Machine Learning-Based AES Key Recovery via Side-Channel Analysis on the ASCAD Dataset

Mukesh Poudel; Nick Rahimi

REVIEW 2 major objections 6 minor 12 references

Machine Learning-Based AES Key Recovery via Side-Channel Analysis on the ASCAD Dataset

T0 review · 2 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that machine-learning classifiers can recover an AES-128 key byte from electromagnetic side-channel traces on the ASCAD datasets, and that the Key Rank metric — not per-trace accuracy — is what shows the attack succeeds.

desk verdict The fixed-key results are plausible but the ASCADv key-rank numbers are meaningless: the variable-key dataset changes the key per trace, while the paper's rank formula sums scores for a single key across all traces. read the letter →

arxiv 2508.11817 v1 pith:GI23LA32 submitted 2025-08-15 cs.CR

Mukesh Poudel , Nick Rahimi This is my paper · ORCID

classification cs.CR

keywords side-channelanalysisAESkeyrecoverymachinelearningdeepASCADdatasetRankelectromagneticleakageRandomForestfeatureselection

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that machine-learning models can turn noisy electromagnetic leakage from an AES-128 implementation into a recovered key byte, using the public ASCAD fixed-key and variable-key datasets. It frames the attack as a 256-way classification of the first-round S-box output for one key byte, then ranks all 256 key guesses by summed log-probabilities over attack traces. Against the intuition that per-trace accuracy below 2% means failure, several models reach Rank 0: a CNN in about 65 traces on the fixed-key set, a ResNet in about 30 traces on the variable-key set, and a Random Forest trained on the top 100 importance-ranked features in about 200 traces. The intended takeaway is that the Key Rank metric is necessary for evaluating ML-based side-channel attacks, and that unprotected AES software leaks enough to be practically exploitable.

What carries the argument

The load-bearing mechanism is the Key Rank metric applied to the first-round AES S-box output, $\mathrm{Sbox}(\mathrm{plaintext}[i] \oplus k_{\text{guess}})$. For each candidate key byte, the attacker sums the log-probabilities the model assigns to the corresponding S-box outputs over the attack traces; the true key dominates the summed score even when individual classifications are mostly wrong. Secondary machinery carries the models: Random Forest Gini importance for selecting the top 100 features, a four-block CNN with kernel size 11 and a 4096-unit dense head, and a ResNet whose shortcut connections are credited with making variable-key recovery work. Feature selection roughly halves the

What would settle it

Retrain the same architectures on the official ASCAD profiling and attack splits with fixed seeds and repeat the attack phase many times, plotting rank versus trace count for each repeat. If the median traces-to-Rank-0 is not near 65 for the CNN on ASCADf, about 30 for the ResNet on ASCADv, or about 200 for the feature-selected RF, or if the rank curves are wildly unstable across repeats, the specific efficiency claims fail. A sharper check: run the published pipeline (if supplied) and verify that the same attack traces reach Rank 0 regardless of trace order and that the reported key byte 224

Watch

Extended reading notes

Core claim

The central claim is that successful key recovery does not require high per-trace classification accuracy. The paper's CNN reaches only 0.81% test accuracy, yet it ranks the correct fixed-key byte first after roughly 65 attack traces; the Random Forest's validation accuracy is 0.46%, yet a feature-reduced RF still reaches Rank 0. This is possible because Key Rank aggregates the model's class probabilities across traces: for each candidate key byte, the attack computes the summed log-probability of the S-box output that candidate would imply, and the true key accumulates enough small advantages to overtake all 255 wrong hypotheses. On the variable-key dataset, where the standard CNN fails ent

Load-bearing premise

The central result depends on the models being trained and evaluated on the standard ASCAD profiling and attack sets, with the reported Rank 0 trace counts coming from a single held-out attack set rather than from favorable folds, best-of-many runs, or an undocumented data split.

