# Improve Neural Distinguishers of SIMON and SPECK

Authors: ZeZhou Hou; JiongJiong Ren; ShaoZhen Chen
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Deep learning has played an important role in many fields, which shows significant potential for cryptanalysis. Although these existing works opened a new direction of machine learning aided cryptanalysis, there is still a research gap that researchers are eager to fill. How to further improve neural distinguishers? In this paper, we propose a new algorithm and model to improve neural distinguishers in terms of accuracy and the number of rounds. First, we design an algorithm based on SAT to improve neural distinguishers. With the help of SAT/SMT solver, we obtain new effective neural distinguishers of SIMON using the input differences of high-probability differential characteristics. Second, we propose a new neural distinguisher model using multiple output differences. Inspired by the existing works and data augmentation in deep learning, we use the output differences to exploit more derived features and train neural distinguishers, by splicing output differences into a matrix as a sample. Based on the new model, we construct neural distinguishers of SIMON and SPECK with round and accuracy promotion. Utilizing our neural distinguishers, we can distinguish reduced-round SIMON or SPECK from pseudorandom permutation better.


---

## Body

## 1. Introduction

Deep learning has brought about significant improvement in many fields [1–3], and it enlightened cryptanalysis. As early as 1991, Ronald Rivest [4] discussed the similarities and differences between machine learning and cryptography and analysed the application of machine learning in the field of cryptography. In recent years, deep learning has also been applied to side channel analysis [5, 6], and it was pointed out that the sensitive information on embedded devices can be effectively extracted by training neural networks.At Crypto 2019, Gohr [7] showed that deep learning can produce very powerful cryptographic distinguishers and indicated that the neural distinguisher was better than the distinguisher obtained by traditional approach. He used an input difference to train neural distinguishers of SPECK32/64 [8] based on the deep residual neural networks (ResNets) [9]. If the accuracy of a neural distinguisher exceeds 0.5, the neural distinguisher can distinguish target cipher E from pseudorandom permutation. Gohr's work is a giant leap in differential cryptanalysis based on deep learning. However, his work actually opened many questions.Why are neural distinguishers effective? How to improve neural distinguishers in terms of accuracy and the number of rounds?In Eurocrypt 2021, Benamira et al. [10] proposed a detailed analysis and thorough explanations of the inherent workings of Gohr’s distinguishers. They showed that Gohr's neural distinguisher was in fact inherently building a very good approximation of the differential distribution table (DDT). Based on this, Benamira et al. also constructed an 8-round distinguisher of SIMON32/64. In [10], Benamira et al. answered the first question. Similarly, Chen and Yu [11] bridged machine learning and cryptanalysis via the extended differential-linear connectivity table. The first question is answered in [10, 11]. In addition to these works related to the inherent workings of neural distinguishers, there are some works related to the improvement of the neural distinguishers. In [12], Chen and Yu designed a new neural distinguisher model using multiple ciphertext pairs instead of single ciphertext pair. The new neural distinguisher can be used to improve the key recovery attack on 11-round SPECK32/64. But Chen et al. did not explore improving the accuracy from the perspective of input difference or output difference, which is not conducive to finding a longer-round neural distinguisher. In [13], Su et al. constructed polytopic neural distinguisher of round-reduced SIMON32/64. Their work partially answered the second question, yet the second question is still worth studying, especially in selecting the input differences and data format. Not limited to the neural distinguishers, there are also some works related to the neural aided key recovery attack [14–16].It is not difficult to find that further improvement of the neural distinguishers is still worth studying, especially in accuracy and the number of rounds, because if the distinguishing accuracy is promoted, the complexity of key search can be reduced; and if the number of rounds is increased, the key recovery attack can be improved. However, unfortunately, there are few works to explore how to improve neural distinguishers from the perspective of the input difference. Besides, the neural distinguishers can be improved by using other distinguisher models. Inspired by these existing works, our core target is to answer the second question, that is, to further improve neural distinguishers in terms of accuracy and the number of rounds.In this paper, our contributions are as follows.An algorithm is designed based on SAT to improve neural distinguishers and apply to SIMON. In [7], Gohr chose 0x40,0x0 as the input difference to train his distinguisher because it transitioned deterministically to the low-weight output difference. But such input differences are hard to find, which makes it difficult to find effective distinguishers. To solve this problem, we propose an algorithm based on SAT to improve neural distinguishers. With the help of this automatic search tool, we search for the exact nr-round differential characteristics with probability 2−n/4×Pmax,Pmax and choose their input differences to train nr-round neural distinguishers, where Pmax is the optimal probability and n is the block size. Utilizing the algorithm, we obtain some neural distinguishers of 9-round SIMON32/64, 10-round SIMON48/96, and 11-round SIMON64/128 with the accuracy exceeding 57% for the first time. Compared with the choice of input difference presented in [10], our algorithm obtains higher-accuracy neural distinguishers. Our results are shown in Table 1.Table 1
Comparison of neural differential distinguishers.
Block cipherSource of neural distinguisher/input differenceRoundAccuracy (%)SIMON32/64Reference [10]1882.2Reference [17]2959.07Reference [13]3963.73Section3959.77Section4982.27Section41061.09SIMON48/96Reference [17]2950.22Reference [10]11053.49Section31057.89Section41081.40Section41161.43SIMON64/128Reference [17]21058.61Section31159.72Section41173.79Section41269.57SPECK32/64Reference [7]761.6Reference [12]3770.74Section4788.19Reference [7]851.40Section4856.49SPECK48/96Reference [15]5—4Section4763.43SPECK64/128Section4863.201We train neural distinguishers using Benamira et al. ’s method presented in [10]. 2In [17], Abed et al. constructed differential characteristics of SIMON. We train neural distinguishers by choosing the input differences in [17]. 3We choose the highest-accuracy neural distinguisher in [12, 13]. 4 Chen et al. used 5-round neural distinguisher to attack SPECK48/x, but the accuracy was not presented in [15].A new neural distinguisher model is proposed using multiple output differences and neural distinguishers of SIMON and SPECK are improved. In image recognition based on deep learning, a deep learning researcher will enhance some objective features of pictures so that the neural network can learn more effective features, which will improve the accuracy of the network. In [10], Benamira et al. explored the connection between Gohr's distinguisher and DDT, which enlightens us that the output difference is helpful to improve neural distinguishers. This also implies that we can selectively enhance certain features from output difference to improve neural distinguishers. Unlike [7, 12] using ciphertext pairs as training data, we use the output differences to train neural distinguishers by splicing output differences into a matrix as a sample. For a matrix, we treat it as an image and each output difference of the matrix is treated as an objective feature. Our goal is not only to learn each objective feature but also to learn the connections between output differences. If all output differences of the matrix are from the same input difference, the matrix will be labeled 1; otherwise, it will be labeled 0. Thanks to the new model learning more features than using ciphertext pairs, we improve neural distinguishers of SIMON32/64, SIMON48/96, and SIMON64/128. Besides, we obtain new neural distinguishers of 8-round SPECK32/64, 7-round SPECK48/96, and 8-round SPECK64/128, which are better than the existing neural distinguishers. Using our improved neural distinguishers, we can distinguish reduced-round SIMON or SPECK from pseudorandom permutation better. As a footnote, we show with experiments where the improvement in the accuracy of distinguishers is not due to the increase in the number of plaintexts but learning more features from the relationship between the output differences. The summary of our neural distinguishers together with other neural distinguishers is shown in Table 1.The remainder of this paper is organised as follows. In Section2, we introduce the basic notations and review Gohr’s distinguishers. In Section 3, we design an algorithm based on SAT to help us find high-accuracy neural distinguishers. In Section 4, we propose a new neural distinguisher model to ulteriorly improve neural distinguishers. Conclusions are drawn in Section 5 where we also suggest further work.


