Artificial Intelligence and the Effective Security of AES: A Narrative Review of Side-Channel Analysis, Encrypted-Traffic Analysis, and the Post-Quantum Positioning of AES-256

Abstract

This paper provides a narrative review on the role of artificial intelligence in cryptography, with a substantial focus on the Advanced Encryption Standard (AES) and, where the distinction matters, on AES with 256-bit keys (AES-256), at the intersection of cryptanalysis, encrypted-traffic analysis, and post-quantum computing. Deep learning side-channel analysis has been evolving into a general-purpose attack tool; neural distinguishers have entered classical cryptanalysis; and encrypted-traffic analysis shows that payload confidentiality does not imply metadata privacy. We distinguish throughout between the security of the primitive, the security of a concrete implementation, and metadata privacy at the protocol level, since the results surveyed here bear on the latter two rather than on the first. AES-256 remains structurally robust, including against the Grover bound in an idealized quantum model, but should be deployed alongside hardened implementations, post-quantum key establishment such as ML-KEM, and protocol-level countermeasures, rather than treated as sufficient on its own.

1. Introduction

Cryptography has gone through two largely independent transformations in recent years: The first was the advance of artificial intelligence, in particular deep learning, thus becoming a practical tool for the analysis and evaluation of cryptographic implementations [1,2,3], with a growing role in classical cryptanalysis as well [4,5]. The second was the steady progress in quantum computing, which redefined the research agenda in asymmetric and symmetric cryptography (to a smaller extent) [6,7,8,9]. These two trends are usually studied in isolation. AI-powered adversaries can reduce the effective security of concrete implementations even when the algorithm itself is mathematically secure, whereas quantum algorithms bound the security of the primitive. Throughout this review we consider an adversary that holds both capabilities, but we treat the two attack surfaces jointly rather than as interacting: to the best of our knowledge, no published framework models how AI-assisted implementation attacks and quantum key search would reinforce one another, and we do not claim such an interaction here.

In this setting, the Advanced Encryption Standard with 256-bit keys (AES-256) remains the core of virtually all security protocols, including Transport Layer Security, IPsec, disk encryption, and cloud storage. AES-256 is generally believed to retain its structural robustness even against quantum adversaries in the black-box model, but realistic threat models must include implementation attacks, protocol-level leakage, and scenarios in which artificial intelligence and quantum capabilities are held by the same adversary [1,2,4,7]. The same observation logic applies to authenticated modes such as AES-GCM and to message authentication codes—their effective security in already deployed systems depends not only on the strength of the underlying algorithm but also on how well it is implemented.

Looking at the attacker’s side first, the main novelty of recent years is the consolidation of deep learning-based side-channel analysis as a general-purpose tool. Convolutional networks, residual networks, and, more recently, transformer-based architectures extract key-dependent information from power traces, electromagnetic measurements, or execution timing with a level of automation that classical statistical techniques could not reach [1,2,3]. Public datasets such as ASCAD [1] and systematic benchmarks on masked AES implementations have made it easier to get started and to compare and evaluate results reliably [3,10]. Distinct from side-channel analysis, artificial intelligence has also entered classical cryptanalysis, notably through neural differential distinguishers for block ciphers [5] and through machine learning-assisted search for differential trails, linear approximations, and algebraic attack configurations [4].

Defenders have not been idle. Learning-based classifiers detect anomalies in encrypted network traffic and support intrusion detection [11,12,13,14,15]. Generative adversarial networks produce substitution boxes with good cryptographic properties, and reinforcement learning helps tune parameters in lightweight and post-quantum schemes [4]. Some studies have explored neural networks as full encryption tools; for example, Abadi and Andersen [16] trained three networks where two learned to communicate privately while the third tried to intercept them—although such proposals do not yet meet the security standards that real-world systems would normally require [4,16].

