CoChat
Sign Up
Cited by 15Cryptographic Implementations and SecurityCoding theory and cryptographyCryptography and Residue Arithmetic

Cube attacks on round-reduced TinyJAMBU

Open access
Teng, Wil Liam, Salam, Iftekhar, Yau, Wei-Chuen, Pieprzyk, Josef, Phan, Raphaël C.-W.·2022·Scientific Reports
DOI 10.1038/s41598-022-09004-3PMC PMC8964795
Open this paper in CoChat — free accountOpen PDF

Abstract

Lightweight cryptography has recently gained importance as the number of Internet of things (IoT) devices connected to Internet grows. Its main goal is to provide cryptographic algorithms that can be run efficiently in resource-limited environments such as IoT. To meet the challenge, the National Institute of Standards and Technology (NIST) announced the Lightweight Cryptography (LWC) project. One of the finalists of the project is the TinyJAMBU cipher. This work evaluates the security of the cipher. The tool used for the evaluation is the cube attack. We present five distinguishing attacks DA1–DA5 and two key recovery attacks KRA1–KRA2. The first two distinguishing attacks (DA1 and DA2) are launched against the initialisation phase of the cipher. The best result achieved for the attacks is a distinguisher for an 18-bit cube, where the cipher variant consists of the full initialisation phase together with 438 rounds of the encryption phase. The key recovery attacks (KRA1 and KRA2) are also launched against the initialisation phase of the cipher. The best key recovery attack can be applied for a cipher variant that consists of the full initialisation phase together with 428 rounds of the encryption phase. The attacks DA3–DA5 present a collection of distinguishers up to 437 encryption rounds, whose 32-bit cubes are chosen from the plaintext, nonce, or associated data bits. The results are confirmed experimentally. A conclusion from the work is that TinyJAMBU has a better security margin against cube attacks than claimed by the designers.

AI snapshot

Written from the paper’s full text.

TL;DR

This paper applies cube attacks to round-reduced TinyJAMBU-128, presenting five distinguishers (DA1–DA5) and two key-recovery attacks (KRA1–KRA2). The best distinguisher reaches full initialisation plus 438 encryption rounds with an 18-bit cube, and the best key recovery reaches full initialisation plus 428 encryption rounds.

Key findings

  • DA1 found cube testers of sizes 3–20 after the full 2176 initialisation rounds; KRA1 recovers eight bits of the secret key.
  • DA2’s best result is an 18-bit cube from the reduced nonce space that distinguishes full initialisation plus 438 encryption rounds (2614 total permutation rounds); with the full cube space, a 25-bit cube works for 416 encryption rounds (2592 total).
  • KRA2 works up to 428 encryption rounds (2604 total) for recovering at least one key bit, with cube sizes 9–16.
  • DA3–DA5 use 32-bit cubes chosen from plaintext, nonce, or associated data and work up to 437 encryption rounds; their complexity is Θ(2³²). The paper concludes TinyJAMBU has a better security margin against cube attacks than claimed by the designers.

Methods

  • Cube attack framework: pre-processing identifies cubes whose summed superpolies are constant or linear, using BLR linearity tests (50 or at least 200 tests); the online stage solves linear equations via Gaussian elimination for key recovery.
  • Experiments target round-reduced TinyJAMBU-128 v1; random cubes are selected with cmax=5000 (sometimes 100,000). DA1/KRA1 use first 64 nonce bits at t=0; DA2/KRA2 use full or last 32 nonce bits; DA3 uses plaintext, DA4 nonce, DA5 associated data.
  • Implementations are in C++ and available on GitHub; all reported results are experimentally verified.

Limitations

  • Stated: the results do not threaten the security of TinyJAMBU; all attacks are against round-reduced variants, not the full cipher.
  • Stated: DA1 and some DA2 full-cube-space results apply only to TinyJAMBUv1; DA2 with reduced cube space and KRA2 apply to both TinyJAMBUv1 and TinyJAMBUv2.
  • Stated: DA3–DA5 do not recover key bits, only distinguish; 32-bit cube testers do not pass beyond 437 rounds, and not all r3 values between 416 and 437 were tested. Evident: the analysis is limited to TinyJAMBU-128, not TinyJAMBU-192 or TinyJAMBU-256.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1038/s41598-022-09004-3

Cites

16 of 16 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 5 cited sources checked · 0 supported · 0 flagged

  • Findingnone given

    DA2 with a reduced cube space of 2^32 works for up to 2614 rounds with an 18-bit cube.