## 2. Preliminaries

To make it easier to read this paper, we first list the main notations. Then an overview of Gohr's work is given.


### 2.1. Notations

SIMON2n/mnSIMON acting on2n-bit plaintext blocks and using a mn-bit keySPECK2n/mnSPECK acting on2n-bit plaintext blocks and using a mn-bit key⊕Bitwise XOR⊙Bitwise AND∨Bitwise OR+Addition modulo2nSjLeft circular shift byj bitsKMaster keykii-round subkey ki=kin−1…ki0


### 2.2. Overview of Gohr's Distinguisher Mode

Given a fixed input difference△=0x40,0x0 and a plaintext pair P0,P1, the resulting ciphertext pair C0,C1 is regarded as s sample. Each sample will be attached a label Y:(1)Y=1,ifP0⊕P1=Δ,0,else.A neural network is trained over enough samples labeled 1 and 0. In addition, half the training data comes from ciphertext pairs labeled 1 and the other half from ciphertext pairs labeled 0. For the samples with label 1, their ciphertext pairs are from a specific distribution related to the fixed input difference. For the samples with label 0, their ciphertext pairs are from a uniform distribution due to their random input difference. If a neural network can obtain a stable distinguishing accuracy higher than 50\% on a testing set, we call the trained neural network a neural distinguisher. What is particularly noteworthy is that each sample is encrypted by a random key. By this method, the neural distinguisher will work whether the key is changed or not. In [7], Gohr chose the deep residual neural networks to train neural distinguisher and obtained effective neural distinguishers of 5-round, 6-round, and 7-round SPECK32/64.In traditional differential attack, it is pivotal to distinguish encryption function from a pseudorandom permutation, which is done with the help of the differential characteristic. For annr-round optimal characteristic Δα⟶2−tΔβ of a block cipher with block size n bits, we calculate the output difference given the fixed input difference Δα. If the ratio of the output difference to Δβ is about 2−t, then we can distinguish the block cipher from a pseudorandom permutation. This is called distinguishing attack for block ciphers.For Gohr’s neural distinguisher, we can obtainN ciphertext pairs encrypted by the input difference 0x40,0x0. We input the N ciphertext pairs, and the neural distinguisher will predict their labels. If the ratio of samples labeled 1 exceeds 0.5, we can distinguish the block cipher and pseudorandom permutation and the neural distinguisher is effective. This is called a distinguishing attack based on the neural distinguisher. In addition, it is obvious that the higher the accuracy of the neural distinguisher, the better the effect of the distinguishing attack; and the complexity of key search can also be reduced if the distinguishing accuracy is greatly promoted. So, it is necessary to improve neural distinguisher.In [7], Gohr explained the reason for choosing 0x40,0x0 as the input difference that it transitioned deterministically to the low-weight difference 0x8000,0x8000. But it is pretty hard to find such input differences unless the full differential distribution table is used. Moreover, it is a time-consuming task to calculate the full DDT, especially for large-size block ciphers.


## 2.1. Notations

SIMON2n/mnSIMON acting on2n-bit plaintext blocks and using a mn-bit keySPECK2n/mnSPECK acting on2n-bit plaintext blocks and using a mn-bit key⊕Bitwise XOR⊙Bitwise AND∨Bitwise OR+Addition modulo2nSjLeft circular shift byj bitsKMaster keykii-round subkey ki=kin−1…ki0


## 2.2. Overview of Gohr's Distinguisher Mode

Given a fixed input difference△=0x40,0x0 and a plaintext pair P0,P1, the resulting ciphertext pair C0,C1 is regarded as s sample. Each sample will be attached a label Y:(1)Y=1,ifP0⊕P1=Δ,0,else.A neural network is trained over enough samples labeled 1 and 0. In addition, half the training data comes from ciphertext pairs labeled 1 and the other half from ciphertext pairs labeled 0. For the samples with label 1, their ciphertext pairs are from a specific distribution related to the fixed input difference. For the samples with label 0, their ciphertext pairs are from a uniform distribution due to their random input difference. If a neural network can obtain a stable distinguishing accuracy higher than 50\% on a testing set, we call the trained neural network a neural distinguisher. What is particularly noteworthy is that each sample is encrypted by a random key. By this method, the neural distinguisher will work whether the key is changed or not. In [7], Gohr chose the deep residual neural networks to train neural distinguisher and obtained effective neural distinguishers of 5-round, 6-round, and 7-round SPECK32/64.In traditional differential attack, it is pivotal to distinguish encryption function from a pseudorandom permutation, which is done with the help of the differential characteristic. For annr-round optimal characteristic Δα⟶2−tΔβ of a block cipher with block size n bits, we calculate the output difference given the fixed input difference Δα. If the ratio of the output difference to Δβ is about 2−t, then we can distinguish the block cipher from a pseudorandom permutation. This is called distinguishing attack for block ciphers.For Gohr’s neural distinguisher, we can obtainN ciphertext pairs encrypted by the input difference 0x40,0x0. We input the N ciphertext pairs, and the neural distinguisher will predict their labels. If the ratio of samples labeled 1 exceeds 0.5, we can distinguish the block cipher and pseudorandom permutation and the neural distinguisher is effective. This is called a distinguishing attack based on the neural distinguisher. In addition, it is obvious that the higher the accuracy of the neural distinguisher, the better the effect of the distinguishing attack; and the complexity of key search can also be reduced if the distinguishing accuracy is greatly promoted. So, it is necessary to improve neural distinguisher.In [7], Gohr explained the reason for choosing 0x40,0x0 as the input difference that it transitioned deterministically to the low-weight difference 0x8000,0x8000. But it is pretty hard to find such input differences unless the full differential distribution table is used. Moreover, it is a time-consuming task to calculate the full DDT, especially for large-size block ciphers.