Editorial extensions

If this is right

Per-trace classification accuracy is a misleading success criterion for profiling side-channel attacks; rank-versus-traces curves should be the standard evaluation.
Random Forest Gini importance is a cheap dimensionality-reduction step that can cut required attack traces by roughly half, making classical ML more competitive for SCA.
Residual connections can be the decisive factor for variable-key targets, where a plain CNN fails completely and a ResNet recovers the key in about 30 traces.
Unprotected AES implementations on microcontrollers leak enough electromagnetic information for standard ML models to recover key bytes, reinforcing the need for masking, shuffling, or other countermeasures.
Model choice should depend on target complexity: a tuned CNN is more trace-efficient on the simple fixed-key dataset, while a deeper ResNet wins on the larger variable-key dataset.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper: the headline trace counts are single-run approximations (about 65, 30 in one section and roughly 20 in another, and about 200) with no seeds, code, or repeated-run variance, so the exact efficiencies should be treated as provisional until independently reproduced on the official ASCAD split.
Beyond the paper: the same rank-based machinery should extend to simultaneous recovery of all 16 key bytes and to desynchronized ASCAD traces; those tests would show whether the conclusion holds under more realistic acquisition conditions.
Beyond the paper: because the attacks target unmasked value-based S-box leakage, standard masking or shuffling countermeasures should substantially suppress this attack class; evaluating the same models on the masked ASCAD variant would be a natural follow-up.
Beyond the paper: combining per-byte Key Rank scores across positions would turn one-byte recovery into full-key enumeration, which is the step that makes the attack practical against real AES-128.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The core message—that low per-trace classification accuracy can coexist with successful key recovery when you use the domain's Key Rank metric—is correct and worth restating for newcomers to side-channel analysis. The comparison of RF, SVM, CNN, and ResNet on ASCAD is a reasonable exercise, and the RF feature-importance reduction is a sensible, concrete probe of dimensionality effects. The paper is also honest about its limitations in Section 4.4: it assumes synchronized traces, known plaintext, and profiling setting. That is credit where it's due.

The soft spots are serious. The stress-test concern is not a quibble; it lands exactly. Section 2.2 says the ASCADv key changes for every trace in both profiling and attack sets. Section 2.6 then defines Key Rank as the summed log-probability over N attack traces for each hypothesized key byte. That sum assumes the same unknown key byte appears in all N traces. With per-trace random keys there is no single true key to rank. The reported ASCADv results—RF 470 traces, SVM 320, ResNet 30 or 20—have no valid interpretation as stated. This is an internal contradiction in the core methodology.

There are smaller problems too. The ResNet trace counts disagree between Section 3.5 (30), Section 4.3 (approximately 20), and Table 2 (30). The abstract claims SVM and RF on full features perform poorly, but the SVM is only trained on reduced features. No code, no seeds, no repeated-run variance are provided, so even the fixed-key numbers (CNN ∼65, RF ∼200, ResNet ∼110) are impossible to reproduce or verify from the paper alone. The novelty is low: the Key Rank versus accuracy point is already established in the cited literature, including Picek et al. and the original ASCAD paper.

For a reader, the fixed-key experiments are a plausible reinforcement of known results, and the feature-importance study is mildly interesting. But the variable-key claims are the paper's main claim to handle a harder scenario, and they break. I would not send this to peer review in its current form. If the authors fix the variable-key evaluation—for example, using per-trace rank or a clear explanation of how they adapted the fixed-key metric—and release code with consistent numbers, then a revised version could be worth a referee's time. As submitted, I'd regard it as an honest but flawed benchmark report.

Referee Report

2 major / 6 minor

Summary. This paper evaluates several ML models for AES key-byte recovery on the ASCAD fixed-key (ASCADf) and variable-key (ASCADv) datasets. The problem is framed as 256-class classification of the first-round S-box output; the authors train Random Forest (RF), SVM, CNN, and ResNet models and evaluate them with the side-channel Key Rank metric. They report that, despite per-trace classification accuracy below 2%, CNNs and ResNets reach Rank 0 on the fixed-key dataset (about 65 and 110 traces, respectively), and that feature-selected RF achieves Rank 0 in about 200 traces. On the variable-key dataset they report RF, SVM, and ResNet success (about 470, 320, and 30 traces, respectively). The paper concludes that standard accuracy is insufficient and that ML-based side-channel attacks are practical.

