“It is very difficult to build classifiers capable of detecting when an AI system is performing a side-channel attack.”