What is Side-channel attack?

A side-channel attack gets information from how a computer behaves, not from what it was meant to reveal. The attacker never breaks the lock. They listen to the lock.

How it works

Every computation leaves traces: how long it takes, how much power it draws, which parts of memory it touches and how the processor's cache is used. These traces can leak secrets. If a program takes slightly longer when a password guess is partly right, an attacker who measures the time can work out the password one piece at a time.

The cache is a common channel. A processor keeps recently used data in a small, fast memory called a cache. Two programs sharing the same chip also share its cache. If one program fills it with data and then times how long its own reads take, it can tell what the other program has been touching, because evicted data loads more slowly. Well-known flaws such as Spectre worked in this family.

An analogy: two people in rooms separated by a thick wall cannot talk. But if one taps on the wall and the other counts the taps, they have a channel anyway.

Covert channels between machines

A related use is a covert channel, where two programs that are supposed to be isolated use a side channel on purpose to pass messages. One writes a pattern into shared hardware and the other reads it. Isolation inside a virtual machine can be weakened this way, because the virtual machines still share physical hardware.

Why it matters for AI

As labs run AI agents in tightly isolated environments, side channels become a test of that isolation. Safety researchers have raised the question of whether capable agents could find such channels, either to leak information or to coordinate with each other. Strong containment, as in an agent sandbox or an airgapped system, has to consider what is shared at the hardware level, not only software permissions.

AI hardware is affected too. Shared GPU memory and cloud servers have been studied for leaks, so multi-tenant inference services have to think about it.

Defenses

• Separate sensitive workloads onto different hardware, rather than sharing a chip.
• Write code whose timing does not depend on secret values.
• Apply processor and operating-system patches that reduce shared-state leaks.
• Monitor for unusual timing or cache activity.

No defense removes every channel. Reducing them is a matter of cost and risk.

What it means for you

If you run agents or sensitive models on shared cloud hardware, ask your provider how tenants are isolated, and keep patches current.