Significance. If the fixed-key results are reproducible, the paper offers a useful comparative benchmark and a clear example of the accuracy/Key Rank mismatch that is well known in the side-channel literature. The use of the public ASCAD benchmark and the standard Key Rank metric are appropriate and are strengths of the study. However, the variable-key results are currently undermined by an internal inconsistency in the Key Rank computation: the paper states that ASCADv keys change per trace, yet the Key Rank formula assumes a single fixed key across all attack traces. The exact efficiency claims are also not reproducible from the manuscript because no code, seeds, or repeated-run variance are provided, and there is a direct contradiction in the reported ResNet trace counts (30 vs. 20). The central phenomenon is credible, but the variable-key conclusions need substantial revision.

major comments (2)

[§2.2 vs. §2.6] The Key Rank formula in §2.6, Score(k_guess)=Σ_i log P(Sbox(pt_i⊕k_guess)|trace_i), assumes a single key byte common to all N attack traces. This is incompatible with §2.2, which states that in ASCADv 'the secret key changes for each trace in both the profiling and attack sets.' With a per-trace key there is no well-defined 'true key' for the attack set as a whole; the cumulative score for a fixed k_guess mixes traces where that guess is correct (probability 1/256) with traces where it is not. The reported Rank 0 values for ASCADv (RF ~470, SVM ~320, ResNet 30; Table 2, §3.2–§3.5) therefore lack a valid interpretation. The authors must either demonstrate that the ASCADv attack set actually uses a fixed key (and correct §2.2), or replace cumulative Key Rank with a per-trace metric (e.g., average guessing entropy or per-trace success rate). This affects the paper's main variable-key claims
[§3.5 vs. §4.3, Table 2] The headline trace counts are not reproducible and contain a direct contradiction: ResNet on ASCADv is reported as 30 traces in §3.5 and Table 2, but as 'approximately 20 traces' in §4.3. No random seed, number of repeated runs, or confidence interval is provided for any 'traces to Rank 0' figure, and the attack-set splitting protocol is not described. Since these numbers are the paper's quantitative conclusions, the authors should report the full distribution over runs (or at least fix a seed and state the protocol) and reconcile the contradictory statements.

minor comments (6)

[Abstract] The abstract says the datasets contain '700 and 1400 EM traces respectively,' but the paper later states that each trace consists of 700 (ASCADf) or 1400 (ASCADv) EM measurements. Please correct the wording to '700-sample and 1400-sample traces' or similar.
[§3.2] The reported RF validation accuracy of 0.46% is only slightly above the random baseline for 256 classes (≈0.39%). Consider reporting the per-class balanced accuracy or a statistical test showing that the model's probability estimates are informative, since this is central to the 'accuracy vs. Key Rank' discussion.
[§3.4] The text states that SVM recovered the key in 320 traces for both ASCADf and ASCADv. Given the very different dataset sizes and noise levels, this exact equality is suspicious; please verify the number and clarify whether it is a coincidence or a typo.
[Table 1 and Table 2] There is a typo in the column header 'T raining Time (s)' (extra space). Also, the training times include overhead for probability estimation; this should be stated more prominently to avoid misleading comparisons.
[Section 4.3] The discrepancy between 'approximately 20 traces' and the table value of 30 traces is not just a presentation issue; it affects the paper's efficiency claims. Please reconcile all occurrences.
[General] No code or data availability statement is provided, which hampers reproducibility. At minimum, a link to the repository or a detailed experimental configuration (seeds, hardware/software versions, data splits) should be added.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the key-recovery claims are evaluated against the standard external ASCAD benchmark and the domain-standard Key Rank metric, with no self-citation chain or definitional reduction.

