AI Learns to Break Encryption by Listening to a Chip’s Power Whispers

Every time a smartphone encrypts a message or a smart card verifies a payment, the tiny silicon inside it leaks secrets. Not through software bugs or weak passwords, but through physics itself: the fluctuating draw of electrical power, the faint hum of electromagnetic radiation, and even millisecond-level timing delays all betray something about the calculations happening within. This is the domain of side-channel analysis, a field of cryptology that has matured from a laboratory curiosity into one of the most practical threats facing embedded security. Now, a team of researchers in China has shown that a machine learning technique borrowed from computer vision can dramatically sharpen one of the oldest weapons in this arsenal, recovering encryption key relationships with success rates that leap far beyond what previous methods could achieve.

The technique, described in the open-access journal Cybersecurity, is called CL-SCCA, short for Contrastive Learning-based Side-channel Collision Attack. It was developed by Zoushaojie Jiang, An Wang, Annyu Liu, Yaoling Ding, Jingqi Zhang, Jiakun Li, and Liehuang Zhu, most of them affiliated with the Beijing Institute of Technology. Their work targets a family of attacks known as side-channel collision attacks, which were first proposed by Kai Schramm and colleagues back in 2003 as a way of attacking the DES block cipher. The core idea behind collision attacks is elegant: rather than guessing the value of a secret key byte directly, an attacker looks for moments when two different internal operations of a cipher produce the same intermediate value. When two S-box outputs in the Advanced Encryption Standard, for example, collide, the attacker learns that the XOR of the two corresponding key bytes equals the XOR of the two known plaintext bytes. Recover enough of these pairwise relationships, and the entire key space collapses. Instead of searching through an astronomically large key space, the attacker needs only to enumerate a single reference byte, reducing the search to a trivial 256 possibilities.

For two decades, the weak link in collision attacks has been the collision detector itself. Traditional approaches rely on hand-crafted statistical distinguishers, typically correlation coefficients, to measure how similar the power traces of two different byte operations look. The trouble is that real hardware is messy. Noise floods the measurements, leakage signals are nonlinear, and the leakage from one byte position may be shifted in time or distorted in shape compared with another. Under these conditions, simple statistical similarity measures struggle to uncover the hidden shared features that would reveal a genuine collision, and the recovered key relationships become unstable. The result is that collision attacks, despite their theoretical power, have often underperformed in practice.

Deep learning promised to change that. In 2023, Moritz Staib and Amir Moradi introduced DL-SCCA, the first deep learning-based side-channel collision attack. Their insight exploited a structural property of fixed-key encryption: under a fixed key, there is a one-to-one mapping between each plaintext byte and the intermediate S-box value it produces. A neural network can therefore be trained on the traces of one byte position, using plaintext values as labels, and then transferred to the traces of other bytes to infer key differences. This worked, but only up to a point. Because different key bytes are generally different, the same plaintext label can correspond to entirely different intermediate values at different byte positions. Training jointly on multiple bytes using plaintext labels would confuse the model, forcing it to pull together leakage features that actually belong to different secrets. DL-SCCA was therefore confined to learning from a single byte at a time, leaving the richer, multi-byte leakage distribution largely untapped.

This is where contrastive learning enters the picture. Contrastive learning is a self-supervised technique that rose to fame in image recognition, most famously through frameworks like SimCLR. Its central trick is to learn representations without labels: two randomly augmented views of the same input are pulled together in the model’s representation space, while views of different inputs are pushed apart. Applied to power traces, this means the network can learn what makes a trace distinctive without ever being told which plaintext or key produced it. The researchers behind CL-SCCA realized this was exactly the missing ingredient. By pretraining an encoder on unlabeled traces drawn from multiple byte positions simultaneously, the model learns leakage features that are shared across bytes, precisely the transferable, collision-relevant structure that a single-byte supervised model cannot capture.

The technical pipeline is straightforward to describe but carefully engineered. After segmenting full traces into byte-specific leakage windows using sensitivity analysis, the method proceeds in three stages. First comes unsupervised pretraining: each trace is augmented twice using random shifting, random cropping, and random denoising, producing a positive pair, while augmented samples from other traces serve as negatives. A simple multilayer perceptron with four fully connected layers encodes these samples, and a projection head maps them into a 128-dimensional contrastive space where a normalized temperature-scaled cross-entropy loss does the pulling and pushing. Second, the projection head is discarded and a classification head is attached; the model is fine-tuned with plaintext labels from one chosen byte. Third, the fine-tuned model is applied to traces of target bytes, and candidate key differences are ranked by accumulating log-probabilities across attack traces. Notably, the researchers found that this simple MLP architecture outperformed a convolutional network variant, suggesting the gains come from the learning strategy rather than model size.

