Differential-Neural Cryptanalysis on AES
Open accessAbstract
Based on the framework of a multi-stage key recovery attack for a large block cipher, 2 and 3-round differential-neural distinguishers were trained for AES using partial ciphertext bits. The study introduces the differential characteristics employed for the 2-round ciphertext pairs and explores the reasons behind the near 100% accuracy of the 2-round differential neural distinguisher. Utilizing the trained 2-round distinguisher, the 3-round subkey of AES is successfully recovered through a multi-stage key guessing. Additionally, a complexity analysis of the attack is provided, validating the effectiveness of the proposed method.
AI snapshot
Written from the paper’s full text.
TL;DR
The paper trains 2- and 3-round differential-neural distinguishers for AES-128, including with partial ciphertext, and uses a 2-round distinguisher to recover a 3-round AES subkey via multi-stage key guessing. It reports near-100% accuracy for a 2-round distinguisher using only two ciphertext bytes and gives complexity estimates for the key recovery attack.
Key findings
- A 3-round distinguisher trained on full ciphertext had all positive instances predicted correctly but a true negative rate of about 1/16; using one row or column gave TNR about 1/64, and using two bytes gave TNR about 1/128.
- A 2-round distinguisher trained on one byte was insufficient, but using two bytes achieved accuracy close to 100%; the paper attributes this to differential propagation between Δ10 and Δ11, with Δ10 = 02 MC • Δ6 and Δ11 = 01 MC • Δ6.
- The wrong-key response profile for AES was validated. Theoretically, traversing two bytes of subkey (2^16 subkeys) with one ciphertext pair isolates the actual subkey, and repeating 8 times recovers the complete 3-round subkey.
- Practically, combining scores from 3 ciphertext pairs via Σ_{i=0}^{2} log(s_i/(1−s_i)) isolates the real subkey; using only 2 ciphertext pairs retains 2 guessed subkeys including the real one. The reported data complexity is D_c = 3 × 2 = 2^2.585 and time complexity is T_c = 2^16 × D_c × 8 = 2^21.585.
Methods
- The neural network follows Gohr’s Speck32/64 architecture adapted to AES ciphertext format: input ciphertext pair or parts as a [2, N_pb] matrix, initial convolution with width-1 and N_f = 16 channels, five convolutional blocks with two convolution layers each (N_f filters, kernel size 3), batch normalization, ReLU, skip connections, and a prediction head with two fully connected segments of 64 neurons each and a Sigmoid output.
- Training used Linux RNG-generated uniformly distributed keys and plaintext pairs with input difference Δ = 0x80. For label Y_i = 1, both plaintexts were encrypted for r rounds; for Y_i = 0, the second plaintext was replaced by a new random plaintext and encrypted. Training ran 20 epochs on N = 10^7 instances with M = 10^6 test instances, batch size B_s = 1000, MSE loss plus L2 regularization λ = 10^-5, Adam, and a cyclic learning rate with β = 0.002, α = 0.0001, n = 9.
- Key recovery used the multi-stage framework for large-state block ciphers by Yi Chen et al., with partial decryption because the last AES round omits MixColumns. The wrong-key response profile was examined using 200 random key and plaintext pairs encrypted through r+1 rounds, then single-round partial decryption over all possible δ and evaluation with an r-round distinguisher.
Limitations
- The paper states that its capabilities are currently limited to training a 3-round differential-neural distinguisher, that training an effective 3-round distinguisher was challenging, and that one byte of ciphertext is insufficient for an effective 2-round distinguisher.
- The paper states that recovering the complete 3-round subkey requires repeating the experiment 8 times, and that prepending a high-probability classical differential to extend rounds correspondingly increases complexity.
- Evident from the text: the 3-round distinguishers have low TNRs (about 1/16, 1/64, or 1/128 depending on data subset) despite high TPR, and the attack targets only a 3-round subkey rather than full AES.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
0 of 6 cited sources checked · 0 supported · 0 flagged
- Findingown data
The wrong key hypothesis for AES is validated.
“From Fig. 5, it is evident that the wrong key hypothesis for AES is validated.”
Quote in the paperSubstantial claim - Findingnone given
For a more robust filter, scores s from 3 ciphertext pairs are combined using the formula ∑ log(s/(1-s)), effectively isolating the real subkey.
“For a more robust filter, scores s from 3 ciphertext pairs are combined using the formula ∑ 2 i=0 log s i 1-s i , effectively isolating the real subkey.”
Quote in the paperSubstantial claim - Findingown data
The TNRs for the differential-neural distinguisher trained with all ciphertexts, one column or one row, and two bytes are approximately 1/16, 1/64, and 1/128, respectively.