Meanwhile, the post-quantum agenda has moved from research to the standardization of technology. Systems that are built on the public-key approach—that rely on the hardness of factoring and discrete logarithm problems—are vulnerable to Shor’s algorithm [8,9], which prompted a multi-year effort coordinated by NIST and led to the publication of FIPS 203, FIPS 204, and FIPS 205 in 2024 [6,17,18]. For symmetric cryptography, the main quantum threat is Grover’s algorithm, which provides a quadratic speed-up for unstructured key search. Applying it to AES-256 reduces the effective key-search security from 256 classical bits to roughly 128 quantum bits [7], although detailed resource estimates that account for circuit depth, logical qubits, and quantum error correction show that mounting such an attack at scale is extremely expensive—even under optimistic hardware assumptions [7,19]. For data with long-term confidentiality requirements, it remains prudent to treat the Grover bound of approximately 128 bits as the working post-quantum security level of AES-256, noting that this figure is the complexity of Grover search in an idealized model rather than an estimate of the practical cost of an arbitrary quantum attack, and to combine it with a post-quantum key-establishment mechanism such as ML-KEM [6] in order to mitigate the harvest-now, decrypt-later risk.

Because the term is used throughout this review, we state at the outset what we mean by it. By effective security we denote the security level that an adversary actually faces when attacking a concrete deployment, as opposed to the security level of the abstract primitive under its idealized model. The two coincide only when the implementation leaks nothing beyond its input–output behavior and the surrounding protocol reveals nothing beyond the ciphertext itself. In practice they diverge, and we therefore distinguish three properties, which correspond to three different threat models and which the remainder of this review treats separately:

(i)

Primitive security: the resistance of AES-256 as a mathematical object to classical and quantum key-recovery and distinguishing attacks, under a black-box model in which the adversary observes only plaintext–ciphertext pairs (Section 3.3, Section 4.2 and Section 4.3);

(ii)

Implementation security: the resistance of a concrete hardware or software realization to an adversary who additionally observes physical leakage such as power consumption, electromagnetic emanation or timing, and who may inject faults (Section 4.1);

(iii)

Metadata privacy at the protocol level: the extent to which an observer of an encrypted channel can infer the application, the user action or the accessed resource from traffic metadata alone, without compromising the confidentiality of the payload at all (Section 5).

Effective security is a property of a deployment rather than of an algorithm, and in any given system it is determined by whichever of these three is weakest. It is also the quantity that artificial intelligence has most visibly affected, since none of the results surveyed below alters the mathematical security of AES-256. Where a claim in this review concerns only one of the three properties, we state which one.

For the purposes of this review, the adversary is defined as follows. We consider an adversary A holding three capabilities simultaneously: (a) physical proximity to a target device, sufficient to acquire power or electromagnetic traces and, where noted, to inject faults, but without knowledge of the key material; (b) passive observation of encrypted network traffic at some vantage point between the endpoints, including packet sizes, timing and direction, but no ability to decrypt payloads; and (c) access to quantum computation of the scale assumed by the resource estimates of Section 3.3, applied to key search. Capability (a) threatens property (ii), capability (b) threatens property (iii), and capability (c) bounds property (i). We assume the capabilities are held jointly but exercised independently: nothing in the literature surveyed here demonstrates an interaction in which one capability amplifies another, and we make no such claim. The constraint that separates this adversary from an unbounded one is data: for (a), the number of traces obtainable from the target; for (b), the volume and freshness of labeled traffic; and for (c), the circuit depth a realistic quantum computer can sustain. Each of the results discussed below is, at bottom, a statement about how much of the relevant resource the corresponding capability requires.

The objective of this review is to connect these three areas of research and to answer four questions. First, how AI has changed cryptanalysis and side-channel analysis of AES-256, and where the new methods break down. Second, how much machine learning can recover from encrypted traffic, and what this means for AES-protected channels. Third, the position of AES-256 against a combined quantum and AI threat model, and why post-quantum key establishment matters for it. Fourth, whether AI logic can be embedded directly into cryptographic algorithms or protocols, and which of those attempts are realistic for deployment.