full rationale

The paper's derivation chain is self-contained with respect to its central claims. Models (RF, SVM, CNN, ResNet) are trained on labeled ASCAD S-box outputs and evaluated on separate ASCAD attack traces; the Key Rank metric is an externally defined, standard side-channel evaluation measure (cited to Picek et al. [9]) and is not fitted or defined in terms of the reported outcomes. Feature selection via RF Gini importance is performed on the profiling set and then evaluated on the attack set; this is standard feature selection, not a fitted-input-called-prediction construction. No load-bearing result is justified by a citation to the authors' own prior work: the references include the ASCAD paper [4], ResNet literature [8], and other external SCA works [10, 11, 12], with no self-citations. The CNN architecture borrowing kernel-size findings from [4] is inherited from the public ASCAD benchmark and is not an ansatz smuggled in to force the result. Hyperparameter exploration (e.g., batch size, tree depth, C) is reported as ablations on the same datasets but does not redefine the evaluation metric or make the headline numbers true by construction. The paper also explicitly lists limitations in Section 4.4 (synchronized traces, known plaintext, ASCAD-specific models), which supports rather than undermines its non-circular nature. The only substantive concern is the validity of applying the fixed-key Key Rank formula to the ASCADv dataset where the secret key changes per trace, as the paper itself states in Section 2.2; that is a methodology/correctness issue, not a circularity issue, and it does not alter the circularity verdict.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

No new physical entity, particle, or mathematical object is invented. The load-bearing components are tuned hyperparameters and standard domain assumptions about the leakage model and attack scenario. The absence of shipped code and seeds makes the tuned hyperparameters the main unstated variables.

free parameters (3)

CNN/ResNet hyperparameters = kernel size 11, batch size 100, learning rate 1e-5, weight decay 1e-5, 4 blocks
The paper explicitly states these were chosen through exploratory tuning runs (Section 2.5), and the final values are what make the reported Rank 0 results work.
RF hyperparameters = n_estimators=100, max_depth=20, min_samples_leaf=10, top 100 features
Selected by the authors through experiments; the paper notes max_depth=30 makes recovery fail, so the chosen depth is load-bearing for the RF result.
SVM hyperparameters = C=1.0, gamma='scale', RBF kernel, 100 features
The paper reports trying other C values and finding the standard value gives the best trade-off, making this a tuned setting.

assumptions (3)

domain assumption The value-based leakage model: EM trace contains information correlated with the S-box output value.
Stated in Section 2.1 and is the standard profiling SCA assumption; the attack depends on this correlation being learnable.
domain assumption The attack knows the plaintexts and can compute S-box outputs for all key hypotheses.
Explicitly acknowledged in Section 4.4 as a limitation of the profiling attack scenario.
domain assumption The official ASCAD dataset's profiling and attack splits are used correctly.
The results only transfer to realistic attacks if the evaluation follows the standard protocol; the paper does not provide enough detail to confirm the attack-set selection.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Machine Learning-Based AES Key Recovery via Side-Channel Analysis on the ASCAD Dataset." pith.science (2026). https://pith.science/paper/GI23LA32

@misc{pith2026250811817,
  author       = {Pith},
  title        = {Pith review of: Machine Learning-Based AES Key Recovery via Side-Channel Analysis on the ASCAD Dataset},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GI23LA32}},
  note         = {Machine review of arXiv:2508.11817}
}

read the original abstract

Cryptographic algorithms like AES and RSA are widely used and they are mathematically robust and almost unbreakable but its implementation on physical devices often leak information through side channels, such as electromagnetic (EM) emissions, potentially compromising said theoretically secure algorithms. This paper investigates the application of machine learning (ML) techniques and Deep Learning models to exploit such leakage for partial key recovery. We use the public ASCAD `fixed' and `variable' key dataset, containing 700 and 1400 EM traces respectively from an AES-128 implementation on an 8-bit microcontroller. The problem is framed as a 256-class classification task where we target the output of the first-round S-box operation, which is dependent on a single key byte. We evaluate standard classifiers (Random Forest (RF), Support Vector Machine (SVM)), a Convolutional Neural Network(CNN) and a Residual Neural Network(ResNet). We also explore the utility of RF-based feature importance for dimensionality reduction. Crucially, we employ this domain-specific Key Rank metric for evaluation, showing its necessity over standard classification accuracy. Our results show that SVM and RF on full features perform poorly in key ranking. However, RF trained on reduced (top 100) identified via importance analysis achieves Rank 0 (successful key byte recovery) using almost half the attack traces. The implemented CNN also achieves Rank 0 efficiently using approximately 65 attack traces for the fixed-key dataset. The ResNets perform best on large and complex datasets but may not always be the best choice for simple fixed key dataset in terms of efficiency. Thus we conclude that models, particularly CNNs, ResNets and feature-selected RF, coupled with the Key Rank metric, are an effective tool for side-channel key recovery, confirming the practical vulnerability of the cryptographic implementations.