“From Tables 1, 2, and 3, it is evident that the TNRs for the differential-neural distinguisher trained with different data subsets-namely, all ciphertexts, one column or one row of ciphertext, and two bytes-are approximately 1 16 , 1 64 , and 1 128 , respectively.”
Quote in the paperSubstantial claim - Findingown data
2-round and 3-round differential-neural distinguishers were trained for AES using partial ciphertext bits.
“2 and 3-round differential-neural distinguishers were trained for AES using partial ciphertext bits.”
- Also stated in: § Our Contribution. · plain
“We have developed a differential-neural distinguisher for AES, which was trained using various subsets of ciphertext data, including full ciphertext, a single row or column, two bytes, and one byte.”
Quote in the paperSubstantial claim - Also stated in: § Our Contribution. · plain
- Findingreasoning
A strong relationship exists between ∆10 and ∆11.
“Figure 4 shows the propagation diagram for two rounds of AES, from which it can be inferred that a strong relationship exists between ∆ 10 and ∆ 11 .”
Quote in the paperSubstantial claim
- Findingown data
Utilizing only one byte of ciphertext is insufficient for training an effective distinguisher.
“As illustrated in Table 4, utilizing only one byte of ciphertext proves insufficient for training an effective distinguisher.”
Quote in the paperSubstantial claim - Findingreasoning
Utilizing the trained 2-round distinguisher, the 3-round subkey of AES is successfully recovered through multi-stage key guessing.
“Utilizing the trained 2-round distinguisher, the 3-round subkey of AES is successfully recovered through a multi-stage key guessing.”
- Also stated in: § Our Contribution. · plain
“Furthermore, we utilize the trained 2round distinguisher to conduct a 3-round key recovery attack on AES.”
Quote in the paperSubstantial claim - Also stated in: § Our Contribution. · plain
- Findingown data
There is a proportional decrease in the true negative rate of the distinguisher as the amount of ciphertext used for training diminishes.
“Our findings indicate that there is a proportional decrease in the true negative rate of the distinguisher as the amount of ciphertext used for training diminishes.”
- Also stated in: § 3.1 3-Round Distinguisher Using Partial Ciphertext · plain
“The reduction in data volume corresponds proportionally with these TNR values.”
Quote in the paperSubstantial claim - Also stated in: § 3.1 3-Round Distinguisher Using Partial Ciphertext · plain
- Findingown data
Using just two bytes of ciphertext, a distinguisher accuracy close to 100% was achieved.
“Remarkably, using just two bytes of ciphertext, we have achieved a distinguisher accuracy close to 100%.”
- Also stated in: § 3.2 2-Round Distinguisher Using Partial Ciphertext · boosted
“However, as demonstrated in Table 5, employing two bytes of ciphertext enables the training of a 2-round differential-neural distinguisher, achieving an accuracy close to 100%.”
- Also stated in: § 5. Conclusions · boosted
“Our investigations confirmed that minimal ciphertext data, such as two bytes, enables distinguishers to achieve nearperfect accuracy.”
Quote in the paperSubstantial claim - Also stated in: § 3.2 2-Round Distinguisher Using Partial Ciphertext · boosted
- Findingnone given
Using only 2 ciphertext pairs retains 2 guessed subkeys, including the real one.
“Using only 2 ciphertext pairs retains 2 guessed subkeys, including the real one.”
Quote in the paperNot a substantial claim - Interpretationreasoning
Theoretically, decrypted data will be identified as ciphertext (a positive instance) only if the subkey guess is exact.
“Theoretically, decrypted data will be identified as ciphertext (a positive instance) only if the subkey guess is exact.”
Quote in the paperNot a substantial claim - Interpretationown data
The paper has demonstrated the utility of differential-neural distinguishers in enhancing key recovery attacks of AES.
“This paper has demonstrated the utility of differential-neural distinguishers in enhancing key recovery attacks of AES.”
Quote in the paperSubstantial claim - Premisecitation
The last round of AES encryption does not involve the MC operation.
“Notably, partial decryption techniques can be utilised since the last round of AES encryption does not involve the MC operation.”
- Also stated in: § 2.1 Description of AES-128 · plain
“in the last round the MixColumns operation is omitted.”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [6] [6] J. Daemen and V. Rijmen, The Design of Rijndael: AES - The Advanced Encryption Standard, Information Security and Cryptography, Springer, 2002. 10.1007/978-3-662-04722-4 source
- Also stated in: § 2.1 Description of AES-128 · plain
- Interpretationreasoning
The high accuracy of the 2-round distinguisher is attributed to the effective capture of differential propagation characteristics inherent in AES.
