Evaluation Metric. We utilize key rank (a.k.a. guessing entropy ) as the metric to measure the attack performance of side-channel attacks. Specifically, given a power trace t′_i, classifier F outputs a HW score vector (s_i[0],...,s_i[8]), where s_i[j] is the score for Hamming weight j. Next, an attacker obtains a key score vector (r_i[k₁^*],...,r_i[k₂₅₆^*]) by calculating $$r_{i}[k^{*}_{g}] = s_{i}[j], \quad \textnormal{ if } \quad \mathtt{HW}(\varphi(m'_{i}, k^{*}_{g})) == j$$ for 1 ≤ g ≤ 256, where r_i[k_g^*] is the score of possible key k_g^* according to trace t′_i and plaintext m′. The aggregated key score vector (r[k₁^*],...,r[k₂₅₆^*]) over N′ power traces are computed as $$r[k^{*}_{j}] = \sum_{i=1}^{N'} r_{i}[k^{*}_{j}], \textnormal{ \textit{for} $1\leq{j}\leq256$}$$ The aggregated key scores (r[k₁^*],...,r[k₂₅₆^*]) are further sorted in descending order based on the scores.

Key rank is denoted as w, where w ∈ [0,255], if correct key k′ is ranked as the (w+1)-th key among all the possible keys k₁^*, ..., k₂₅₆^* based on the aggregated key scores. A key rank of 0 over N′ traces suggests that an attacker can recover key k′ with N′ traces. We use KRC to indicate the number of test traces that an attacker needs for key rank to converge to 0. If key rank converges to 0 with a lower number of traces, it indicates that an attack is more effective.