Figures

Figures reproduced from arXiv: 2508.11817 by the authors.

**Figure 2.** CNN Architecture for SCA – Input Layer: Accepts a 1D EM trace (700 samples for ASCADf, 1400 samples for ASCADv) as a tensor of shape (BatchSize, 1, TraceLength) – Convolutional Blocks (4x): The network employs four identical convolutional blocks for hierarchical feature extraction. Each block includes: 1. Conv1d Layer: Applies 1D convolutions with a kernel size of 11 and padding of 5 (effectively ’same’ padding for… view at source ↗

**Figure 3.** ResNet Architecture for SCA The core of this model is the Residual Block, which processes the input through two parallel paths: – The Main Path: This path consists of two 1D convolutional layers, each with a kernel size of 11. Each convolution is followed by a Batch Normalization layer, and a ReLU activation function is applied after the first block [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Sample Example of a Key Rank Chart [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]

**Figure 5.** Figure 5: Key Rank Charts for RF on Datasets ASCADf(left) and ASCADv(right) [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

**Figure 6.** Figure 6: Key Rank Charts for CNN on ASCADf(left) and ASCADv(right) [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]

**Figure 7.** Figure 7: Key Rank Charts for SVC on Datasets ASCADf(left) and ASCADv(right) [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

**Figure 8.** Figure 8: Key Rank Charts for ResNets on Datasets ASCADf(left) and AS [PITH_FULL_IMAGE:figures/full_fig_p014_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

12 extracted references · 12 canonical work pages

[1]

Journal of Cybersecurity & Information Management 15(2) (2025)

Obaid, Z.M., Ali Alheeti, K.M.: Enhancing malware detection through elec- tromagnetic side-channel analysis using random forest classifier. Journal of Cybersecurity & Information Management 15(2) (2025)

work page 2025
[2]

Investigating Efficient Deep Learning Architectures For Side-Channel Attacks on AES

Berreby, Y.E., Sauvage, L.: Investigating efficient deep learning architec- tures for side-channel attacks on aes. arXiv preprint arXiv:2309.13170 (2023)

work page Pith review arXiv 2023
[3]

In: Advances in Cryptology—CRYPTO’99: 19th Annual International Cryptology Confer- ence Santa Barbara, California, USA, August 15–19, 1999 Proceedings 19

Kocher, P., Jaffe, J., Jun, B.: Differential power analysis. In: Advances in Cryptology—CRYPTO’99: 19th Annual International Cryptology Confer- ence Santa Barbara, California, USA, August 15–19, 1999 Proceedings 19. pp. 388–397. Springer (1999)

work page 1999
[4]

Journal of Cryptographic Engineering 10(2), 163–188 (2020)

Benadjila, R., Prouff, E., Strullu, R., Cagli, E., Dumas, C.: Deep learning for side-channel analysis and introduction to ascad database. Journal of Cryptographic Engineering 10(2), 163–188 (2020)

work page 2020
[5]

PloS one 20(4), e0315340 (2025)

Huang, H., Wu, J., Tang, X., Zhao, S., Liu, Z., Yu, B.: Deep learning-based improved side-channel attacks using data denoising and feature fusion. PloS one 20(4), e0315340 (2025)

work page 2025
[6]

John Savard: AES (Rijndael) Round Function [png image]. Wikime- dia Commons (1999), https://commons.wikimedia.org/wiki/File:AES_ (Rijndael)_Round_Function.png, dedicated to public domain under CC0 1.0 Universal (https://creativecommons.org/publicdomain/zero/1.0/)

work page 1999
[7]