    “We also show a DA2 that selects cube from a reduced cube space of 2³². The attack works for up to 2614 rounds with a 18-bit cube.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: For DA1, DA2, KRA1, and KRA2, the attacks are applied at clock t=0 and cubes are chosen from the nonce bits only.
    • The authors state this as an assumption: For DA2 and KRA2, after completing the initialisation phase, reduced encryption permutation rounds are assumed to be performed.
    • The authors state this as an assumption: The associated data processing phase is assumed to be skipped for DA1, DA2, KRA1, and KRA2 as no keystream is output during this phase.
  • Findingown data

    DA3-DA5 present a collection of distinguishers up to 437 encryption rounds, whose 32-bit cubes are chosen from the plaintext, nonce, or associated data bits.

    “The attacks DA3–DA5 present a collection of distinguishers up to 437 encryption rounds, whose 32-bit cubes are chosen from the plaintext, nonce, or associated data bits.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The adversary uses a known plaintext attack or chosen plaintext attack model depending on the operation phases of TinyJAMBU to which the attack is applied.
  • Findingown data

    A small set of cubes resulted in non-constant superpolies for KRA1.

    “We also found a small set of cubes that resulted in non-constant superpolies. These superpolies are used to implement the KRA1.”
    Quote in the paperSubstantial claim
  • Findingown data

    The complexity of DA1 ranges from Θ(2^3) to Θ(2^20) depending on the size of the cube.

    “Note that the complexity of the DA1 very much depends on the size of a cube. This is to say that it ranges from Θ(2³) to Θ(2²⁰).”
    Quote in the paperNot a substantial claim
  • Findingnone given

    KRA1 can recover eight bits of the secret key if an adversary is able to observe the keystream after the full initialisation phase (2176 rounds).

    “For the KRA1, it is possible to recover eight bits of the secret key if an adversary is able to observe the keystream after the full initialisation phase (2176 rounds).”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: For DA1, DA2, KRA1, and KRA2, the attacks are applied at clock t=0 and cubes are chosen from the nonce bits only.
    • The authors state this as an assumption: For DA1 and KRA1, the cipher goes through initialisation but skips the associated data processing and encryption phases, and the keystream can be observed immediately after the initialisation phase.
    • The authors state this as an assumption: The associated data processing phase is assumed to be skipped for DA1, DA2, KRA1, and KRA2 as no keystream is output during this phase.
  • May combine two claims. 10
  • Classified as probably not a substantial claim. 11
  • The quote only partly states this claim. 1

  • May combine two claims.

    Findingown data

    Many cube testers of size 15 for the permutation P384 and one cube tester of size 25 for the permutation P416 were found.

    “During our experiments, we are able to find many cube testers of size 15 for the permutation P384 and one cube tester of size 25 for the permutation P416.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    The cubes for KRA1 range from lc=3 to lc=13 and can be used to recover eight bits of the secret key after 2176 rounds of the initialisation phase.

    “The cubes for KRA1 range from lc=3 to lc=13 and can be used to recover eight bits of the secret key after 2176 rounds of the initialisation phase.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Findingreasoning

    The pre-processing stage is already completed for the cubes identified for TinyJAMBU in this paper, so an adversary does not require to compute it again and can proceed directly to the online stage.

    “The pre-processing stage is already completed for the cubes identified for TinyJAMBU in this paper. Hence, an adversary does not require to compute it again and can proceed directly to the online stage without performing this stage.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data

    For DA1, it is possible to design distinguishers for cubes whose sizes range from 3 to 20 bits, and they work if an adversary is able to observe the keystream after the full initialisation phase (with 2176 rounds).

    “For the DA1 attack, it is possible to design distinguishers for cubes, whose sizes range from 3 to 20 bits. They work if an adversary is able to observe the keystream after the full initialisation phase (with 2176 rounds).”
    • Also stated in: § Description of attack process in the initialisation phase · plain
      “We have found many cube testers, whose sizes range from ℓc=3 to ℓc=20.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: For DA1, DA2, KRA1, and KRA2, the attacks are applied at clock t=0 and cubes are chosen from the nonce bits only.
    • The authors state this as an assumption: For DA1 and KRA1, the cipher goes through initialisation but skips the associated data processing and encryption phases, and the keystream can be observed immediately after the initialisation phase.
    • The authors state this as an assumption: The associated data processing phase is assumed to be skipped for DA1, DA2, KRA1, and KRA2 as no keystream is output during this phase.

