Paper 2026/1085 Original: eprint.iacr.org/2026/1085 ↗

Autonomous LLM-Orchestrated Side-Channel Extraction Against Fully Unrolled and Masked Architectures

Abstract

Unrolled cryptographic hardware architectures are increasingly deployed to maximize throughput, inherently intro- ducing massive algorithmic noise floors that frequently thwart traditional temporal Side-Channel Analysis (SCA). However, the reliance on structural combinational noise as a standalone coun- termeasure remains underexplored against adaptive, AI-driven profiling. This work presents a novel autonomous framework uti- lizing a Large Language Model (LLM) agent to orchestrate and execute differential power evaluations against a 161,000-gate fully unrolled AES-128 core on a target CW305 FPGA. We first estab- lish a baseline, demonstrating that standard Correlation Power Analysis (CPA) systematically fails to penetrate the unrolled noise floor, yielding statistically insignificant correlations (r ≈ 0.11). In response to this heuristic failure, the autonomous agent dynamically pivots to a Zero-State Differential Power Isolation methodology. By leveraging single-channel baseline subtraction, the agent mathematically cancels multi-round algorithmic noise from the global power trace, successfully isolating the target combinational leakage and achieving peak correlations exceeding r = 0.318 across all 16 state bytes. Furthermore, by comparing the extracted physical signatures to the logical target state, the framework autonomously extracts 16 unique physical-to-logical routing maps. This demonstrates that while automated Electronic Design Automation (EDA) synthesis inadvertently introduces physical bit-level obfuscation, these synthesis optimizations can be systematically reverse-engineered by agentic profiling. Ultimately, this work proves that unrolled combinational architectures can- not serve as a robust defense against adaptive, autonomous side- channel characterization.