In: International Workshop on Crypto- graphic Hardware and Embedded Systems

Mangard, S., Schramm, K.: Pinpointing the side-channel leakage of masked aes hardware implementations. In: International Workshop on Crypto- graphic Hardware and Embedded Systems. pp. 76–90. Springer (2006)

work page 2006
[8]

In: Proceedings of the IEEE conference on computer vision and pattern recognition

He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recog- nition. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

work page 2016

Show all 12 references

[9]

IACR Transactions on Cryptographic Hardware and Embedded Systems pp

Picek, S., Heuser, A., Jovic, A., Bhasin, S., Regazzoni, F.: The curse of class imbalance and conflicting metrics with machine learning for side-channel evaluations. IACR Transactions on Cryptographic Hardware and Embedded Systems pp. 209–237 (2019) 20 Mukesh Poudel and Nick Rahimi

2019
[10]

Mathematics 11(15), 3265 (2023)

Karayalcin, S., Perin, G., Picek, S.: Resolving the doubts: On the construc- tion and use of resnets for side-channel analysis. Mathematics 11(15), 3265 (2023)

2023
[11]

Cryptology ePrint Archive (2025)

Rousselot, N., Heydemann, K., Masure, L., Migairou, V.: Scoop: An opti- mizer for profiling attacks against higher-order masking. Cryptology ePrint Archive (2025)

2025
[12]

IACR Transactions on Cryptographic Hardware and Embedded Systems pp

Zaid, G., Bossuet, L., Habrard, A., Venelli, A.: Methodology for efficient cnn architectures in profiling attacks. IACR Transactions on Cryptographic Hardware and Embedded Systems pp. 1–36 (2020)

2020

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [1]

Journal of Cybersecurity & Information Management 15(2) (2025)

Obaid, Z.M., Ali Alheeti, K.M.: Enhancing malware detection through elec- tromagnetic side-channel analysis using random forest classifier. Journal of Cybersecurity & Information Management 15(2) (2025)

work page 2025

[2] [2]

Investigating Efficient Deep Learning Architectures For Side-Channel Attacks on AES

Berreby, Y.E., Sauvage, L.: Investigating efficient deep learning architec- tures for side-channel attacks on aes. arXiv preprint arXiv:2309.13170 (2023)

work page Pith review arXiv 2023

[3] [3]

In: Advances in Cryptology—CRYPTO’99: 19th Annual International Cryptology Confer- ence Santa Barbara, California, USA, August 15–19, 1999 Proceedings 19

Kocher, P., Jaffe, J., Jun, B.: Differential power analysis. In: Advances in Cryptology—CRYPTO’99: 19th Annual International Cryptology Confer- ence Santa Barbara, California, USA, August 15–19, 1999 Proceedings 19. pp. 388–397. Springer (1999)

work page 1999

[4] [4]

Journal of Cryptographic Engineering 10(2), 163–188 (2020)

Benadjila, R., Prouff, E., Strullu, R., Cagli, E., Dumas, C.: Deep learning for side-channel analysis and introduction to ascad database. Journal of Cryptographic Engineering 10(2), 163–188 (2020)

work page 2020

[5] [5]

PloS one 20(4), e0315340 (2025)

Huang, H., Wu, J., Tang, X., Zhao, S., Liu, Z., Yu, B.: Deep learning-based improved side-channel attacks using data denoising and feature fusion. PloS one 20(4), e0315340 (2025)

work page 2025

[6] [6]

John Savard: AES (Rijndael) Round Function [png image]. Wikime- dia Commons (1999), https://commons.wikimedia.org/wiki/File:AES_ (Rijndael)_Round_Function.png, dedicated to public domain under CC0 1.0 Universal (https://creativecommons.org/publicdomain/zero/1.0/)

work page 1999

[7] [7]

In: International Workshop on Crypto- graphic Hardware and Embedded Systems

Mangard, S., Schramm, K.: Pinpointing the side-channel leakage of masked aes hardware implementations. In: International Workshop on Crypto- graphic Hardware and Embedded Systems. pp. 76–90. Springer (2006)

work page 2006

[8] [8]

In: Proceedings of the IEEE conference on computer vision and pattern recognition

He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recog- nition. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

work page 2016