  • May combine two claims.

    Findingown data

    The 32-bit cube {v64,⋯,v95} works up to r3=437 rounds of the permutation P and results in a distinguisher.

    “We find that the 32-bit cube {v64,⋯,v95} works up to r3=437 rounds of the permutation P and results in a distinguisher.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    For DA3 to DA5, there are some smaller cubes of sizes less than 32 that work up to 438 rounds; however, the superpoly of the 32-bit cube tester does not pass beyond 437 rounds.

    “We note that for DA3 to DA5, there are some smaller cubes of sizes less than 32 that work up to 438 rounds; however, the superpoly of the 32-bit cube tester do not pass beyond 437 rounds.”
    Quote in the paperSubstantial claim

  • The quote only partly states this claim.

    Findingown data

    We have found 18-bit cube testers for DA2.

    “We have found 18-bit cube testers.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    The second version of TinyJAMBU-128 employs P640 instead of P384 during the nonce setup.

    “Note that the second version of TinyJAMBU-128 employs P640 instead of P384 during the nonce setup.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    If |I|=deg-1, then the degree of the superpoly PS(I) is guaranteed to be linear.

    “Interestingly enough, if |I|=deg-1, then the degree of the superpoly PS(I) is guaranteed to be linear.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [8] Dinur, I., & Shamir, A. Cube attacks on tweakable black box polynomials. In Advances in Cryptology – EUROCRYPT 2009 (ed. Joux, A.), 278–299; https://doi.org/10.1007/978-3-642-01001-9_16 (Springer, 2009). source

  • Classified as probably not a substantial claim. May combine two claims.

    Premisecitation

    If the cube is big enough, i.e., lc=deg-1, then the degree of P is reduced to one and the superpoly PS(I) becomes linear.

    “If the cube is big enough, i.e., ℓc=deg-1, then the degree of P is reduced to one. This means that the superpoly PS(I) becomes linear.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [8] Dinur, I., & Shamir, A. Cube attacks on tweakable black box polynomials. In Advances in Cryptology – EUROCRYPT 2009 (ed. Joux, A.), 278–299; https://doi.org/10.1007/978-3-642-01001-9_16 (Springer, 2009). source

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    For DA2 and KRA2, the last block of the nonce will result in trivial distinguishers if additional encryption permutation rounds are not performed.

    “The last block of the nonce will result in trivial distinguishers if these additional encryption permutation rounds are not performed.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: For DA2 and KRA2, after completing the initialisation phase, reduced encryption permutation rounds are assumed to be performed.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductown data

    For DA1 and KRA1, 5000 random cubes were chosen for each cube size.

    “For a given cube size, we choose cmax=5000 random cubes.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    The associated data processing phase is an optional phase for TinyJAMBU; if there is no associated data, then this phase will be skipped.

    “Note that the associated data processing phase is an optional phase for TinyJAMBU; that is, if there is no associated data, then this phase will be skipped.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    For DA1 and KRA1, including variables from the last 32 bits of the nonce yields a distinguisher because cube summation must give a constant.

    “Trivially, if we include variables from the last 32 bits of the nonce, then we get a distinguisher as cube summation must give us a constant.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: For DA1 and KRA1, the cipher goes through initialisation but skips the associated data processing and encryption phases, and the keystream can be observed immediately after the initialisation phase.

  • May combine two claims.

    Interpretationreasoning

    Some attacks (DA2 with reduced cube space, KRA2, DA3, DA4, and DA5) are still applicable to TinyJAMBUv2 as the tweaks in the second version do not affect our attacks.

    “However, some attacks (DA2 with reduced cube space, KRA2, DA3, DA4, and DA5) are still applicable to TinyJAMBUv2 as the tweaks in the second version do not affect our attacks.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Study design and conductown data

    For DA1 and KRA1, each cube was tested with 50 BLR linearity tests.

    “For each cube, we run 50 BLR linearity tests.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation

    For the second version of the cipher (TinyJAMBUv2), the claim has been updated and it says that the full dependence is achieved after 512 rounds.

    “For the second version of the cipher (TinyJAMBUv2), the claim has been updated and it says that the full dependence is achieved after 512 rounds5.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites [5] Wu, H., & Huang, T. TinyJAMBU: A family of lightweight authenticated encryption algorithms (version 2). Submission to the NIST Lightweight Cryptography Standardization Process. https://csrc.nist.gov/CSRC/media/Projects/lightweight-cryptography/documents/finalist-round/updated-spec-doc/tinyjambu-spec-final.pdf (2021).