One subtlety threatened to undermine the whole approach. In a mini-batch mixing traces from several bytes, cross-byte negative samples vastly outnumber same-byte negatives. Because traces from different bytes differ in position, amplitude, and morphology, the model can separate them cheaply using these superficial byte-source cues rather than the fine-grained leakage features that actually matter for collision detection. The team’s solution is a byte-weighted contrastive loss, which assigns a reduced weight, controlled by a coefficient alpha, to cross-byte negative pairs. Gradient analysis shows this scales down the backpropagation contribution of cross-byte pairs, discouraging the model from wasting capacity on byte-identity discrimination. Ablation experiments on the ASCAD_F dataset showed that lowering alpha consistently reduced average key-rank and raised success rates, and t-SNE visualizations confirmed that the learned representations from different bytes overlapped far more when cross-byte repulsion was weakened.

The experimental results are striking. Across three public benchmark datasets, CL-SCCA achieved relative improvements in key-difference recovery success rate of approximately 14.88 percent on ASCAD_F, 77.73 percent on ASCAD_R, and 65.20 percent on DPA Contest v4 compared with the previous state of the art. On both ASCAD variants, the method drove the key-rank of the correct difference to zero for every target byte, meaning the right answer always surfaced at the top of the ranking. The method was not limited to AES: the team collected their own datasets for the Chinese national cipher SM4 on a 16-bit smart card and for the lightweight cipher PRESENT-128 on a 32-bit microcontroller, and in both cases the contrastive approach substantially outperformed DL-SCCA, demonstrating generality across different S-box sizes, cipher structures, and hardware platforms. Comparisons against other self-supervised baselines were equally decisive: an autoencoder-based method managed a recovery success rate below one percent, a Siamese network reached only about fifteen percent, while the byte-weighted variant of CL-SCCA exceeded eighty percent on ASCAD_F.

The study is candid about limits. On DPA Contest v4, which uses rotating S-box masking, cross-byte transfer proved harder: recovery results clustered into groups, and Pearson correlation analysis of group-averaged traces showed that leakage similarity between bytes within a group was high while similarity across groups was near zero. No loss function can erase such inherent leakage differences. The researchers also found that leakage window size matters in a non-monotonic way, with a 700-sample window on ASCAD_F outperforming both smaller and larger choices, because extra trace regions inject irrelevant information. Robustness tests against desynchronization and random delay countermeasures showed the contrastive approach still held the advantage, though the byte-weighted refinement lost its edge when perturbations made same-byte traces differ as much as cross-byte ones.

For defenders, the message is sobering. Masking countermeasures, long considered a robust shield, did not stop these attacks on any of the masked datasets tested. The work signals a broader trend in hardware security: self-supervised learning, which thrives on unlabeled data, is a natural fit for realistic attack scenarios where adversaries cannot easily obtain labeled profiling traces from a clone device. The authors point toward future end-to-end frameworks that would jointly localize leakage, align cross-byte features, and recover keys directly from raw traces. As machine learning continues to lower the expertise and data barriers of side-channel attacks, the race between leakage and countermeasure design is entering a new, faster phase, and the chips guarding our keys will need every advantage physics and mathematics can offer.

Subject of Research: Contrastive learning-based side-channel collision attacks for recovering cryptographic key differences from power traces

Article Title: CL-SCCA: multi-byte contrastive learning for side-channel collision attacks on cryptosystems

Article References: Jiang, Z., Wang, A., Liu, A., Ding, Y., Zhang, J., Li, J., & Zhu, L. (2026). CL-SCCA: multi-byte contrastive learning for side-channel collision attacks on cryptosystems. Cybersecurity, 9(1), Article 232. https://doi.org/10.1186/s42400-026-00658-4

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00658-4

Keywords: side-channel analysis, collision attack, contrastive learning, deep learning, cryptography, AES, SM4, PRESENT, power traces, masking countermeasures, key recovery, self-supervised learning