💻 computer science

Deep Learning-Assisted Improved Differential Fault Attacks on Lightweight Stream Ciphers

This paper proposes a deep learning-assisted differential fault attack framework that utilizes multilayer perceptrons to accurately identify fault locations and a threshold-based method to optimize secret recovery, demonstrating improved efficiency in breaking ACORNv3 and MORUSv2 while providing the first experimental security evaluation of ATOM under a relaxed fault model.

Original authors: Kok Ping Lim, Dongyang Jia, Iftekhar Salam

Published 2026-04-01

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Kok Ping Lim, Dongyang Jia, Iftekhar Salam

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a high-tech, ultra-secure lockbox (a stream cipher) that protects your most valuable secrets. These lockboxes are tiny and lightweight, designed to fit inside smart devices like your thermostat, smart watch, or medical sensor (the Internet of Things). Because they are so small and everywhere, they are easy for a thief to physically touch.

This paper is about a new way for a thief to break these locks, and a clever new tool they are using to do it.

The Old Way: The "Guess and Check" Thief

Traditionally, to break these locks, a thief would use a technique called a Differential Fault Attack. Here's how it works in simple terms:

The Disturbance: The thief physically taps the lockbox with a magnet or a laser to cause a tiny "glitch" (a fault) inside the machine. Imagine flipping a single switch inside the lockbox from "off" to "on" by accident.
The Mystery: The thief doesn't know which switch they flipped. They just know the lockbox is now acting weird.
The Comparison: The thief watches the lockbox output its secret code (the keystream) twice: once normally, and once with the glitch. By comparing the two codes, they can deduce where the glitch happened and eventually figure out the master key.

The Problem: The old way of finding where the glitch happened was like trying to find a needle in a haystack by looking at the shape of the hay. It was slow, often inaccurate, and required the thief to make thousands of guesses.

The New Tool: The "AI Detective"

This paper introduces a new weapon: Deep Learning (a type of Artificial Intelligence).

Instead of guessing, the researchers trained a digital "detective" (a Multilayer Perceptron or MLP model) to look at the weird output codes and instantly say, "Aha! The glitch happened at switch #42!"

Think of it like this:

Old Method: A human trying to identify a song by humming a few notes and guessing the title.
New Method: Shazam. You hum a few notes, and the AI instantly tells you the exact song and artist.

The researchers trained this AI on three specific types of lockboxes: ACORNv3, MORUSv2, and ATOM.

The Results: How Well Did the AI Do?

The researchers tested their AI detective on three different "locks":

ACORNv3 (The Easy Lock):
- The AI was incredibly accurate (99.99% correct). It could pinpoint the glitch almost perfectly.
- The Break-in: With the AI's help, the researchers broke the lock using only 21 to 34 glitches. This is much faster and easier than previous methods.
MORUSv2 (The Medium Lock):
- The AI was still very good (99.92% correct).
- The Break-in: This lock was bigger and more complex. It took about 213 to 248 glitches to break it. However, the researchers only had to "guess" a tiny bit of the key (at most 6 bits), which is like guessing a 6-digit PIN. It's still a massive improvement over older methods.
ATOM (The Super Lock):
- This lockbox has a special "Double Key Filter" (a double-layered security system).
- The AI struggled a bit more here (82% accuracy) because the glitch patterns were chaotic and unpredictable, like trying to predict the path of a pinball in a chaotic machine.
- The Break-in: Under the "no control" rule (where the thief can't choose exactly where to glitch), they couldn't fully break it. However, when they did get to choose exactly where to glitch, they managed to break most of the lock. This proves that ATOM is the strongest of the three, thanks to its clever design.

The "Threshold" Strategy

The researchers also invented a smart strategy called a Threshold-based method.

Imagine you are trying to solve a giant jigsaw puzzle.

Old Way: You keep adding pieces until the picture is 100% complete, even if you have to force pieces that don't fit.
New Way: The researchers said, "Let's only try to solve the puzzle if we have at least 80% of the pieces that fit perfectly." If the pieces don't fit well enough, they stop, inject a new glitch, and get more pieces. This saves time and energy, ensuring they don't waste effort on a broken puzzle.

Why Does This Matter?

This paper is a double-edged sword:

For Attackers: It shows that AI can make physical attacks on small devices much more powerful and efficient.
For Defenders (The Good Guys): It tells us exactly how strong these locks are.
- It proves that ACORN and MORUS are vulnerable to this new AI-assisted attack and need to be updated or used with more caution.
- It proves that ATOM is very tough. Its "Double Key Filter" design is excellent at confusing even the smartest AI detectives, making it a great candidate for protecting our future IoT devices.

In a nutshell: The researchers taught a computer to be a master lock-picking detective. They used it to break three different types of digital locks, showing us which ones are safe and which ones need to be reinforced. It's a wake-up call for device makers to make their security even stronger against smart, glitch-hunting AI.

1. Problem Statement

Lightweight cryptographic primitives (e.g., ACORNv3, MORUSv2, ATOM) are essential for resource-constrained IoT devices but are vulnerable to physical attacks, specifically Differential Fault Attacks (DFA).

