and vice versa. This is a big deal because it proves you don't need to be in the exact same lab with the exact same equipment to break the code.
Resilience: Even when they moved the probe slightly (simulating a human error or a different setup), the model still worked. It was robust against "jitter."
The Hybrid Trick: For a very hard-to-crack hardware version of the code, the AI couldn't do it alone. So, they created a "hybrid" team: the AI acted as a signal amplifier (like a volume knob), boosting the weak signal so a traditional math tool could finally hear the secret.

The Bottom Line
The paper claims that by training on data from many different probe positions, we can build security tests that are much more flexible and reliable. You no longer need to throw away all your previous data just because you moved your equipment slightly. You can use a "chorus" of data points to find the secret, making side-channel attacks more portable and reproducible across different labs and setups.

1. Problem Statement

Side-Channel Analysis (SCA), particularly using Electromagnetic (EM) emanations, is a powerful method for extracting secret keys from cryptographic devices. However, profiled attacks (where an attacker trains a model on a clone device) suffer from a critical lack of portability.

The Challenge: A profiled model trained on a specific EM probe position often fails when the probe is moved even slightly on the target device, or when the attack is performed on a different device with a different physical setup.
Current Limitations: Existing research focuses on "hot-spot finding" (locating the best spot) or trace augmentation to fix minor misalignments. Reproducing research is difficult because precise relative positioning (often requiring de-capped chips and manual repositioning) is rarely published or replicated.
The Gap: There is a need for a profiling method that is robust to changes in probe position (x, y, z coordinates) and cross-device variations without requiring identical physical setups or de-capping.

2. Methodology

The authors propose a Multi-Place Training strategy combined with Deep Learning and a novel Hybrid Attack technique.

A. Data Collection & Datasets

The study utilizes a unique cross-institutional collaboration between Google Zurich and Technical University of Munich (Fraunhofer AISEC).

Hardware: Off-the-shelf ChipWhisperer boards (STM32F3 and STM32F4) with decoupling capacitors removed (to increase power leakage, making EM leakage harder).
Probes: Various EM probes (Langer HH 250-75, Riscure 0.5mm coil) with diameters of 250µm and 500µm.
Grids: Traces were captured on a grid of positions around the leakage source (e.g., 11x11, 5x5, 101x101 grids) with varying step sizes (0.05mm to 2.3mm).
Scenarios:
- SW-AES: Software AES on STM32F3. Captured in two different labs (Munich and Zurich) with different oscilloscopes and setups.
- HW-AES: Hardware-accelerated AES on STM32F4. Captured in two different rooms in Zurich with different setups, sharing only the probe.
- Public Datasets: SL-STM and SL-XM from [NNR+24] for comparison.

B. Deep Learning Approach

Model: Based on the GPAM (Generalized Profiled Attack Model) architecture [BIK+24].
Training Strategy: Instead of training on a single "hot-spot," the model is trained on traces from multiple grid positions simultaneously. The model learns to generalize across spatial variations.
Preprocessing: Traces are normalized to $[-1, 1]$ based on the min/max of the specific lab's data to handle voltage scaling differences.
Ablation Studies: The authors compared multi-place training against:
- Training on a single hot-spot with massive amounts of data.
- Training on all data (including low-leakage areas).
- Interpolation capabilities (testing positions between grid points).

C. Hybrid Attack Technique (For Low Leakage)

For the Hardware AES (STM32F4), the leakage was too low for the neural network to perform direct classification. The authors developed a Hybrid Approach:

Signal Amplification: A neural network is trained to regress the Hamming Distance of the last round (outputting 16 float values).
CPA Integration: Instead of using the raw traces for the attack, the 16 float outputs from the neural network are fed into a classical Correlation Power Analysis (CPA).
Result: The neural network acts as a denoising/amplifying filter, significantly boosting the signal-to-noise ratio (SNR) for the CPA.

3. Key Contributions

Cross-Lab Portability: First demonstration of a profiled EM attack where profiling data comes from a completely different lab (different country, different equipment, different operators) and successfully attacks a target device in the other lab.
Position Resilience: Proved that training on multiple probe positions creates a model robust to probe repositioning. The model can detect leakage even when the probe is moved significantly (e.g., from "close" to "far" distances or different x/y coordinates).
Hybrid Neural-CPA Technique: A novel method using a neural network as a signal amplifier for CPA, enabling key recovery on hardware-accelerated AES implementations where standard deep learning or standard CPA failed individually.
Large-Scale Datasets: Publication of extensive datasets (millions of traces) captured under varying conditions, including a 101x101 fine grid, to facilitate future research on portability.

4. Key Results

Software AES (STM32F3):
- Cross-Device Success: A model trained on Munich data successfully attacked Zurich data (and vice versa), though with a performance drop compared to same-device attacks.
- Data Diversity vs. Volume: Training on multiple positions (diversity) outperformed training on a single hot-spot with 5x more data. The multi-place model was less sensitive to x, y, and z displacement.
- Interpolation: The model successfully detected leakage at positions between the training grid points, proving it learned a continuous spatial representation rather than memorizing discrete points.
Hardware AES (STM32F4):
- Hybrid Success: The hybrid NN+CPA approach successfully recovered the full key on the HW-AES-H2 dataset (742k traces) where standard CPA failed.
- Robustness: The hybrid model trained on one chip/room successfully attacked a different chip/room setup.
Public Datasets: The multi-place approach improved leakage detection on the SL-XM and SL-STM datasets compared to single-point training, though results varied based on the specific chip architecture.

5. Significance and Implications

Reproducibility: This work addresses a major bottleneck in SCA research. It suggests that precise, de-capped, manual repositioning is not strictly necessary for successful attacks if multi-place training is used.
Evaluation Standards: It challenges the "black-box" assumption in security evaluations. Evaluators can no longer rely on a single "perfect" probe position to claim security; they must consider that attackers can train on multiple positions to find leakage over a larger area.
Development Efficiency: Manufacturers can reuse data captured during initial hot-spot searches for profiling, rather than discarding it if the setup changes later.
Future Directions: The paper suggests that future profiling could use hand-held probes with slight repositioning during capture to achieve similar resilience, removing the need for expensive, precise 3D positioning tables.

In summary, the paper demonstrates that Deep Learning, when trained on diverse spatial data, can overcome the physical limitations of EM probe positioning, making profiled side-channel attacks significantly more portable and dangerous in real-world scenarios.