The Price of Peeking: Anytime-Valid Leakage Detection on ML-KEM EM Traces

We study anytime-valid leakage detection for side-channel evaluation: evaluators routinely inspect leakage tests while acquisition is still running and decide to extend or stop based on what they see, but fixed-horizon screening such as the Welch t-test with |t|>4.5 gives no error guarantee for this monitored decision rule. We use testing by betting (SKIT-type swap-pair e-processes), whose false-alarm probability is controlled uniformly over time under an explicit conditional symmetry null.

Key findings:

• Repeated looks break fixed-horizon screening: under exact designed nulls on recorded backgrounds, repeated-look |t|>4.5 screening over all 13,000-20,000 samples raised a false alarm in 2.7-12.9% of replicates, against 0.0-4.7% for terminal-only screening and no rejections for a sample-wise e-Bonferroni process.
• Anytime validity has a price: in matched comparisons sharing the frozen witness, rows and payoff, first-crossing detection needed 1.68-2.00x the traces of a fixed-horizon randomization test at 80% detection on synthetic streams, and 1.68-2.38x on degraded recordings from an open ML-KEM EM dataset (primary Ridge witness, α=0.05).
• When leakage is strong, monitoring pays off: on undegraded reference and pqm4 recordings, the monitored procedure stopped at a median of 62-72 and 146-316 evaluation traces, i.e. 2-8% of a conservative 4,096-trace budget.
• In a prespecified follow-up, the e-Bonferroni process detected natural-label associations in 4 of 4 backgrounds after 840-3,288 traces.

All recordings come from one device and natural-label results are descriptive; the paper states the assumptions each claim requires. Code and data are open (DOI and GitHub links above).