Quantifying Side-Channel Leakage in Public Metrology Releases

Technical Summary: Quantifying Side-Channel Leakage in Public Metrology Releases

Problem Statement
Public scientific and metrology releases, such as roughness spectra from semiconductor manufacturing, can inadvertently leak hidden process parameters (recipes) that the releasing entity intends to keep private. Once a measurement is published, an observer may utilize it to recover specific process settings—such as quencher loading, acid-transport length, or stochastic amplitude—without the releaser's intent. The paper formalizes this risk as a profiled statistical side-channel audit. The core challenge is to quantify how many released spectra are required for a protected recipe bit to become statistically distinguishable within a public utility class, given specific constraints on the adversary's profiling resources.

Methodology
The authors propose a rigorous framework that adapts quantitative information flow and profiled template-attack reasoning to public scientific releases. The methodology is structured around a "recipe-release game" involving a release owner and a profiled observer.

1. Channel Modeling: The public transcript is modeled as a released Power Spectral Density (PSD) band. For the case study of Extreme Ultraviolet (EUV) lithography, the spectrum is modeled as a screened reaction-diffusion field:
   $$S(k) = A e^{-\beta k^2}(1 + \lambda^2 k^2)^{-3/2} + S_0$$
   Here, $A$ (amplitude) and $\beta$ (blur) are treated as nuisance coordinates, $S_0$ is the metrology floor, and $\lambda$ is the protected transport coordinate.
2. Statistical Formalism:
   • Gamma Channel: For averaged PSD bins, the authors derive exact likelihoods assuming independent bins follow a Gamma distribution.
   • Covariance-Weighted Channel: When bins are correlated (e.g., due to overlapping segments), the model is replaced by a covariance-weighted log-spectrum channel.
   • Divergence Metrics: The framework computes exact Kullback-Leibler (KL) divergences and Chernoff exponents to quantify the distinguishability between two utility-equivalent recipes separated by a protected coordinate.
3. Adversary Classes: The audit grades adversaries by their profiling budgets:
   • Training Budget ($Q$): Number of labeled spectra used to train templates.
   • Library Size ($N$): Number of stored templates.
   • Compute Budget ($T$): Number of likelihood scores evaluated.
   • Mismatch: The gap between the true data distribution and the adversary's fitted model.
     The framework provides bounds for optimal pairwise tests, finite-library thresholds, and corrections for finite training and model mismatch.

Key Contributions

1. Resource-Explicit Game: A formal definition of the recipe-release game with explicit budgets $(N, Q, L, T)$ that grade the adversary's effort, moving beyond idealized information-theoretic limits to practical constraints.
2. Exact Statistical Bounds: Derivation of exact gamma-channel likelihoods and covariance-weighted replacements for correlated bins, yielding precise KL divergences, Chernoff exponents, and protected-bit advantage bounds.
3. Finite-Band Transport-Leakage Law: A headline result establishing that, after eliminating amplitude and blur, the protected acid-transport information in a low-frequency band obeys a ninth-order exponent:
   $$I_{\lambda|\alpha,\beta}(K) = \frac{64}{1225} w \lambda^6 K^9 + O(w \lambda^8 K^{11})$$
   This law holds for $K\lambda \ll 1$, where $K$ is the band edge.
4. Nuisance-Coupled Analysis: A treatment of the metrology floor ($S_0$) and chemical non-identifiability, showing how profiling the floor reduces information and defining conditions under which a "floor-blind" audit is trustworthy.
5. Design Tool for Controlled Disclosure: A method to place protected tangents in the nullspace of the release map, allowing the calculation of the public statistic that maximizes utility while adhering to a leakage budget.
6. Reproducible Audit Protocol: A step-by-step protocol (Section 8) to turn a measured PSD release into leakage exponents and safe bands, including diagnostics for gamma fit, covariance estimation, and mismatch margins.
7. Open Implementation: A fixed-seed Python package that reproduces all tables and figures, validates the ninth-order asymptotic law, and includes Monte-Carlo simulations.

Results

• Leakage Exponents: The study confirms that leakage scales with the ninth power of the band edge ($K^9$) in the low-frequency regime. This implies that low-pass releases (small $K$) effectively hide the protected bit, while releasing data near or past the "transport knee" ($K\lambda \sim 1$) drastically increases leakage.
• RMS vs. PSD: Collapsing a spectrum to a single Root Mean Square (RMS) scalar destroys most attribution signal. In synthetic audits, RMS-only releases resulted in success rates near chance (approx. 0.55), whereas full PSD releases achieved near-certain attribution (approx. 0.98) with the same number of spectra.
• Finite-Training Penalty: The paper quantifies the penalty when an adversary has limited training data ($Q$). With sparse profiling ($Q \le 20$), the adversary's success rate remains near chance, even if the channel theoretically permits higher leakage. Success rises decisively only when $Q \gtrsim 50$.
• Correlation Effects: Positive correlation between bins (e.g., from overlapping Welch averaging) reduces distinguishable information. A diagonal-gamma audit (assuming independence) over-states leakage compared to a covariance-weighted audit, serving as a conservative upper bound.
• Floor Conditioning: The audit identifies a "well-conditioned" corner (low floor, moderate band) where a floor-blind analysis is valid. In ill-conditioned regimes, the metrology floor must be explicitly profiled to avoid overestimating protection.

Significance and Scope
The paper claims to provide a reproducible statistical side-channel audit framework specifically for scientific metrology releases. Its significance lies in transforming the abstract risk of "data leakage" into concrete, calculable numbers (exponents, safe bands, and sample thresholds) that a release owner can use to make disclosure decisions.

The authors are modest about the scope:

• The EUV case study is a model-conditioned instantiation, not a validated process model for all lithography.
• The "protected coordinate" $\lambda$ is an effective transport length; a single spectrum cannot uniquely identify individual chemical rates (e.g., separating quencher loading from loss rate) without a controlled sweep.
• The current results rely on synthetic and reconstructed data (including a "smoke test" on reconstructed points from a public paper) to exercise the pipeline.
• The framework is model-agnostic regarding the calculus (gamma/covariance channels, divergence bounds) but relies on the specific screened spectrum model for the physical instantiation.

The paper concludes that the next step is the deployment of this protocol on repeated measured releases to estimate effective degrees of freedom and covariance empirically, thereby moving from theoretical bounds to practical, measured safety guarantees.