## 3. An Approach Based on SAT to Improve Neural Distinguisher

In traditional differential cryptanalysis, it is a primary task to find a high-probability differential characteristic, which takes advantage of the unevenness of the differential distribution. The distribution of output differences is different for different input differences. For a neural distinguisher, it actually learns the distribution of output difference given a fixed input difference. Therefore, the input difference directly affects the accuracy of the neural distinguisher.In [7], Gohr chose 0x40,0x0 as the input difference to train the distinguisher because it transitioned deterministically to a low-weight output difference. But such input differences are hard to find, which makes it difficult to find effective distinguishers. In [10], Benamira et al. chose the input difference from nr−1-round or nr−2-round optimal differential characteristics for nr-round neural distinguishers.In this section, we will introduce our algorithm for improvingnr-round neural distinguishers by searching for the nr-round differential characteristics. With the help of SAT/SMT solver, we search for high-probability differential characteristics with probability in 2−bs/4×Pmax,Pmax, where Pmax is the optimal probability and bs is the block size. Using our algorithm, we can obtain high-accuracy neural distinguishers for 9-round SIMON32/64, 10-round SIMON48/96, and 11-round SIMON64/128.


### 3.1. Generic Network Architecture

Gohr converted the distinguisher of ciphertext pairs into a binary classification problem. His method is not only applicable to SPECK but also applicable to SIMON. With his method, we can construct a generic network architecture for other ciphers. We refer to [7] for the description of the method of constructing the network architecture.There are multiple neural networks available to train neural distinguishers, such as MIP and ResNets. We choose the ResNets to train a neural distinguisher.Our networks comprise three main components: input layer, iteration layer, and predict layer, shown in Figure1. n in Figure 1 refers to the word size of SIMON 2n/mn. The input layer receives training data with fixed length. In the iteration layer, we use 5 residual blocks. In each residual block, we use two Conv1D layers, and each Conv1D layer is followed by a batch normalization layer and an activation layer. After flattening data from iteration layer, data will be sent into a fully connected layer. The fully connected layer consists of a hidden layer and an output unit.Figure 1
Network architecture. (a) Input Layer. (b) Iteration Layer. (c) Output Layer.
(a)(b)(c)In our network, we choose the kernel size of the first Conv1D layer as 1 and the kernel size of the other Conv1D layer is 3. In addition, the number of filters in each convolutional layer is2n and the padding method is SAME. At last, we train our network based on L2 weights regularization to avoid overfitting. The other details of the hyperparameters used are given in Table 2. In Table 2, we choose hyperparameters similar to those in Gohr’s choice, so we can ignore the influence of the neural network and its parameters. After the neural distinguisher is trained, we can use it to distinguish the output of target cipher with a given input difference from random data. The higher its accuracy on the test set is, the better it distinguishes ciphertext data.Table 2
List of hyperparameters.
HyperparametersValueBatch size10000Epochs100Train size107Validation size105Regularization parameter10–4OptimizerAdamLoss functionMSE (mean squared error)