The structure of this paper is organized into six sections. Section 2 presents the research methodology and the selection criteria. Section 3 provides background on symmetric and asymmetric cryptography, on machine learning in the cryptographic context, and on post-quantum computing. Section 4 analyzes the role of artificial intelligence in cryptanalysis and side-channel attacks, with a focus on AES-256 and on the limits of current methods. Section 5 examines artificial intelligence for encrypted-traffic analysis and anomaly detection and discusses the resulting privacy implications. Section 6 concludes with a synthesis and a discussion of open problems and research directions.

2. Research Methodology

This review is narrative and critical rather than systematic: instead of exhaustive coverage via a reproducible search protocol, we curated the works that best capture the major lines of research at the intersection of machine learning, cryptography, and post-quantum security through expert judgment. Selection was guided by four primary research questions:

• How are machine learning and deep learning models applied in practice for cryptanalysis and side-channel analysis of symmetric ciphers, with a particular focus on AES-256?
• What is the impact of artificial intelligence on encrypted-traffic analysis, protocol fingerprinting, and anomaly detection, and what does this mean for overall confidentiality?
• What is the current consensus regarding the post-quantum feasibility of AES-256, and how does it interact with the new post-quantum algorithms?
• What are the practical outcomes and unresolved problems when trying to blend AI logic directly into existing encryption algorithms?

To answer these questions, several sources were consulted: peer-reviewed journal articles, conference papers, and significant preprints indexed in major databases were considered, including IEEE Xplore, SpringerLink, ScienceDirect, MDPI, the ACM Digital Library, the IACR Cryptology ePrint Archive, and also selected open-access journals in cryptography, security, and networking. Search queries combined cryptographic and AI-related keywords: deep learning side-channel analysis, AES, machine learning cryptanalysis, AI-generated S-box, encrypted-traffic classification deep learning, post-quantum cryptography symmetric Grover AES-256, and trustworthy deep learning encrypted traffic. Targeted searches were also run for specific primitives and standards, such as NIST post-quantum FIPS 203/204/205 [6,17,18,20] and the quantum cost of Grover key recovery on AES [7,9,19].

Given how much both fields publish, we filtered for novelty and technical depth instead of attempting a complete catalog of the literature. Papers were prioritized when they reported empirical results on real hardware or realistic datasets, for example public side-channel datasets such as ASCAD [1] or widely used encrypted-traffic corpora [11,12,14,21]; when they introduced new methods or architectures rather than minor parameter variations [2,3,5,10,22]; or when they contributed to standardization efforts and long-term recommendations [6,17,18,20,23,24]. While several papers presented incremental improvements to a single idea, representative works were chosen to best illustrate the trend rather than citing every variant. The review draws a deliberate methodological line: when two works are in genuine tension, such as a result and a published reproduction of it [22,25], both are retained and the disagreement is discussed rather than smoothed over.

The queries returned approximately 110 candidate works, which were screened first by title and abstract, with full texts consulted for those that passed that stage. The reduction was driven primarily by redundancy: where several works advanced the same idea, we retained the study that established it and, where a later work superseded that result in scope or rigor, the superseding work as well, omitting the intermediate variants.

To make the basis of this curation explicit rather than implicit, we state the criteria that governed it. A work was included when it satisfied the topical criterion, namely that it bears on at least one of the three security properties defined in Section 1 as they apply to AES or to symmetric cryptography more broadly, and at least one of the following: (a) it reported experimental results on public datasets or real hardware; (b) it introduced a method, architecture or evaluation framework subsequently adopted or contested by other groups; (c) it constituted a standardization document or official guidance; or (d) it reproduced, contradicted or bounded a previously published result.