The Challenge: In a realistic attack scenario (the "no-control" model), an adversary can inject a single-bit bit-flipping fault but does not know the exact location of the injection.
The Bottleneck: Traditional DFA relies on signature-based methods to identify the fault location by analyzing differential keystreams. These methods often struggle with complex fault propagation patterns, leading to lower identification accuracy and requiring more fault injections or guess-and-determine strategies to recover the secret state.
The Gap: While Deep Learning (DL) has been applied to block cipher cryptanalysis, its application to DFA on stream ciphers under relaxed fault models remains underexplored.

2. Methodology

The authors propose a Deep Learning-Assisted DFA Framework consisting of two main phases:

A. Fault Location Identification (Deep Learning Phase)

Model Architecture: The authors train Multilayer Perceptron (MLP) models to classify the fault location based on the differential keystream.
- Input: Differential keystream bits (XOR of fault-free and faulty keystreams).
- Output: The specific index of the state bit where the fault was injected.
- Training: Datasets are generated by simulating bit-flipping faults at all possible state locations with random keys and IVs. The data is split into training (80%), testing, and validation sets.
- Optimization: Hyperparameters (hidden layers, neurons, dropout rates) are tuned via exhaustive search. The models use Adam optimizers and Early Stopping to prevent overfitting.

B. Secret Recovery (Threshold-Based Optimization)

Equation Construction: Once the fault location is identified, the adversary constructs a system of algebraic equations (Algebraic Normal Form - ANF) by XORing the fault-free and faulty keystream equations.
Threshold Strategy: Instead of solving equations immediately, the authors introduce a threshold-based approach:
1. Collect differential equations until the count of linear equations (or total equations, depending on the cipher) exceeds a specific threshold ( $T$ ).
2. If the system cannot be solved within a time limit (using Gröbner basis in SageMath), the threshold is increased by 5, and more faults are injected.
3. This optimizes the number of fault injections required, avoiding unnecessary attacks if the current equation set is solvable.
Solver: The system is solved using Gröbner basis algorithms. For cases where full recovery is difficult, a minimal "guess-and-determine" strategy is applied to the remaining bits.

3. Key Contributions

First DL-Assisted DFA on ATOM: This work presents the first experimental differential fault attack results on the ATOM stream cipher.
Superior Fault Location Identification: The proposed MLP models significantly outperform traditional signature-based methods in identifying unknown fault locations across all three ciphers.
Optimized Attack Complexity: By incorporating a threshold-based method and utilizing higher-degree equations (quadratic), the authors reduce the number of required fault injections and eliminate the need for extensive guess-and-determine strategies in ACORN and MORUS.
Security Margin Analysis: The study provides empirical evidence on the security margins of these ciphers, particularly highlighting the robustness of ATOM's double key filter design.

4. Experimental Results

A. Fault Location Identification Accuracy

The MLP models achieved near-perfect accuracy for ACORN and MORUS, and significant improvement for ATOM compared to signature-based methods.

Cipher	Method	Keystream Length	Accuracy	Improvement
ACORNv3	MLP (This Work)	152 bits	99.9880%	+0.0133% vs. Signature
MORUSv2	MLP (This Work)	384 bits	99.9231%	+4.66% vs. Signature
ATOM	MLP (This Work)	56 bits	82.3568%	+23.46% vs. Signature

B. Secret Recovery Performance

ACORNv3:
- Faults Required: 21–34 faults (Average: 27).
- Recovery: Full initial state (293 bits) recovered.
- Complexity: Negligible (No guess-and-determine required).
- Comparison: Outperforms Zhang et al. [29] (which required 26–43 faults and guess-and-determine) and Siddhanti et al. [22] (which required guessing 20 bits).
MORUSv2:
- Faults Required: 213–248 faults.
- Recovery: Full initial state (640 bits).
- Guessing: Requires guessing at most 6 bits ( $2^6 = 64$ combinations).
- Comparison: First implementation of DFA on MORUS under a "no-control" fault model. Previous theoretical work (Wong et al.) required precise control and only recovered partial state.
ATOM:
- Faults Required: 46 faults (under precise control model).
- Recovery: Under the "no-control" model, the attack failed to recover the full state due to the cipher's double key filter and non-deterministic fault propagation.
- Precise Control Result: When fault location is controlled, 74 out of 90 NFSR state bits can be recovered.
- Significance: Demonstrates that ATOM possesses a higher security margin than ACORN and MORUS against this specific attack vector.

5. Significance and Conclusion

Feasibility of DL in Cryptanalysis: The paper successfully demonstrates that Deep Learning is a viable and superior tool for identifying fault locations in stream ciphers, especially when fault propagation patterns are complex and non-linear.
Practical Impact: The proposed framework reduces the attack complexity (fewer faults, less guessing) for ACORN and MORUS, making them more vulnerable to physical attacks than previously thought under relaxed assumptions.
Security Validation: The results validate the robustness of the ATOM cipher's design (specifically the double key filter), which effectively resists DL-assisted DFA under realistic "no-control" conditions.
Future Directions: The authors suggest exploring DL-assisted attacks under even more relaxed models (e.g., random faults) and refining equation solving techniques to handle cases where fault location identification is imperfect.

In summary, this work bridges the gap between machine learning and physical cryptanalysis, offering a more efficient attack vector for lightweight stream ciphers while simultaneously providing a rigorous security evaluation of emerging standards like ATOM.