### 3.2. An Algorithm Based on SAT to Improve Neural Distinguisher

SAT is the Boolean Satisfiability Problem. It is an NP-complete problem and considers whether there is a valid assignment to Boolean variables satisfying a given set of Boolean conditions. As the key issue of computer science and artificial intelligence, SAT solvers have gained a lot of attention since it was proposed. It has great advantages of open source, good interface, high efficiency, and perfect compatibility. There are many cryptanalysis results based on SAT [18–20].At present, there are two main ways to select the input differences of neural distinguishers. One way is to directly choose an existing optimal differential characteristic [12], and the other is to choose nr−1-round or nr−2-round optimal differential characteristics for nr-round neural distinguishers [10]. But these methods cannot effectively promote the distinguishing accuracy.Taking into account the unevenness of the distribution of output differences for different input differences, we decide to choose the input differences of high-probability differential characteristics as the candidate differences. We search for high-probability differential characteristic by a SAT-based automatic search tool and train neural distinguishers with these input differences of differential characteristics. Based on this, we design an algorithm to help us search for neural distinguishers with higher accuracy, which is shown in Algorithm1. In Algorithm 1, we expand the search space of input difference by expanding the range of the probability. We choose 2−bs/4×Pmax,Pmax as the lower bound of the probability, where Pmax is the probability of the optimal differential characteristics and bs refers to the block size of the target cipher. By experimental experience, we find that if the differential probability is lower than 2−bs/4×Pmax, there are almost no high-accuracy neural distinguishers. So there is nearly no need to spend time on the differential characteristics with the probability lower than 2−bs/4×Pmax.Using Theorem 3 in [19] and open-source SAT/SMT solver Z3 [21], we search for high-probability differential characteristics of SIMON. Then, with Algorithm 1, we get the 9-, 10-, and 11-round neural distinguishers of SIMON32/64, SIMON48/96, and SIMON64/128, respectively. This is the first time that there is a neural distinguisher of 11-round SIMON64/128. The results of the neural distinguishers are shown in Table 3.Table 3
Comparison with Algorithm1 and other methods.
Block cipherSource of neural distinguisher (input difference)RoundsInput differenceAccuracy (%)SIMON32/64Reference [17]190x0,0x4059.07Algorithm190x0,0x8059.77SIMON48/96Reference [17]190x10100,0x4404050.22Reference [10]2100x80000,0x22200053.49Algorithm1100x0,0x10000057.89SIMON64/128Reference [17]1100x100,0x44058.61Algorithm1110x0,0x1059.721In [17], Abed et al. constructed differential characteristics of SIMON. We train neural distinguishers by choosing the input differences in [17]. 2We train neural distinguishers using Benamira et al.'s method presented in [10].Algorithm 1: Search for neural distinguisher based on SAT.
Input: Network Architecture Net, Cipher C with block size bs bits, Round R.Output: Neural distinguisher ND, Input difference of distinguisher Id.(1)
Search for the optimal probability asPmax(2)
Search for the differential characteristics with probability in2−bs/4×Pmax,Pmax, and save their input differences as DIFF(3)
ND= [ ](4)
Id= [ ](5)
ford in DIFFdo(6)
S=Cd,R#Generate train set using d as the input difference(7)
V=Cd,R#Generate test set using d as the input difference(8)
Dd=NetS#Training using train data(9)
accd=EvaluateDd,V#Get the accuracy of the modelDd(10)
ifaccd>0.51then(11)
ND=NDDd(12)
Id=Idd(13)
end if(14)
end for(15)
returnND,IdIn order to show that Algorithm1 is effective, we use the other two methods [10, 12] of selecting the input difference to train the neural distinguishers with the same rounds. For the method presented in [12], we choose 0x10100,0x44040 in [17] as input difference to train 9-round neural distinguisher. Besides, for the other method presented in [10], we train 10-round neural distinguishers of SIMON48/96 using 9-round and 8-round optimal differential characteristics, and the specific results are shown in Tables 4 and 5.Table 4
10-round neural distinguishers using 9-round optimal characteristics.
Input differenceAccuracyInput differenceAccuracyInput differenceAccuracy0x2,0x8800080.52580x100,0x4440.52790x800,0x22200.52810x8000,0x222000.52860x4000,0x111000.52860x80000,0x2220000.52880x100000,0x4440000.52900x20000,0x888000.52930x20000,0x888000.52930x20,0x8000880.53010x200000,0x8880000.53010x200,0x8880.53030x2000,0x88800.53030x4,0x1000110.53080x80,0x2220.53100x400,0x11100.53110x40,0x1110.53120x10,0x4000440.53120x400000,0x1100010.53120x8,0x2000220.53150x1,0x4400040.53270x800000,0x2200020.53270x1000,0x44400.53300x40000,0x1110000.5334Table 5
10-round neural distinguishers using 8-round optimal characteristics.
Input differenceAccuracyInput differenceAccuracyInput differenceAccuracy0x400004,0x100.52640x100,0x4440.52820x8,0x2000220.52830x88,0x2000.52850x2000,0x88800.52860x400,0x11100.52870x40,0x1110.52890x440,0x10000.52900x40000,0x1110000.52910x100001,0x40.52940x400000,0x1100010.52960x20000,0x888000.52980x800000,0x2200020.52980x110000,0x4000000.52980x11000,0x400000.53000x88000,0x2000000.53010x220,0x8000.53010x800,0x22200.53020x800,0x22200.53020x2200,0x80000.53040x8800,0x200000.53040x200,0x8880.53050x880000,0x20.53060x2,0x8800080.53060x100000,0x4440000.53070x1,0x4400040.53070x10000,0x444000.53080x1100,0x40000.53090x44000,0x1000000.53110x110,0x4000.53130x200002,0x80.53130x8000,0x222000.53140x220000,0x8000000.53140x22,0x800.53180x2,0x8800080.53190x200000,0x8880000.53200x80,0x2220.53220x1000,0x44400.53230x10,0x4000440.53250x4400,0x100000.53260x4,0x1000110.53270x44,0x1000.53270x440000,0x10.53290x20,0x8000880.53390x4000,0x111000.53400x22000,0x800000.53410x11,0x400.53410x80000,0x2220000.5349In Table3, we choose the same data format as that of Gohr’s distinguisher, which is single ciphertext pair. Other hyperparameters are posted in Table 2. As shown in Table 3, we show the comparison of the accuracy from three methods of selecting the input difference. As we can see, compared with selecting the input difference in [10, 17], the accuracy of neural distinguishers obtained by Algorithm 1 has been significantly promoted, which can be used to reduce the complexity of key recovery attack. Although both methods select the input difference from differential characteristics, Algorithm 1 selects the exact rounds of the differential characteristics according to the rounds of neural distinguisher.We also try to search for neural distinguishers for more rounds. Unfortunately, as the number of rounds increases, the nonrandom features of the ciphertext pairs become weaker and weaker. So it is difficult for us to find a neural distinguisher with longer round, even if using Algorithm1. In addition, the higher the Hamming weight of the input difference, the weaker the nonrandom feature of the ciphertext pair. So we should firstly search for input differences with lower Hamming weight adopting Algorithm 1 if time is limited.


## 3.1. Generic Network Architecture

Gohr converted the distinguisher of ciphertext pairs into a binary classification problem. His method is not only applicable to SPECK but also applicable to SIMON. With his method, we can construct a generic network architecture for other ciphers. We refer to [7] for the description of the method of constructing the network architecture.There are multiple neural networks available to train neural distinguishers, such as MIP and ResNets. We choose the ResNets to train a neural distinguisher.Our networks comprise three main components: input layer, iteration layer, and predict layer, shown in Figure1. n in Figure 1 refers to the word size of SIMON 2n/mn. The input layer receives training data with fixed length. In the iteration layer, we use 5 residual blocks. In each residual block, we use two Conv1D layers, and each Conv1D layer is followed by a batch normalization layer and an activation layer. After flattening data from iteration layer, data will be sent into a fully connected layer. The fully connected layer consists of a hidden layer and an output unit.Figure 1
Network architecture. (a) Input Layer. (b) Iteration Layer. (c) Output Layer.
(a)(b)(c)In our network, we choose the kernel size of the first Conv1D layer as 1 and the kernel size of the other Conv1D layer is 3. In addition, the number of filters in each convolutional layer is2n and the padding method is SAME. At last, we train our network based on L2 weights regularization to avoid overfitting. The other details of the hyperparameters used are given in Table 2. In Table 2, we choose hyperparameters similar to those in Gohr’s choice, so we can ignore the influence of the neural network and its parameters. After the neural distinguisher is trained, we can use it to distinguish the output of target cipher with a given input difference from random data. The higher its accuracy on the test set is, the better it distinguishes ciphertext data.Table 2
List of hyperparameters.
HyperparametersValueBatch size10000Epochs100Train size107Validation size105Regularization parameter10–4OptimizerAdamLoss functionMSE (mean squared error)