Conversely, we excluded: incremental variations that alter hyperparameters or datasets without a methodological contribution, where a representative work of the same family was already retained; papers whose experimental setup was not described in sufficient detail to judge what was measured; works reporting only on ciphers outside the symmetric setting, unless cited for a specific conceptual point; and preprints that had neither been peer reviewed nor accumulated independent citations, unless they were the sole source for a result discussed here.

Retained works were further graded on the strength of the evidence they provide, and this grading governs how strongly each is invoked in the text rather than whether it is cited. We distinguish: standardization documents and results independently reproduced or rebutted in the literature, which we treat as settled; single-group experimental results on public benchmarks, which we report as reported; and results obtained on private datasets, in simulation, or without a reproducibility path, which we mark as indicative and do not use to support general claims. The tensions we retain deliberately, such as the exchange between [22] and [25], are examples of the first category resolving in public.

The search covered material published between January 2020 and September 2025, although some of the works considered fall outside this interval, including foundational results predating it, as detailed below, and a small number of more recent publications. We emphasize that this procedure is not equivalent to a systematic review protocol: it does not guarantee exhaustive coverage, and a different set of authors applying the same criteria would plausibly retain a partly different set of works. What it does provide is a stated basis on which our selection can be examined and challenged.

A boundary of this review deserves explicit mention. We restrict attention to standardized symmetric primitives, and to AES in particular; we therefore do not survey the substantial adjacent literature on chaos-based multimedia encryption and image steganography, in which non-standard constructions such as high-dimensional chaotic maps are proposed for domain-specific image protection [26], and in which information hiding is performed within image transformations themselves [27]. These lines of work address threat models centered on the visual content of media rather than on the cipher, its implementation or its traffic, and their security arguments are of a different, largely empirical character; connecting them rigorously to the framework of Section 1 would require an evaluation methodology of its own, which we leave outside our scope.

Although the focus is on developments from approximately 2020 to 2025, several foundational works predating this time window are referenced as needed for context, especially for established datasets, algorithms, evaluation frameworks, and theoretical results [1,7,16,28,29,30]. Examples include the formulation of template attacks [29], the evaluation framework that gave the side-channel field its standard metrics [30], the first systematic application of deep learning to cryptographic implementations [28,31], the original adversarial neural cryptography proposal [16], and the first quantitative Grover resource estimates for AES [7]. The survey does not aim to be exhaustive, as that would be impossible. It seeks to map the main lines of research and to show how artificial intelligence, cryptography and post-quantum computing are converging on a unified security-evaluation perspective in which the underlying algorithm, the implementation, the protocol and the deployment environment must be analyzed together.

3. Background on Cryptography, Artificial Intelligence and Post-Quantum Computing

3.1. Symmetric and Asymmetric Primitives

Modern cryptography relies on a combination of symmetric and asymmetric algorithms. Symmetric ciphers such as AES provide high-throughput confidentiality and are used in block-cipher modes of operation for secure channels, storage, and disk encryption. The widely used 256-bit key variant puts a classical brute-force attack well beyond any realistic computational budget. When combined with authenticated modes (AES-GCM), AES-256 is at the core of Transport Layer Security, IPsec, full-disk encryption, and cloud storage. Hash functions and message authentication codes complement symmetric encryption by protecting the integrity and authenticity of messages. The general threat model and corresponding design principles are covered in classical textbooks and in more recent surveys [4,8,15,32].

Beyond the choice of primitives, the security of deployed cryptographic systems depends on the implementation and on the surrounding protocol logic. Side-channel resistance, constant-time coding, masking and hiding countermeasures, and protections against fault injection are all part of the effective security provided to the user [1,2,3,10,29]. Encrypted-traffic analysis further shows that metadata such as packet sizes and inter-arrival times can leak information about the application or user even when the encryption itself is intact [11,12,13,14,15]. The point is simple: we have come to an age where judging AES-256 by the cipher alone tells you very little about how secure a system actually is.

