Physical access to debug ports (UART, JTAG, SWD) - Bus snooping and manipulation (SPI, I2C) - Side-channel attacks (power analysis, electromagnetic emanations) - Chip-off attacks (removing flash memory for direct reading) - Glitching attacks (voltage or clock manipulation to bypass security)