## 3.2. An Algorithm Based on SAT to Improve Neural Distinguisher

SAT is the Boolean Satisfiability Problem. It is an NP-complete problem and considers whether there is a valid assignment to Boolean variables satisfying a given set of Boolean conditions. As the key issue of computer science and artificial intelligence, SAT solvers have gained a lot of attention since it was proposed. It has great advantages of open source, good interface, high efficiency, and perfect compatibility. There are many cryptanalysis results based on SAT [18–20].At present, there are two main ways to select the input differences of neural distinguishers. One way is to directly choose an existing optimal differential characteristic [12], and the other is to choose nr−1-round or nr−2-round optimal differential characteristics for nr-round neural distinguishers [10]. But these methods cannot effectively promote the distinguishing accuracy.Taking into account the unevenness of the distribution of output differences for different input differences, we decide to choose the input differences of high-probability differential characteristics as the candidate differences. We search for high-probability differential characteristic by a SAT-based automatic search tool and train neural distinguishers with these input differences of differential characteristics. Based on this, we design an algorithm to help us search for neural distinguishers with higher accuracy, which is shown in Algorithm1. In Algorithm 1, we expand the search space of input difference by expanding the range of the probability. We choose 2−bs/4×Pmax,Pmax as the lower bound of the probability, where Pmax is the probability of the optimal differential characteristics and bs refers to the block size of the target cipher. By experimental experience, we find that if the differential probability is lower than 2−bs/4×Pmax, there are almost no high-accuracy neural distinguishers. So there is nearly no need to spend time on the differential characteristics with the probability lower than 2−bs/4×Pmax.Using Theorem 3 in [19] and open-source SAT/SMT solver Z3 [21], we search for high-probability differential characteristics of SIMON. Then, with Algorithm 1, we get the 9-, 10-, and 11-round neural distinguishers of SIMON32/64, SIMON48/96, and SIMON64/128, respectively. This is the first time that there is a neural distinguisher of 11-round SIMON64/128. The results of the neural distinguishers are shown in Table 3.Table 3
Comparison with Algorithm1 and other methods.
Block cipherSource of neural distinguisher (input difference)RoundsInput differenceAccuracy (%)SIMON32/64Reference [17]190x0,0x4059.07Algorithm190x0,0x8059.77SIMON48/96Reference [17]190x10100,0x4404050.22Reference [10]2100x80000,0x22200053.49Algorithm1100x0,0x10000057.89SIMON64/128Reference [17]1100x100,0x44058.61Algorithm1110x0,0x1059.721In [17], Abed et al. constructed differential characteristics of SIMON. We train neural distinguishers by choosing the input differences in [17]. 2We train neural distinguishers using Benamira et al.'s method presented in [10].Algorithm 1: Search for neural distinguisher based on SAT.
Input: Network Architecture Net, Cipher C with block size bs bits, Round R.Output: Neural distinguisher ND, Input difference of distinguisher Id.(1)
Search for the optimal probability asPmax(2)
Search for the differential characteristics with probability in2−bs/4×Pmax,Pmax, and save their input differences as DIFF(3)
ND= [ ](4)
Id= [ ](5)
ford in DIFFdo(6)
S=Cd,R#Generate train set using d as the input difference(7)
V=Cd,R#Generate test set using d as the input difference(8)
Dd=NetS#Training using train data(9)
accd=EvaluateDd,V#Get the accuracy of the modelDd(10)
ifaccd>0.51then(11)
ND=NDDd(12)
Id=Idd(13)
end if(14)
end for(15)
returnND,IdIn order to show that Algorithm1 is effective, we use the other two methods [10, 12] of selecting the input difference to train the neural distinguishers with the same rounds. For the method presented in [12], we choose 0x10100,0x44040 in [17] as input difference to train 9-round neural distinguisher. Besides, for the other method presented in [10], we train 10-round neural distinguishers of SIMON48/96 using 9-round and 8-round optimal differential characteristics, and the specific results are shown in Tables 4 and 5.Table 4
10-round neural distinguishers using 9-round optimal characteristics.
Input differenceAccuracyInput differenceAccuracyInput differenceAccuracy0x2,0x8800080.52580x100,0x4440.52790x800,0x22200.52810x8000,0x222000.52860x4000,0x111000.52860x80000,0x2220000.52880x100000,0x4440000.52900x20000,0x888000.52930x20000,0x888000.52930x20,0x8000880.53010x200000,0x8880000.53010x200,0x8880.53030x2000,0x88800.53030x4,0x1000110.53080x80,0x2220.53100x400,0x11100.53110x40,0x1110.53120x10,0x4000440.53120x400000,0x1100010.53120x8,0x2000220.53150x1,0x4400040.53270x800000,0x2200020.53270x1000,0x44400.53300x40000,0x1110000.5334Table 5
10-round neural distinguishers using 8-round optimal characteristics.
Input differenceAccuracyInput differenceAccuracyInput differenceAccuracy0x400004,0x100.52640x100,0x4440.52820x8,0x2000220.52830x88,0x2000.52850x2000,0x88800.52860x400,0x11100.52870x40,0x1110.52890x440,0x10000.52900x40000,0x1110000.52910x100001,0x40.52940x400000,0x1100010.52960x20000,0x888000.52980x800000,0x2200020.52980x110000,0x4000000.52980x11000,0x400000.53000x88000,0x2000000.53010x220,0x8000.53010x800,0x22200.53020x800,0x22200.53020x2200,0x80000.53040x8800,0x200000.53040x200,0x8880.53050x880000,0x20.53060x2,0x8800080.53060x100000,0x4440000.53070x1,0x4400040.53070x10000,0x444000.53080x1100,0x40000.53090x44000,0x1000000.53110x110,0x4000.53130x200002,0x80.53130x8000,0x222000.53140x220000,0x8000000.53140x22,0x800.53180x2,0x8800080.53190x200000,0x8880000.53200x80,0x2220.53220x1000,0x44400.53230x10,0x4000440.53250x4400,0x100000.53260x4,0x1000110.53270x44,0x1000.53270x440000,0x10.53290x20,0x8000880.53390x4000,0x111000.53400x22000,0x800000.53410x11,0x400.53410x80000,0x2220000.5349In Table3, we choose the same data format as that of Gohr’s distinguisher, which is single ciphertext pair. Other hyperparameters are posted in Table 2. As shown in Table 3, we show the comparison of the accuracy from three methods of selecting the input difference. As we can see, compared with selecting the input difference in [10, 17], the accuracy of neural distinguishers obtained by Algorithm 1 has been significantly promoted, which can be used to reduce the complexity of key recovery attack. Although both methods select the input difference from differential characteristics, Algorithm 1 selects the exact rounds of the differential characteristics according to the rounds of neural distinguisher.We also try to search for neural distinguishers for more rounds. Unfortunately, as the number of rounds increases, the nonrandom features of the ciphertext pairs become weaker and weaker. So it is difficult for us to find a neural distinguisher with longer round, even if using Algorithm1. In addition, the higher the Hamming weight of the input difference, the weaker the nonrandom feature of the ciphertext pair. So we should firstly search for input differences with lower Hamming weight adopting Algorithm 1 if time is limited.


## 4. A New Neural Distinguisher Model Using Multiple Output Differences

In [10], Benamira et al. show that the neural distinguisher generally relies on not only the differential distribution of ciphertext pairs but also the differential distribution in penultimate and antepenultimate rounds. This enlightens us whether we can directly use the output differences to train neural distinguishers. Unlike [7, 12] using ciphertext pairs as samples, we design a new neural distinguisher model with multiple output differences as a sample. Using the new model, we obtain the high-accuracy neural distinguishers for 10-round SIMON32/64, 11-round SIMON48/96, 12-round SIMON64/128, 8-round SPECK32/64, 7-round SPECK48/96, and 8-round SPECK64/128. Additionally, we show with experiments that the promotion in the accuracy of distinguishers is not due to the increase of the number of plaintexts but learning more features from the relationship between the output differences.