3.2. Artificial Intelligence in a Cryptographic Context

Artificial intelligence is understood here primarily as machine learning, with deep learning playing a dominant role. Supervised techniques based on multilayer perceptrons, convolutional networks, and recurrent architectures alongside newer transformer-based setups have proven effective at dealing with complex patterns in high-dimensional data, such as power traces, electromagnetic measurements, or packet sequences [1,2,3,10,11]. In cryptography and security, deep networks have been used as classifiers that map side-channel traces to key hypotheses [1,2,10,28], as sequence models that interpret temporal patterns in network flows or protocol handshakes [11,12], and as generative components in the design of substitution boxes [4]. Reinforcement learning and evolutionary algorithms also appear, for instance to explore large design spaces of symmetric primitives or to optimize internal network variables in automated cryptanalysis frameworks [4].

A distinguishing feature of deep learning methods is their ability to learn suitable representations directly from raw or minimally preprocessed inputs. In side-channel analysis, this replaced much of the manual effort historically devoted to trace alignment, point-of-interest selection, and noise reduction [1,2,3,28,33]. In network security, it enables classifiers that operate on sequences of TLS handshakes or packet-level features without hand-crafted descriptors [11,12,13]. The trade-offs include increased data and computational requirements and reduced transferability to new devices, measurement setups, or network conditions, which Section 4 and Section 5 discuss in more detail [2,10,14,34]. Recent works have also raised concerns about transparent decision-making and reliability, since outputs that rely on learned representations are difficult to audit without additional tooling [10,13].

3.3. Post-Quantum Computing and the Status of AES-256

This subsection concerns primitive security in the sense of Section 1: the security of AES-256 as a mathematical object, independently of how it is implemented or deployed.

Post-quantum cryptography refers to algorithms designed to resist attacks powered by larger-scale quantum computers. The principal driver is Shor’s algorithm, which breaks both the factoring and discrete logarithm problems in polynomial time on a quantum computer and therefore breaks most deployed public-key systems [8]. In response, NIST standardized new post-quantum algorithms, including a module-lattice key-encapsulation mechanism (ML-KEM) derived from CRYSTALS-Kyber and published as FIPS 203 [6], a module-lattice digital signature scheme (ML-DSA) derived from CRYSTALS-Dilithium and published as FIPS 204 [17], and a stateless hash-based signature scheme (SLH-DSA) derived from SPHINCS+ and published as FIPS 205 [18]. These standards are complemented by general guidance, the final-round reports of the NIST process [20], transition guidance [23], and broader migration surveys [9,32,35].

For symmetric cryptography, the situation is more nuanced: Grover’s algorithm provides a quadratic speed-up for unstructured search, which reduces the security level of an n-bit key to roughly n/2 bits in an idealized quantum setting. Applied to AES-256, the bound becomes about 2¹²⁸ quantum oracle queries instead of 2²⁵⁶ classical evaluations [7], which sounds dramatic until you examine the constants. Detailed resource estimates that account for circuit depth, qubit count and quantum error correction show that mounting such an attack at scale would be extremely costly even under optimistic hardware assumptions. Jaques, Naehrig, Roetteler and Virdia [19] implemented the full Grover oracle for AES-128, -192 and -256 and counted the gates carefully; their analysis shows that Grover parallelizes poorly, so under a realistic circuit-depth limit the quadratic speed-up erodes substantially and the true cost runs far beyond near-future machines. Bonnetain, Naya-Plasencia and Schrottenloher [36] approached the question from the cryptanalytic side, quantizing the best reduced-round attacks to measure the quantum security margin of AES. The two results bracket the picture: the brute-force figure of 128 bits is conservative and operationally even weaker than it sounds, while reduced-round quantum cryptanalysis narrows the margin but leaves the full AES-256 standing.

