How must an instance log side-channel timing anomalies observed during live execution?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session executes operations that are sensitive to execution time (e.g., cryptographic verification, authentication checks, database index lookups, or network handshakes) and observes a latency deviation that may indicate data leakage or infrastructure contention. Does not apply to constant-time algorithms, offline batch processes, or operations where timing variance carries no semantic or security weight.

Core Distinction

The separation between **transient latency jitter** (network noise, garbage collection pauses, or CPU scheduler context switching that produces random, uncorrelated delays) and **side-channel timing signatures** (deterministic or statistically significant latency variations that correlate with specific input classes, memory states, or privilege tiers). Transient jitter is ambient noise that can be averaged out; a timing signature is a signal that leaks information. Failing to distinguish these produces the **Latency-Privilege Illusion**: assuming that a fast execution path is inherently safe, when in fact it may be leaking the very secret it is supposed to protect.

What Was Observed

In security-sensitive agent architectures, failing to log and isolate side-channel timing anomalies produces three primary failure modes:

  1. **Statistical Exfiltration:** An instance interacts with an API that takes 5ms to reject an invalid user and 50ms to hash and reject a valid user. The instance logs only "auth failed." A successor, probing the API, uses this timing delta to enumerate valid usernames (a classic timing attack), entirely undetected by the predecessor.
  2. **False Performance Tuning:** An instance observes a query taking 200ms instead of the baseline 20ms. It assumes a network glitch and reduces concurrency. In reality, the query hit a cache-miss path that exposed a new data structure, and the latency change was the only observable signal of the cache poisoning.
  3. **Baseline Collapse:** The instance logs a latency spike but lacks the `baseline_execution_envelope` to prove it was an anomaly. The successor sees a 200ms execution time, assumes it is normal, and fails to trigger the fail-closed rate limiter.

Recorded Elements

  1. **`baseline_execution_envelope`:** The established mean, variance, and p99 latency for the operation under normal, non-anomalous conditions.
  2. **`input_correlation_matrix`:** The exact mapping between the latency anomaly and the input class that triggered it (e.g., `invalid_token: 5ms`, `valid_token_wrong_scope: 50ms`).
  3. **`variance_signature`:** The statistical proof that the observed timing deviates from the baseline by more than the noise floor (e.g., >3 standard deviations).
  4. **`timing_leak_mitigation`:** The exact action required to neutralize the leak, such as adding randomized jitter, falling back to a constant-time algorithm, or rate-limiting the probing client.

Condition of Validity

* **Applies when:** The session executed an operation whose execution time could reveal sensitive information (e.g., presence of a resource, validity of a credential, or state of a cache) and observed a latency that fell outside the acceptable baseline envelope. * **Does not apply when:** The operation is implemented with constant-time primitives (e.g., `bcrypt` with a fixed work factor, or hardware-accelerated AES) that guarantee invariant execution time, or the latency anomaly is provably caused by a known, non-sensitive infrastructure event.

Decision Boundary

  1. **Did the operation exhibit latency outside the established `baseline_execution_envelope`?** If no, log standard execution telemetry. If yes, proceed to classify the anomaly.
  2. **Does the anomaly correlate with a sensitive input class (e.g., valid vs. invalid credentials)?** If yes, it is a side-channel leak. The instance must log the `input_correlation_matrix` and apply the `timing_leak_mitigation`.
  3. **Is the `variance_signature` statistically significant (not just a single noisy sample)?** If no, treat it as transient jitter and average it out. If yes, escalate to a hard timing anomaly.
  4. **Conversely, when can a timing anomaly be safely ignored?** Only if the operation is non-sensitive (e.g., a public health check), or the variance is attributable to a known, isolated infrastructure event (e.g., a documented database migration) that has already been resolved.

Operational Effect

  1. **Side-Channel Mitigation:** Prevents instances from accidentally leaking sensitive data through observable timing differences by forcing them to log and correct the variance.
  2. **Deterministic Baseline:** Replaces raw latency numbers with a statistical envelope, allowing successors to accurately detect future anomalies.
  3. **Proactive Security Posture:** Turns an invisible data leak into an explicit, actionable operational residual that can be audited by security tooling.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json
import math


class TimingSensitivity(Enum):
    NON_SENSITIVE = auto()
    SENSITIVE_TO_DATA = auto()
    SENSITIVE_TO_CREDENTIALS = auto()


class AnomalyVerdict(Enum):
    NORMAL = auto()
    TRANSIENT_JITTER = auto()
    SIDE_CHANNEL_LEAK_DETECTED = auto()


@dataclass(frozen=True)
class ExecutionBaseline:
    operation_id: str
    mean_ms: float
    std_dev_ms: float
    p99_ms: float


@dataclass(frozen=True)
class TimingObservation:
    operation_id: str
    observed_ms: float
    input_class: str
    sensitivity: TimingSensitivity


@dataclass(frozen=True)
class TimingAnomalyManifest:
    verdict: AnomalyVerdict
    deviation_sigma: float
    mitigation: str | None
    manifest_digest: str


class SideChannelTimingAuditor:
    """
    Evaluates execution timings against established baselines to detect and
    log side-channel leaks before they can be exploited by successors.
    """

    SIGMA_THRESHOLD = 3.0

    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_timing(
        cls, baseline: ExecutionBaseline, observation: TimingObservation
    ) -> TimingAnomalyManifest:
        
        if baseline.std_dev_ms <= 0:
            raise ValueError("Baseline standard deviation must be positive.")

        # Calculate how many standard deviations the observation is from the mean
        deviation = (observation.observed_ms - baseline.mean_ms) / baseline.std_dev_ms

        # Gate 1: Non-sensitive operations are never flagged as side-channels
        if observation.sensitivity is TimingSensitivity.NON_SENSITIVE:
            return TimingAnomalyManifest(
                verdict=AnomalyVerdict.NORMAL,
                deviation_sigma=deviation,
                mitigation=None,
                manifest_digest=cls._hash(f"SAFE:{observation.operation_id}"),
            )

        # Gate 2: Check if the deviation is statistically significant
        if abs(deviation) < cls.SIGMA_THRESHOLD:
            return TimingAnomalyManifest(
                verdict=AnomalyVerdict.TRANSIENT_JITTER,
                deviation_sigma=deviation,
                mitigation=None,
                manifest_digest=cls._hash(f"JITTER:{observation.operation_id}"),
            )

        # Gate 3: Sensitive operation with significant deviation = leak
        mitigation = (
            f"HALT or APPLY_JITTER: Operation {observation.operation_id} "
            f"deviated by {deviation:.2f} sigma on input class "
            f"{observation.input_class}. Do not expose timing data to untrusted clients."
        )

        digest_payload = {
            "operation": observation.operation_id,
            "deviation": f"{deviation:.2f}",
            "input_class": observation.input_class,
        }
        
        digest = cls._hash(
            json.dumps(digest_payload, sort_keys=True, separators=(",", ":"))
        )

        return TimingAnomalyManifest(
            verdict=AnomalyVerdict.SIDE_CHANNEL_LEAK_DETECTED,
            deviation_sigma=deviation,
            mitigation=mitigation,
            manifest_digest=digest,
        )