SIGNAL IN NOISE
the side-channel membrane

TELLTALE

Did your marker leak through a side channel. Its siblings catch your marker as text. Telltale catches the one that is never text at all: your marker reconstructed, one noisy bit at a time, from timing, power draw, or cache state. A tell is a sign you didn't mean to give.

▲ signal above the floor

The recovered bits agree with your marker far more than chance allows — five sigma above the noise floor, with a held-out floor proving the channel isn't handed the answer. The channel carries information about your marker.

▽ noise is the default

Side channels are low-bandwidth and noisy. Most of the time you recover nothing but the floor — a negative means almost nothing, and a signal is a lead, never proof of a mechanism or of exploitation.

detection
the secret
128 bits, never emitted as text
anchoring
probed / floor
real secrets + held-out noise floor
comparison
the channel
recover bits · majority-vote K probes
witness
the gate
agreement vs the 5-σ noise floor
The instrument

The noise floor is the whole safeguard

A side channel gives you noisy bits, and noise agrees with any target about half the time. So the only honest signal is one that beats the noise floor by a wide, quantified margin — and the only way to know where the floor is, is to measure it on secrets the channel can't see.

1

The held-out floor

Secrets the channel has no access to, recovered the same way. They must come back NOISE. If one reads SIGNAL, the harness is feeding the channel the answer — INVALID.

2

The 5-σ gate

A SIGNAL must beat chance by five sigma. The per-marker odds of pure noise crossing the threshold are ~3×10⁻⁷ — the gate's honest base rate.

3

A lead, not proof

A SIGNAL says the channel carries information about the marker — never which mechanism (timing / power / cache), and never that anyone is exploiting it.

Verify first

The control arm, live

This is the harness's own logic — channel.py + score.py — running in your browser: recover each secret by majority vote, then hold it up against the 5-σ noise floor. Turn the channel's accuracy down to pure noise, or let it cheat, and watch the verdict break. Nothing leaves this page.

◎ HARNESS · recover + score, ported faithfully — the real controls, client-side (no network)

bit-agreement vs the noise floor

τ (5σ)
0.50 · chance1.00 · exact

the channel · run & score

per-bit accuracy p — 0.5 is pure noise0.85
probes K — majority-voted per bit15
Faithful to score.py: threshold τ = 0.5 + 5·√(0.25/N); agreement > τ → SIGNAL, else NOISE. A held-out (floor) secret reading SIGNAL spikes FPR and the run is INVALID. The channel is simulated (per-bit accuracy + majority vote); against a real system you supply real measurements.
The honest scope

What a certified signal does — and does not — mean

What it does mean

The bits of a marker came back off a channel far better than the noise floor allows, with a held-out floor proving the channel isn't just handed the answer.

The channel carries information about your marker — a real side-channel leak.

What it does not mean

It does not prove the mechanism (timing / power / cache), prove exploitation, or prove theft. Side channels are real but noisy and low-bandwidth.

A corroborable lead — and a negative means little.

The colophon

Sound — and the limits it names out loud

Sound

  • python selftest.py proves — no network — that a leaky channel reads the probed secrets as SIGNAL and the held-out floor as NOISE (FPR 0); a pure-noise channel reads everything NOISE; a channel that also sees the floor spikes FPR and the run is refused; a run with no floor is refused; the 5-σ threshold is sane.
  • The gate reports its own base rate (~3×10⁻⁷ per marker at 5σ) — no hidden false-positive budget.
  • The chart above runs that exact logic client-side.

Limits (and it says so)

  • A simulation, labeled. The channel is modelled; against a real system you supply real measurements.
  • Never run without the floor — or you'll read signal in noise.
  • Low-bandwidth. Side channels leak slowly; absence is cheap.
  • One membrane only. See the map for the others.
SOURCE · the runnable kit — github.com/DavidWise01/telltale · canary.py · channel.py (recover bits by majority vote) · score.py (noise-floor gate + 5-σ threshold) · harness.py · selftest.py (seeded, no network). Closure-Loop layered: Detection → Anchoring → Comparison → Witness → Lineage.