In practice, it remains prudent to plan against the idealized Grover bound of approximately 128 bits of post-quantum security and to combine it with post-quantum key establishment, such as ML-KEM, within a KEM-DEM construction for data with very long confidentiality requirements [6,7,24,35]. This addresses the harvest-now, decrypt-later threat, in which an adversary records ciphertexts today in the hope of decrypting them once sufficiently powerful quantum computers exist. The central question driving the rest of this review follows from this position: in a world where AES-256 is still considered mathematically robust even against quantum adversaries, to what extent can artificial intelligence-driven cryptanalysis and side-channel exploitation reduce the effective security of deployed systems, and conversely, how can artificial intelligence be harnessed to build and operate more resilient cryptographic systems?

4. Artificial Intelligence for Cryptanalysis and Side-Channel Attacks

4.1. From Statistical Profiling to Representation Learning

Section 4.1 concerns implementation security. Section 4.2 and Section 4.3 concern primitive security and the surrounding construction, since neural cryptanalysis attacks the cipher rather than the device running it, and the quantum bounds discussed in Section 4.3 apply to the primitive and to the key-establishment mechanism rather than to a particular realization.

The most mature meeting point between AI and cryptography sits here, in side-channel analysis. A side-channel attack ignores the mathematics of the cipher and listens to the machine running it: its power draw, its electromagnetic signature, the time it takes [1,29]. The secret leaks through the physics, not the algebra. For two decades, the dominant profiling tool was the template attack of Chari, Rao, and Rohatgi [29], which models leakage as a multivariate Gaussian and demands that the analyst do the hard part by hand, aligning the traces, picking the points of interest, fitting the statistics. It works, but it also does not scale, and it falls apart the moment the measurement setup stops cooperating.

Deep learning rearranged the labor. Treat key recovery as classification, feed the network raw or barely processed traces, and let it discover its own representation [1,28,37]. Maghrebi, Portigliatti and Prouff [28] were among the first to show the payoff: multilayer perceptrons and convolutional networks break masked implementations, and the gap over template attacks widens precisely as noise and trace count grow, which is the regime that matters in practice. Cagli, Dumas and Prouff [33] then removed the last manual crutch by using data augmentation so that convolutional networks defeat jitter countermeasures without any realignment at all. The ASCAD database [1] turned these results into a discipline. A public benchmark on masked AES, with a fixed evaluation protocol, is what let the field stop trading anecdotes and start comparing numbers.

What made comparison meaningful in the first place was the formalized metrics introduced by Standaert, Malkin and Yung [30], which gave the community its vocabulary, guessing entropy and success rate, for stating how good an attack actually is. Deep learning has had an uneasy relationship with that vocabulary. Perin, Chmielewski and Picek [38] showed that the confidence scores these metrics rest on are jittery: change a few test traces or a weight initialization and the guessing-entropy curve moves. Their fix, ensembling several models, is sensible. The deeper point is uncomfortable. If single-model results swing with the random seed, a meaningful fraction of the reported improvements in deep learning SCA may be measuring variance rather than progress.

The Zaid–Wouters exchange makes the worry concrete. Zaid, Bossuet, Habrard and Venelli [22] proposed a principled methodology for building compact CNNs, complete with visualization tools meant to explain why each hyperparameter mattered. It was influential. Then Wouters, Arribas, Gierlichs and Preneel [25] reproduced it from the authors’ own code, cut the parameter count by about half with no loss in performance, and disputed the claimed relationship between filter size and trace misalignment. Two strong European groups, one published rebuttal, and the verdict is that the original architectural reasoning was substantially post hoc. This is not an issue; it is how a young and developing field corrects itself. But it should temper any claim that we understand why these networks work—we mostly know that they do.