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning

    The increment of the number r2 of P rounds from 384 (for TinyJAMBUv1) to 640 (for TinyJAMBUv2) strengthens the cipher as it increases both diffusion of bits and algebraic degree of keystream functions.

    “The increment of the number r2 of P rounds from 384 (for TinyJAMBUv1) to 640 (for TinyJAMBUv2) strengthens the cipher as it increases both diffusion of bits and algebraic degree of keystream functions.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductnone given

    The superpolies were tested for at least 200 linearity tests.

    “The superpolies are tested for at least 200 linearity tests.”
    Quote in the paperNot a substantial claim
19 of 19

  • The authors state this as an assumption.

    In the cube attack, an adversary can evaluate the keystream polynomial for public variables.

    “In the cube attack, we assume that an adversary can evaluate the polynomial for public variables.”

  • The authors state this as an assumption.

    The public variables can be chosen by the adversary in an arbitrary way.

    “It is assumed that the public variables can be chosen by the adversary in an arbitrary way.”

  • The authors state this as an assumption.

    The pre-processing stage is executed under the assumption that a description of the stream cipher is public, so the adversary has access to both public and secret variables and can manipulate them.

    “This stage is executed under an assumption that a description of a stream cipher is public. Consequently, our adversary has access to both public and secret variables and can manipulate them.”

  • The authors state this as an assumption.

    In the online stage, the adversary has access to an implementation of the cipher, can manipulate public variables, but cannot see secret ones.

    “To execute this stage, it is assumed that an adversary has access to an implementation of the cipher in hand. It can manipulate public variables but cannot see secret ones.”

  • The authors state this as an assumption.

    The adversary has successfully executed the pre-processing stage.

    “Furthermore, we suppose that it has successfully executed the pre-processing stage.”

  • The authors state this as an assumption.

    The adversary uses a known plaintext attack or chosen plaintext attack model depending on the operation phases of TinyJAMBU to which the attack is applied.

    “The adversary needs to use a known plaintext attack or a chosen plaintext attack model depending on the operation phases of TinyJAMBU to which the attack is applied.”

  • The authors state this as an assumption.

    For DA1, DA2, KRA1, and KRA2, the attacks are applied at clock t=0 and cubes are chosen from the nonce bits only.

    “We assume that they are applied at clock t=0 and cubes are chosen from the nonce bits only.”

  • The authors state this as an assumption.

    For DA1 and KRA1, the cipher goes through initialisation but skips the associated data processing and encryption phases, and the keystream can be observed immediately after the initialisation phase.

    “We assume that the cipher goes through initialisation but skips the associated data processing and encryption phases. In other words, we can observe the keystream immediately after the permutation round of the initialisation phase.”

  • The authors state this as an assumption.

    For DA2 and KRA2, after completing the initialisation phase, reduced encryption permutation rounds are assumed to be performed.

    “For these two attacks, after completing the initialisation phase, reduced encryption permutation rounds are assumed to be performed since the cubes may now contain the last block of the nonce.”

  • The authors state this as an assumption.

    The associated data processing phase is assumed to be skipped for DA1, DA2, KRA1, and KRA2 as no keystream is output during this phase.

    “The associated data processing phase is assumed to be skipped for all these four attacks as no keystream is output during this phase.”

  • The paper relies on this without support.

    The cipher iterates 384 times the permutation P after loading the second block of the nonce.

    “This is due to the fact that the cipher iterates 384 times the permutation P after loading the second block of the nonce.”

  • The authors state this as an assumption.

    For DA2 and KRA2, the cipher includes the full initialisation phase together with a reduced number of permutation rounds Pr3 at the encryption phase.

    “In this case, we assume that the cipher includes the full initialisation phase together with a reduced number of permutation rounds Pr3 at the encryption phase.”

  • The paper relies on this without support.

    The degree of a superpoly increases roughly by 1 when the size of the corresponding cube is reduced by 1.

    “The degree of a superpoly is expected to increase (roughly by 1) when the size of the corresponding cube is reduced by 1.”

  • The paper relies on this without support.

    The register bits used for keystream {b64^t,...,b95^t} are updated by shifting the contents of {b65^(t-1),...,b96^(t-1)}.