### 4.1. New Neural Distinguisher Model

Neural networks and deep learning currently provide the best solutions to many problems in image recognition, speech recognition, and natural language processing. As we know, the deep learning is data-driven, and the quality of the data determines the quality of the model to some extent. For neural distinguishers, the choice of ciphertext pairs directly affects the accuracy of the neural distinguishers, which has been solved in Section3. In deep learning field, the format of training data also affects the quality of the trained model to some extent. This enlightens us that we can improve neural distinguishers from the perspective of data format. In image recognition, the deep learning researchers currently rotate the image or crop it to enhance some objective features, which has been experimentally proven to be effective. Inspired by Benamira et al.’s work and data augmentation in deep learning, we use the output differences to train neural distinguishers by splicing output differences into a matrix as a sample. For a matrix, we treat it as an image and each output difference of the matrix is treated as an objective feature. Our goal is not only to learn each objective feature but also to learn the connections between output differences.As shown in Figure2, the k plaintext pairs P11,P21,P12,P22,…,P1k,P2k are encrypted by a random master key. The k ciphertext pairs C11,C21,C12,C22,…,C1k,C2k are converted to output differences, where n is the block size of ciphers. We splice multiple output differences into a matrix as a sample, which is described as O1O2… . Similar to Gohr’s method, given an input difference Id, each sample will be attached a label Y according to the following equation:(2)YO1O2…Ok=1,ifP1i⊕P2i=Id,i∈1,k,0,else.Figure 2
A new data format usingk different output differences.If the label is 1, the matrix is denoted as a positive sample. Otherwise, it is denoted as a negative sample. We call the new data formatDFdifferent. By randomly generating plaintext and key, we make our distinguishers learn the features of target block cipher instead of the features of the plaintext or key. In the experiment, we make the neural network learn more features by using more output differences in a matrix. As we can see, the new data format needs more ciphertext pairs. For the same number of training sets, the new model requires k times more data than Gohr’s model.Because only the channel dimension is changed, we refer to Figure1 for the description of network architecture.


### 4.2. Applications to SIMON and SPECK

#### 4.2.1. Application to SIMON

We choose the input difference in Table3 to train new neural distinguishers. Other hyperparameters are posted in Table 2. The accuracy comparison is presented in Table 6. For 11-round SIMON48/96, we do not obtain an effective neural distinguisher using the input difference in Table 3. So we research other high-probability differential transmissions.Table 6
Comparison of SIMON using different data format.
CipherData formatkRoundsInput differenceAccuracy (%)SIMON32/64SCP—90x0,0x8059.07MOD490x0,0x8062.27MOD3290x0,0x8082.27MOD32100x0,0x8061.09SIMON48/96SCP—100x0,0x10000057.89MOD4100x0,0x10000061.15MOD48100x0,0x10000081.40MOD48110x1000,0x440061.43SIMON64/128SCP—110x0,0x1059.72MOD4110x0,0x1063.53MOD64110x0,0x1073.79MOD64120x0,0x1069.57SCP: single ciphertext pair; MOD: multiple output differences.In Table6, the “SCP” refers to the data format of Gohr’s neural distinguisher, and the “MOD” refers to the data format shown in Figure 2. As shown in Table 6, compared with using ciphertext pairs, the number of rounds and accuracy of new neural distinguishers are greatly promoted. In addition, the new distinguishers can be further promoted by increasing k, which shows that the superposition of output difference can help the neural network to learn more unknown features.


#### 4.2.2. Application to SPECK

The new format is not limited to the neural distinguisher of SIMON, as it can also be found to be effective in SPECK. In [7, 12], 0x40,0x0 is used to train neural distinguisher of 7-round SPECK32/64. Using the difference, we obtain a new higher-accuracy neural distinguisher of 7-round SPECK32/64. Not only that, with the help of [18, 20], we obtain a good input difference 0x2800,0x10 and an effective 8-round neural distinguisher. As far as we know, this is the first effective 8-round neural distinguisher of SPECK32/64 with accuracy more than 55\%. Besides, we also obtain neural distinguishers of 7-round SPECK48/96 and 8-round SPECK64/128. Summary of the existing results is shown in Table 7. In Table 7, “SCP” refers to the data format of Gohr’s neural distinguisher, “MCP” refers to the data format using multiple ciphertext pairs, and “MOD” refers to the data format shown in Figure 2. Other hyperparameters are posted in Table 2.Table 7
Comparison of SPECK using different data format.
CipherData formatRoundsInput differenceAccuracy (%)SourceSPECK32/64SCP70x40,0x061.6[7]MCP70x40,0x070.741[12]MOD270x40,0x088.87Section4SCP80x40,0x051.4[7]MOD280x2800,0x1056.49Section4SIMON48/96MCP5—3—[15]MOD470x20082,0x12020063.43Section4SIMON64/128MOD580x0,0x1063.20Section4SCP: single ciphertext pair; MCP: multiple ciphertext pairs; MOD: multiple output differences.1The highest accuracy of 7-round SPECK32/64 in [12]. 2k = 32. 3Chen et al. used 5-round neural distinguisher to attack SPECK48/x, but the accuracy was not presented in [15]. 4k = 48. 5k = 64.Utilizing the new model, we improve neural distinguishers in terms of length and accuracy. We can achieve better results in distinguishing attack utilizing the new neural distinguishers. Moreover, we give a further illustration of our model. Since we use more data in the new model than using ciphertext pairs, this makes our improved results seem to be related to increase of data. We perform supplementary experiments to show that the improvement of the accuracy of distinguishers is not due to the increase of the number of plaintexts but because of learning more features from the relationship between the output differences.