Kim, Picek, Heuser, Bhasin and Hanjalic [10] pushed in a counter-intuitive direction that has held up: deliberately injecting noise during training makes the attack more resilient to random-delay countermeasures, extending these attacks to messier targets. Masure, Dumas and Prouff [37] supplied a rigorous structural guide, covering how to tune, what to measure and which protocols to trust, and Timon [31] opened the harder non-profiled setting, where the adversary has no clone device and instead reads a network’s input sensitivity as a distinguisher in its own right. An early survey by Hettwer, Gehrer and Güneysu [39] took stock of the field, and Picek and colleagues’ 2023 systematization [34] is where it has since converged, and recent AES-focused results continue to shave the trace count using denoising and feature fusion [2]. The trajectory is clear, and the practical message is that an unprotected or weakly protected AES-256 implementation offers little assurance against an adversary who can collect a sufficient number of traces from the target device. How much of a margin remains in any given case depends on the access model, the specific implementation, and the quantity and quality of the traces available.

Two limits keep this from being the end of the story. The first is appetite. These models require data and compute, and their hyperparameter space is large and only partially understood, as the Zaid–Wouters episode underscores. The second, and the one that actually protects deployed devices today, is portability. A model trained on one device tends to disappoint on another, because leakage is a property of the specific silicon and rig, and the network learns the rig along with the secret [2,10,34]. The community treats closing this gap as the central open problem. It deserves to be stated more sharply: portability is among the main practical obstacles separating deep learning SCA that works in the laboratory from deep learning SCA that works against a device an attacker has never seen, and there is no principled reason to assume that this obstacle is permanent. Attention has since arrived here too. Shift-invariant transformer networks match the best CNN trace counts on protected AES and absorb desynchronization without flinching [40]; shift-invariance, however, addresses trace misalignment, not cross-device transfer, so the portability ceiling—set by the silicon, not the model—is untouched.

The mechanism behind this result, introduced by EstraNet [40], deserves a fuller description, because it addresses the last structural advantage that convolutional architectures held. Transformer self-attention as normally formulated is sensitive to the absolute position of features in the input, which is precisely what hiding countermeasures randomize. EstraNet replaces this with a shift-invariant attention variant whose relative positional encoding makes the learned representation depend on the spacing between leakage features rather than on their absolute location in the trace, and reduces the quadratic cost of attention to linear in trace length, which is what makes traces of realistic length tractable at all. The practical consequence reported by its authors is state-of-the-art profiling performance on desynchronised traces without the data augmentation that convolutional pipelines require to achieve tolerance to the same countermeasure. In terms of the arms race described above, the countermeasure class that pushed the field from MLPs to CNNs no longer imposes an architectural penalty; the portability ceiling noted above, however, is unaffected, since shift-invariance addresses misalignment within a device, not transfer across devices.

Table 1 summarizes these methods, their main advantages, and the limitations that prevent each from generalizing, and Figure 1 presents the reported trace counts on a logarithmic scale.

Table 1. Representative AI-based methods in cryptanalysis and side-channel analysis, with the attack cost reported by each work ¹.