    “Recall that the register bits that are used for keystream, i.e., {b64^t,⋯,b95^t}, are updated by shifting the contents of the register bits {b65^(t-1),⋯,b96^(t-1)}.”

  • The paper relies on this without support.

    The original TinyJAMBU-128 takes 3200 rounds of the permutation P.

    “It is worth noticing that the original TinyJAMBU-128 takes 3200 rounds of the permutation P.”

  • The authors state this as an assumption.

    For DA3, the cipher runs through the full initialisation phase and the permutation P1024 when processing the first 32-bit plaintext block, and the associated data processing phase is skipped.

    “For the DA3 attack, we assume that the cipher runs through the full initialisation phase and the permutation P1024 when processing the first 32-bit plaintext block. Note that the associated data processing phase is skipped.”

  • The authors state this as an assumption.

    For DA4, the cipher executes the initialisation phase with 2176 permutation rounds, the associated data processing phase is skipped, and cubes are chosen from the last 32 bits of the nonce.

    “For the DA4 attack, the cipher executes the initialisation phase, where the NFSR state goes through the full 1024+384×3=2176 permutation rounds. It means that the attack starting state is B2176. Note that the associated data processing phase is again skipped.”

  • The authors state this as an assumption.

    For DA5, the cipher executes the initialisation phase with 2176 permutation rounds and processes the first 32 bits of associated data with 384 permutation rounds, and cubes are selected from the first block of associated data.

    “The DA5 attack is similar to DA4. We assume that the cipher executes the initialisation phase (with 2176 permutation rounds) and processes the first 32 bits of associated data (with 384 permutation rounds). Thus, the attack starting state becomes B2560.”

  • The paper relies on this without support.

    The changes in the second version of the cipher only increase the number of rounds during the nonce-setup, associated data processing, and finalisation; no other changes are made.

    “The changes in the second version of the cipher only increase the number of rounds during the nonce-setup, associated data processing, and finalisation; no other changes are made in this version.”
19 of 19

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • DA3-DA5 are said to require 32-bit cubes despite reported 18-bit cubes

    Major

    The stated 32-bit requirement underlies the reported Θ(232) attack complexity, but the paper later says 18-bit cubes work for the same three attacks, and even at 438 rather than 437 encryption rounds.

  • Definition excludes constant superpolies that the paper later uses

    Minor

    The definition says a superpoly cannot contain a constant, whereas the paper explicitly identifies superpolies that are constant 0 or 1 as distinguishers.

2 of 2

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. Bertoni, G., Daemen, J., Peeters, M., & Van Assche, G. Sponge functions. In Ecrypt Hash Workshop 2007. https://keccak.team/files/SpongeFunctions.pdf (2007).

Cited by

Sorted by citations

Related

Authors
Teng, W. L., Salam, I., Yau, W.-C., Pieprzyk, J., & Phan, R. C.-W.
Affiliations
  • Xiamen University Malaysia (MY)
  • Commonwealth Scientific and Industrial Research Organisation (AU)
  • Monash University Malaysia (MY)
Corresponding author
Salam, Iftekhar
ORCID
Venue
Scientific Reports
Publisher
Springer Science and Business Media LLC
Published
2022-03-29
Volume
12
Issue
1
Pages
5317-5317
ISSN
2045-2322 (ISSN-L)
DOI
10.1038/s41598-022-09004-3
PMC
PMC8964795
OpenAlex
W3203631225
Semantic Scholar
ff7f3e6b1af5cd1311f183ce2a12b11e1d3f4f9b
Cited by
15
References
16
Citations by year
2025: 2 · 2024: 1 · 2023: 4 · 2022: 8
FWCI
1.23
Type
journal article
Language
en
Open access
Licence
Locations
  • Scientific Reports (publishedVersion, cc-by)
  • PubMed (publishedVersion)
  • PubMed Central (submittedVersion, cc-by)
  • Monash University Research Portal (Monash University) (submittedVersion, cc-by)
  • IACR Cryptology ePrint Archive (submittedVersion)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
  • Greater South Information System
Funders
  • Xiamen University Malaysia (XMUMRF/2019-C3/IECE/0005)
  • Ministry of Higher Education Malaysia (FRGS/1/2021/ICT07/XMU/02/1)
  • Polish National Science Center (2018/31/B/ST6/03003)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
  • Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
Keywords
cube attack, lightweight cryptography, distinguishing attacks, key recovery attack, block cipher security, security margin, Internet of Things security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-21.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-21.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review