“We attribute this high level of accuracy to the effective capture of differential propagation characteristics inherent in AES.”
- Also stated in: § 3.2 2-Round Distinguisher Using Partial Ciphertext · hedged
“The distinctive characteristics encapsulated within these two bytes likely contribute to the outcomes observed in Table 5, differentiating them significantly from random numbers.”
Quote in the paperSubstantial claim - Also stated in: § 3.2 2-Round Distinguisher Using Partial Ciphertext · hedged
- Interpretationreasoning
One can traverse two bytes of the subkey, i.e., 2^16 subkeys, with just one ciphertext pair to isolate the actual subkey.
“Consequently, one can traverse two bytes of the subkey, i.e., 2 16 subkeys, with just one ciphertext pair to isolate the actual subkey.”
Quote in the paperNot a substantial claim - Premisecitation
Gohr integrated the differential-neural distinguisher with classical differentials, facilitating a 12-round key recovery attack on SPECK32/64.
“Gohr effectively integrated this distinguisher with classical differentials, facilitating a 12-round key recovery attack on SPECK32/64 (from a total of 22 rounds).”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [1] [1] A. Gohr, “Improving attacks on round-reduced speck32/64 using deep learning,” CRYPTO 2019, Lecture Notes in Computer Science, vol.11693, pp.150-179, Springer, 2019. 10.1007/978-3-030-26951-7_6 source
- Classified as probably not a substantial claim. 7
- May combine two claims. 7
- The quote only partly states this claim. 1
Probably not a substantial claim: may not pass S3 (load-bearing).
FindingreasoningTo recover the complete 3-round subkey, this experiment is repeated 8 times.
“To recover the complete 3-round subkey, this experiment is repeated 8 times.”
Quote in the paperNot a substantial claimMay combine two claims.
FindingreasoningThe data complexity Dc for a 3-round key recovery attack is 3 × 2 = 2^2.585; the time complexity Tc is 2^16 × Dc × 8 = 2^21.585.
“Hence, the data complexity D c for a 3-round key recovery attack is 3 × 2 = 2 2.585 ; the time complexity T c is 2 16 × D c × 8 = 2 21.585 .”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.
Findingnone givenIn Table 1, 2 and 3-round differential-neural distinguishers are trained using a complete ciphertext pair.
“In Table 1, the 2 and 3-round differential-neural distinguishers are trained using a complete ciphertext pair.”
Quote in the paperNot a substantial claimMay combine two claims.
Findingown dataFor the 3-round distinguisher trained with complete ciphertext pair, all positive instances are predicted correctly, while negative instances are predicted correctly with probability about 1/16.
“All positive instances are predicted correctly, while negative instances are only predicted correctly with a probability of about 1 16 .”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationGohr introduced the concept of differential-neural cryptanalysis.
“In CRYPTO 2019, Gohr introduced the concept of differential-neural cryptanalysis [1].”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [1] [1] A. Gohr, “Improving attacks on round-reduced speck32/64 using deep learning,” CRYPTO 2019, Lecture Notes in Computer Science, vol.11693, pp.150-179, Springer, 2019. 10.1007/978-3-030-26951-7_6 source
May combine two claims.
InterpretationreasoningThe differential-neural distinguisher might have learned a characteristic that all positive instances satisfy, whereas negative instances, being random numbers, have a 15/16 probability of satisfying it.
“This suggests that the differential-neural distinguisher might have learned a characteristic that all positive instances satisfy, whereas the negative instances, being random numbers, have a 15 16 probability of satisfying it.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
PremisecitationBenamira noted that Gohr's differential-neural distinguisher provides a robust approximation of the cipher's differential distribution table (DDT) and learns additional information beyond the DDT.
“At EUROCRYPT 2021, Benamira [2] noted that Gohr's differential-neural distinguisher provides a robust approximation of the cipher's differential distribution table (DDT) and learns additional information beyond the DDT.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [2] [2] A. Benamira, D. Gérault, T. Peyrin, and Q.Q. Tan, “A deeper look at machine learning-based cryptanalysis,” EUROCRYPT 2021, Lecture Notes in Computer Science, vol.12696, pp.805-835, Springer, 2021. 10.1007/978-3-030-77870-5_28 source
Classified as probably not a substantial claim. May combine two claims.
Premisenone givenThe subkey space for AES amounts to 2^128, impractical for exhaustive search.
“However, the subkey space for AES amounts to 2 128 , impractical for exhaustive search.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
PremisecitationBao et al. refined the concept of neutral bits, extending key recovery attacks to 13 rounds for SPECK32/64 and to 16 rounds for SIMON32/64.