### 4.3. A Supplementary Explanation to Our New Model

Although the accuracy is higher using the new data format, the performance may be likely improved by training on more training samples. So we use the same number of ciphertext pairs to train neural distinguishers shown in Table8. Other hyperparameters are posted in Table 2.Table 8
Comparison with using ciphertext pairs and output differences.
CipherData formatkRoundsSize of training dataAccuracy (%)SIMON32/64SCP—1032×10750.28MOD321010761.09SIMON48/96SCP—1148×10750.43MOD481110761.43SIMON64/128SCP—1264×10750.37MOD641210769.57SCP: single ciphertext pair; MOD: multiple output differences.In Table8, “SCP” refers to the data format of Gohr’s neural distinguisher, and “MOD” refers to the data format shown in Figure 2. As shown in Table 8, the accuracy using multiple output differences is higher, even if the same amount of data is used. In addition, it takes up less memory using output differences, which can reduce training time in the training process.To further illustrate the effectiveness of the new distinguishers, we conduct additional experiments. As shown in Figure3, we use k same output differences as a sample; And we call the data format DFsame. As shown in Figures 2 and 3, DFdifferent uses k different output difference in a sample, while DFsame uses k same output difference in a sample. Based on the data format DFsame, 106 positive and negative ciphertext pairs are randomly generated; and each output difference is reused k times and filled in a matrix as a sample. Then new neural distinguishers are performed on 106 samples. We calculate the accuracy of the new neural distinguishers for these special data. Table 9 shows the corresponding test results.Figure 3
A data format usingk same output differences.Table 9
Accuracy comparison withDFsame and DFdifferent.
CipherskRoundsAccuracy usingDFsame(%)Accuracy usingDFdifferent(%)SIMON32/64321051.6961.09SIMON48/96481154.8161.43SIMON64/128641249.7869.57SPECK32/6432851.1856.49SPECK48/9648750.0663.43SPECK64/12864850.8463.20In Table9, the “Accuracy using DFsame” refers to the accuracy of neural distinguishers trained by DFsame. The “Accuracy using DFdifferent” refers to the accuracy of neural distinguishers trained by DFdifferent. As shown in Table 9, the accuracy using DFsame is lower than that using DFdifferent. This illustrates that the new distinguishers learn more unknown features especially in the connection of different output differences.


## 4.1. New Neural Distinguisher Model

Neural networks and deep learning currently provide the best solutions to many problems in image recognition, speech recognition, and natural language processing. As we know, the deep learning is data-driven, and the quality of the data determines the quality of the model to some extent. For neural distinguishers, the choice of ciphertext pairs directly affects the accuracy of the neural distinguishers, which has been solved in Section3. In deep learning field, the format of training data also affects the quality of the trained model to some extent. This enlightens us that we can improve neural distinguishers from the perspective of data format. In image recognition, the deep learning researchers currently rotate the image or crop it to enhance some objective features, which has been experimentally proven to be effective. Inspired by Benamira et al.’s work and data augmentation in deep learning, we use the output differences to train neural distinguishers by splicing output differences into a matrix as a sample. For a matrix, we treat it as an image and each output difference of the matrix is treated as an objective feature. Our goal is not only to learn each objective feature but also to learn the connections between output differences.As shown in Figure2, the k plaintext pairs P11,P21,P12,P22,…,P1k,P2k are encrypted by a random master key. The k ciphertext pairs C11,C21,C12,C22,…,C1k,C2k are converted to output differences, where n is the block size of ciphers. We splice multiple output differences into a matrix as a sample, which is described as O1O2… . Similar to Gohr’s method, given an input difference Id, each sample will be attached a label Y according to the following equation:(2)YO1O2…Ok=1,ifP1i⊕P2i=Id,i∈1,k,0,else.Figure 2
A new data format usingk different output differences.If the label is 1, the matrix is denoted as a positive sample. Otherwise, it is denoted as a negative sample. We call the new data formatDFdifferent. By randomly generating plaintext and key, we make our distinguishers learn the features of target block cipher instead of the features of the plaintext or key. In the experiment, we make the neural network learn more features by using more output differences in a matrix. As we can see, the new data format needs more ciphertext pairs. For the same number of training sets, the new model requires k times more data than Gohr’s model.Because only the channel dimension is changed, we refer to Figure1 for the description of network architecture.


## 4.2. Applications to SIMON and SPECK

### 4.2.1. Application to SIMON

We choose the input difference in Table3 to train new neural distinguishers. Other hyperparameters are posted in Table 2. The accuracy comparison is presented in Table 6. For 11-round SIMON48/96, we do not obtain an effective neural distinguisher using the input difference in Table 3. So we research other high-probability differential transmissions.Table 6
Comparison of SIMON using different data format.
CipherData formatkRoundsInput differenceAccuracy (%)SIMON32/64SCP—90x0,0x8059.07MOD490x0,0x8062.27MOD3290x0,0x8082.27MOD32100x0,0x8061.09SIMON48/96SCP—100x0,0x10000057.89MOD4100x0,0x10000061.15MOD48100x0,0x10000081.40MOD48110x1000,0x440061.43SIMON64/128SCP—110x0,0x1059.72MOD4110x0,0x1063.53MOD64110x0,0x1073.79MOD64120x0,0x1069.57SCP: single ciphertext pair; MOD: multiple output differences.In Table6, the “SCP” refers to the data format of Gohr’s neural distinguisher, and the “MOD” refers to the data format shown in Figure 2. As shown in Table 6, compared with using ciphertext pairs, the number of rounds and accuracy of new neural distinguishers are greatly promoted. In addition, the new distinguishers can be further promoted by increasing k, which shows that the superposition of output difference can help the neural network to learn more unknown features.


### 4.2.2. Application to SPECK

The new format is not limited to the neural distinguisher of SIMON, as it can also be found to be effective in SPECK. In [7, 12], 0x40,0x0 is used to train neural distinguisher of 7-round SPECK32/64. Using the difference, we obtain a new higher-accuracy neural distinguisher of 7-round SPECK32/64. Not only that, with the help of [18, 20], we obtain a good input difference 0x2800,0x10 and an effective 8-round neural distinguisher. As far as we know, this is the first effective 8-round neural distinguisher of SPECK32/64 with accuracy more than 55\%. Besides, we also obtain neural distinguishers of 7-round SPECK48/96 and 8-round SPECK64/128. Summary of the existing results is shown in Table 7. In Table 7, “SCP” refers to the data format of Gohr’s neural distinguisher, “MCP” refers to the data format using multiple ciphertext pairs, and “MOD” refers to the data format shown in Figure 2. Other hyperparameters are posted in Table 2.Table 7
Comparison of SPECK using different data format.
CipherData formatRoundsInput differenceAccuracy (%)SourceSPECK32/64SCP70x40,0x061.6[7]MCP70x40,0x070.741[12]MOD270x40,0x088.87Section4SCP80x40,0x051.4[7]MOD280x2800,0x1056.49Section4SIMON48/96MCP5—3—[15]MOD470x20082,0x12020063.43Section4SIMON64/128MOD580x0,0x1063.20Section4SCP: single ciphertext pair; MCP: multiple ciphertext pairs; MOD: multiple output differences.1The highest accuracy of 7-round SPECK32/64 in [12]. 2k = 32. 3Chen et al. used 5-round neural distinguisher to attack SPECK48/x, but the accuracy was not presented in [15]. 4k = 48. 5k = 64.Utilizing the new model, we improve neural distinguishers in terms of length and accuracy. We can achieve better results in distinguishing attack utilizing the new neural distinguishers. Moreover, we give a further illustration of our model. Since we use more data in the new model than using ciphertext pairs, this makes our improved results seem to be related to increase of data. We perform supplementary experiments to show that the improvement of the accuracy of distinguishers is not due to the increase of the number of plaintexts but because of learning more features from the relationship between the output differences.


