You have two defences running. The certificate bounds where the machine may go, and the energy monitor from module one raises an alarm when power departs from prediction by more than three standard deviations. So an adversary does the obvious thing: it modulates inside the safe span, and it keeps the amplitude just under the alarm. The question is what that leaves it. Treat the power trace as a communication channel against the monitor's own two point nine watt residual, at the three hertz rate the robot's perception already runs at. Modulating right at the eight point seven watt threshold, never once tripping it, carries about five bits per second. Eighteen kilobits in an hour. That is enough for a key, a credential, or a fingerprint of the model. The detection floor does not close the channel, and the monitor in question is the one this course built.