“In ASIACRYPT 2022, Bao et al. [3] refined the concept of neutral bits, extending key recovery attacks to 13 rounds for SPECK32/64 and to 16 rounds (from a total of 32) for SIMON32/64.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites [3] [3] Z. Bao, J. Guo, M. Liu, L. Ma, and Y. Tu, “Conditional differential-neural cryptanalysis,” IACR Cryptol. ePrint Arch., p.719, 2021.
May combine two claims.
PremisecitationYi Chen et al. proposed a multi-stage differential-neural cryptanalysis framework applicable to larger block ciphers, facilitating key recovery attacks on all ciphers in the SPECK family.
“However, Yi Chen et al. [5] have proposed a multi-stage differential-neural cryptanalysis framework applicable to larger block ciphers, facilitating key recovery attacks on all ciphers in the SPECK family.”
Quote in the paperSubstantial claim0 of 1 sources checked- cites [5] [5] Y. Chen, Z. Bao, Y. Shen, and H. Yu, “A deep learning aided key recovery framework for large-state block ciphers,” IACR Cryptol. ePrint Arch., p.1659, 2022.
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Probably not a substantial claim: may not pass S4 (based).
Interpretationnone givenThe validation of the wrong key hypothesis through the wrong key response profile has been pivotal in optimizing theoretical and practical key recovery strategies.
“The validation of the wrong key hypothesis through the wrong key response profile has been pivotal in optimizing theoretical and practical key recovery strategies.”
Quote in the paperNot a substantial claim
Cites
Daemen, J., & Rijmen, V. (2002) · Information Security and Cryptography · doi:10.1007/978-3-662-04722-4 · Cited by 2,437 · see citing works
Improving Attacks on Round-Reduced Speck32/64 Using Deep Learning
Gohr, A. (2019) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-26951-7_6 · Cited by 207 · see citing works
A Deeper Look at Machine Learning-Based Cryptanalysis
Benamira, A., Gerault, D., Peyrin, T., & Tan, Q. Q. (2021) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-77870-5_28 · Cited by 130 · see citing works
More Insight on Deep Learning-Aided Cryptanalysis
Bao, Z., Lu, J., Yao, Y., et al. (2023) · Lecture notes in computer science · doi:10.1007/978-981-99-8727-6_15 · Cited by 25 · see citing works
Self-citation(2021) · IACR Cryptology ePrint Archive · Cited by 15 · see citing works
A deep learning-aided key recovery framework for large-state block ciphers
陈, 怡., 包, 珍., 申, 焱., et al. (2022) · Scientia Sinica Informationis · doi:10.1360/ssi-2022-0298 · Cited by 3 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Yu, X., He, L., Geng, J., et al. (2025) · Applied Sciences · doi:10.3390/app15169111 · Cited by 4 · see citing works
Survey: Six Years of Neural Differential Cryptanalysis
Gérault, D., Hambitzer, A., Huppert, M., & Picek, S. (2026) · IACR Communications in Cryptology · doi:10.62056/a69qxruc2 · Cited by 1 · see citing works
Impossible 4-Tuple Attack: A New Mixture-Based Cryptanalysis Applied to Reduced-Round AES-128
Hajari, M., Salmasizadeh, M., Mohajeri, J., Ahmadi, S., & Mirzaie, A. (2025) · IEEE Access · doi:10.1109/access.2025.3591639
Square Transposition Method with Adaptive Key Flexibility and Strong Diffusion Performance
Pakereng, M. A. I., Wowor, A. D., Beeh, Y. R., David, F., Christianto, E., Susanto, V. E., & Canavaro, C. (2025) · Matrik Jurnal Manajemen Teknik Informatika dan Rekayasa Komputer · doi:10.30812/matrik.v24i3.5004
- Authors
- ZHANG, L., WANG, Z., & LU, J.
- Affiliations
- Xidian University (CN)
- National University of Defense Technology (CN)
- Venue
- IEICE Transactions on Information and Systems
- Published
- 2024-10-01
- Volume
- E107.D
- Issue
- 10
- Pages
- 1372-1375
- ISSN
- 0916-8532 (ISSN-L)
- 1745-1361
- OpenAlex
- W4402973648
- Semantic Scholar
- caffdfa97219f556ac41d547dd176b4abbd14f39
- Cited by
- 4
- References
- 6
- Citations by year
- 2026: 1 · 2025: 3
- FWCI
- 0.61
- Type
- journal article
- Language
- en
- Open access
- diamond
- doi.org
- Locations
- IEICE Transactions on Information and Systems (publishedVersion)
- Funders
- National Natural Science Foundation of China (62172319, U19B2021)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Keywords
- AES, differential cryptanalysis, key recovery attack
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-23.
Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-23.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