## 4.2.1. Application to SIMON

We choose the input difference in Table3 to train new neural distinguishers. Other hyperparameters are posted in Table 2. The accuracy comparison is presented in Table 6. For 11-round SIMON48/96, we do not obtain an effective neural distinguisher using the input difference in Table 3. So we research other high-probability differential transmissions.Table 6
Comparison of SIMON using different data format.
CipherData formatkRoundsInput differenceAccuracy (%)SIMON32/64SCP—90x0,0x8059.07MOD490x0,0x8062.27MOD3290x0,0x8082.27MOD32100x0,0x8061.09SIMON48/96SCP—100x0,0x10000057.89MOD4100x0,0x10000061.15MOD48100x0,0x10000081.40MOD48110x1000,0x440061.43SIMON64/128SCP—110x0,0x1059.72MOD4110x0,0x1063.53MOD64110x0,0x1073.79MOD64120x0,0x1069.57SCP: single ciphertext pair; MOD: multiple output differences.In Table6, the “SCP” refers to the data format of Gohr’s neural distinguisher, and the “MOD” refers to the data format shown in Figure 2. As shown in Table 6, compared with using ciphertext pairs, the number of rounds and accuracy of new neural distinguishers are greatly promoted. In addition, the new distinguishers can be further promoted by increasing k, which shows that the superposition of output difference can help the neural network to learn more unknown features.


## 4.2.2. Application to SPECK

The new format is not limited to the neural distinguisher of SIMON, as it can also be found to be effective in SPECK. In [7, 12], 0x40,0x0 is used to train neural distinguisher of 7-round SPECK32/64. Using the difference, we obtain a new higher-accuracy neural distinguisher of 7-round SPECK32/64. Not only that, with the help of [18, 20], we obtain a good input difference 0x2800,0x10 and an effective 8-round neural distinguisher. As far as we know, this is the first effective 8-round neural distinguisher of SPECK32/64 with accuracy more than 55\%. Besides, we also obtain neural distinguishers of 7-round SPECK48/96 and 8-round SPECK64/128. Summary of the existing results is shown in Table 7. In Table 7, “SCP” refers to the data format of Gohr’s neural distinguisher, “MCP” refers to the data format using multiple ciphertext pairs, and “MOD” refers to the data format shown in Figure 2. Other hyperparameters are posted in Table 2.Table 7
Comparison of SPECK using different data format.
CipherData formatRoundsInput differenceAccuracy (%)SourceSPECK32/64SCP70x40,0x061.6[7]MCP70x40,0x070.741[12]MOD270x40,0x088.87Section4SCP80x40,0x051.4[7]MOD280x2800,0x1056.49Section4SIMON48/96MCP5—3—[15]MOD470x20082,0x12020063.43Section4SIMON64/128MOD580x0,0x1063.20Section4SCP: single ciphertext pair; MCP: multiple ciphertext pairs; MOD: multiple output differences.1The highest accuracy of 7-round SPECK32/64 in [12]. 2k = 32. 3Chen et al. used 5-round neural distinguisher to attack SPECK48/x, but the accuracy was not presented in [15]. 4k = 48. 5k = 64.Utilizing the new model, we improve neural distinguishers in terms of length and accuracy. We can achieve better results in distinguishing attack utilizing the new neural distinguishers. Moreover, we give a further illustration of our model. Since we use more data in the new model than using ciphertext pairs, this makes our improved results seem to be related to increase of data. We perform supplementary experiments to show that the improvement of the accuracy of distinguishers is not due to the increase of the number of plaintexts but because of learning more features from the relationship between the output differences.


## 4.3. A Supplementary Explanation to Our New Model

Although the accuracy is higher using the new data format, the performance may be likely improved by training on more training samples. So we use the same number of ciphertext pairs to train neural distinguishers shown in Table8. Other hyperparameters are posted in Table 2.Table 8
Comparison with using ciphertext pairs and output differences.
CipherData formatkRoundsSize of training dataAccuracy (%)SIMON32/64SCP—1032×10750.28MOD321010761.09SIMON48/96SCP—1148×10750.43MOD481110761.43SIMON64/128SCP—1264×10750.37MOD641210769.57SCP: single ciphertext pair; MOD: multiple output differences.In Table8, “SCP” refers to the data format of Gohr’s neural distinguisher, and “MOD” refers to the data format shown in Figure 2. As shown in Table 8, the accuracy using multiple output differences is higher, even if the same amount of data is used. In addition, it takes up less memory using output differences, which can reduce training time in the training process.To further illustrate the effectiveness of the new distinguishers, we conduct additional experiments. As shown in Figure3, we use k same output differences as a sample; And we call the data format DFsame. As shown in Figures 2 and 3, DFdifferent uses k different output difference in a sample, while DFsame uses k same output difference in a sample. Based on the data format DFsame, 106 positive and negative ciphertext pairs are randomly generated; and each output difference is reused k times and filled in a matrix as a sample. Then new neural distinguishers are performed on 106 samples. We calculate the accuracy of the new neural distinguishers for these special data. Table 9 shows the corresponding test results.Figure 3
A data format usingk same output differences.Table 9
Accuracy comparison withDFsame and DFdifferent.
CipherskRoundsAccuracy usingDFsame(%)Accuracy usingDFdifferent(%)SIMON32/64321051.6961.09SIMON48/96481154.8161.43SIMON64/128641249.7869.57SPECK32/6432851.1856.49SPECK48/9648750.0663.43SPECK64/12864850.8463.20In Table9, the “Accuracy using DFsame” refers to the accuracy of neural distinguishers trained by DFsame. The “Accuracy using DFdifferent” refers to the accuracy of neural distinguishers trained by DFdifferent. As shown in Table 9, the accuracy using DFsame is lower than that using DFdifferent. This illustrates that the new distinguishers learn more unknown features especially in the connection of different output differences.


## 5. Conclusion and Future Work

In this paper, we proposed a new algorithm and model to further improve neural distinguishers. On the one hand, by carefully selecting the input differences with utilizing SAT/SMT algorithm, we managed to search for exactnr-round differential characteristics with high probability and trained nr-round neural distinguishers. On the other hand, by adopting the new data format, we spliced multiple output differences into a matrix as a sample to capture more derived features; thus we can improve the number of rounds and accuracy of neural distinguishers. Application to SIMON and SPECK has proved the superiorities of our algorithm and models.With our results, we obtain new effective neural distinguishers, which can be used to distinguish reduced-round SIMON or SPECK from pseudorandom permutation better. Since there are numerous network architectures now with the development of deep learning, it is meaningful to explore other appropriate network models to improve neural distinguishers.



---

*Source: 9288229-2021-12-31.xml*