// phd candidate · lirmm × thales · final year

A little bit of DL-SCA

Deep-learning based side-channel attacks (DL-SCA) are a threat to highly-secured components such as cryptographic chips. This website summarizes my attempts at evaluating these threats.

read --writingcat papers.bibstatus: open to ml-based security research / engineering roles from november 2027
// live attacks, computed in your browser
demo://cpa · aes-128 · round 1 SubBytes · HW leakage● done
  1. 2bk00
  2. 7ek01
  3. 15k02
  4. 16k03
  5. 28k04
  6. aek05
  7. d2k06
  8. a6k07
  9. abk08
  10. f7k09
  11. 15k10
  12. 88k11
  13. 09k12
  14. cfk13
  15. 4fk14
  16. 3ck15

key recovered · 16/16 bytes · 173 simulated traces, correlated at build time. With JavaScript on, the attack runs live in your browser.

demo://template · aes-128 · 1st-order boolean masking○ idle

Every S-box output is split with a fresh random mask, so first-order CPA sees nothing. A template attack first learns the device on a clone, then recovers the key from the masked traces, racing a second-order CPA on the same data.

01 profile · clone device, key and masks known0 traces
02 attack · target device, key unknown, same masked traces for both

template · posterior per guess

  1. ··
  2. ··
  3. ··
  4. ··
  5. ··
  6. ··
  7. ··
  8. ··
  9. ··
  10. ··
  11. ··
  12. ··
  13. ··
  14. ··
  15. ··
  16. ··

cpa · 2nd order · |ρ| of the centred product

  1. ··
  2. ··
  3. ··
  4. ··
  5. ··
  6. ··
  7. ··
  8. ··
  9. ··
  10. ··
  11. ··
  12. ··
  13. ··
  14. ··
  15. ··
  16. ··
race · key bytes found vs traces (log)

ready

ls ./writing

ls -a →

animated · interactive

Is the gradient to blame for the plateau?

Previous research linked the plateau effect to relying on SGD-based training. Can gradient-free DL-SCA overcome the plateau?

cascade-2026 · animated · interactive

Is it really broken?

How the way the DL-SCA community computes guessing entropy leaves the door open to false positives. And an introduction to a robust distinguisher.

tches-2025 · animated · interactive

Scoop, explained: profiling attacks against higher-order masking

Scoop is a novel optimization algorithm, aimed at reducing the plateau effect. To achieve this, we made a theoretical study of what happens with gradient-based optimization against higher-order leakages.

whoami

Arthemis team, LIRMM · Advanced Security Team, Thales. Supervised by Loïc Masure, Karine Heydemann, Vincent Migairou and Philippe Maurine.

Teaching: Foundations of Deep Learning, Random Signals. ./teaching →

0x01

Foundations of DL based Side-Channel Attacks

I am fascinated by the plateau effect (Masure et al., 2023), its causes and how to overcome it (if possible). My main goal is to bring a deeper theoretical understanding to the very empirical DL-SCA field.

0x02

Optimization (for deep learning)

I am also passionate about optimization, whether it is for deep learning or more classical operational research. Luckily for me, most of the current profiled attacks rely on optimization (and even more so for post-quantum algorithms!).

cat papers.bib

talks & posters →