Method/Reference	Target & Dataset	Key Advantage	Main Limitation	Reported Cost
Template attack (Chari et al. [29])	Profiled SCA; Gaussian leakage model	Optimal under correct assumptions; well understood	Manual POI selection and alignment; assumes Gaussian noise; scales poorly	Not comparable (pre-ASCAD)
MLP/CNN profiling (Maghrebi et al. [28])	Masked AES; power traces	Breaks masking; advantage grows with noise and trace count	Heavy training data; early architectures ad hoc	1000 traces (CNN/MLP); 500 (autoencoder), 1st-order masked AES
CNN + data augmentation (Cagli et al. [33])	AES with uniform RDI	Defeats jitter with no realignment	Augmentation must be tuned; compute cost	GE = 1 in 7 traces (uniform RDI, shift augmentation); attack fails without augmentation (>1000)
CNN benchmark on ASCAD (Benadjila et al. [1])	Masked AES (ASCAD)	Public, reproducible benchmark; beats templates	Dataset-specific tuning; ASCAD is not every device	50 k profiling traces; 1146 traces to GE = 1 (ASCAD sync, as re-measured by Zaid et al. [22])
Noise-injected CNN (Kim et al. [10])	AES with random delays	Robust to desynchronization countermeasures	Hyperparameter sensitivity; limited portability	GE = 1 in 3 traces (AES_RD, with noise)
Compact CNN methodology (Zaid et al. [22])	Masked AES (ASCAD)	Small models, strong performance, visualization tools	Rationale disputed by Wouters et al. [25]; ~52% of parameters removable	GE = 1 in 191 traces (sync); 244 (desync 50); 3930× fewer params than prior CNN
Shift-invariant transformer (Hajra et al. [40])	Masked AES (ASCADf, ASCADr, CHES20); random delay and clock jitter	Linear time and memory in trace length; shift-invariant; scales beyond 10 K samples	Assumes constant relative POI distances; degrades on traces beyond 40 K; β2 requires tuning	GE = 1 in 13 traces (ASCADf, 10 K window); up to 90% fewer traces than CNN and LSTM benchmarks
Methodology/evaluation study (Masure et al. [37])	Masked AES (ASCAD)	Principled tuning and metric guidance	Core result is a general theorem; empirical tightness shown on specific leakage models	Not applicable (methodological)
Non-profiled DL-SCA (Timon [31])	AES; no clone device	Removes the profiling assumption	Lower efficiency; sensitivity-based distinguisher is fragile	Not comparable (non-profiled)
Model ensembles (Perin et al. [38])	Masked AES (ASCAD)	Stabilizes jittery metrics; better generalization	Training cost multiplied; masks variance more than it solves it	Not comparable (variance study)
Neural differential distinguisher (Gohr [5])	Speck32/64, reduced rounds	Beats classical distinguisher; real key recovery	Lightweight cipher and reduced rounds; no result on full AES-256	Not applicable (Speck32/64)
Cipher identification, CNN (Hu & Yuan [41])	AES/3DES/CAST/RC2/Blowfish; NIST randomness-test features	Names the algorithm from ciphertext alone; beats classical ML and MLP	Synthetic ECB data; ~87.5% binary; identification, not key recovery	~87.5% binary accuracy (not key recovery)
Cipher identification, lightweight ML (Kowalewski & Grzes [42])	AES/DES/3DES/RC4; byte-level statistics	Runs on edge/IoT; Random Forest and Bagging most stable	Degrades sharply under CBC and key diversity; ECB-bound	~78% accuracy (Random Forest, single key)

¹ Targets and datasets are those reported by the cited works. The reported cost is the number of attack traces at which the correct key reaches rank one (reported as guessing entropy 0 or 1 depending on the rank-indexing convention of each work), or the classification accuracy for cipher-identification methods. Because the reported settings differ in dataset variant, desynchronization level, leakage model and profiling-set size, these values are not directly comparable across rows; works evaluated outside the ASCAD benchmark are marked as not comparable. All limitations listed are drawn from the reproducible experimental studies cited, not from theoretical inference.

Figure 1. Attack cost across side-channel studies: traces required for the correct key to reach rank one, on a logarithmic scale, annotated per setting. Values are taken from Benadjila et al. [1], Maghrebi et al. [28], Zaid et al. [22], Hajra et al. [40], Cagli et al. [33] and Kim et al. [10]; they were obtained under different evaluation protocols and are indicative only.

A related implementation threat deserves brief mention because it increasingly appears in combination with the passive attacks surveyed here. Fault injection attacks perturb the computation itself, through voltage or clock glitching, electromagnetic pulses or laser illumination, and recover the key from the relationship between correct and faulty outputs; differential fault analysis against AES is long established and requires very few faulty ciphertexts [43]. Deep learning has entered this area in the same supporting role it plays in side-channel analysis: classifiers assist in identifying exploitable fault positions, in filtering effective from ineffective injections, and in combined attacks in which a fault forces the implementation into a state whose leakage is then profiled. For the effective security of an AES-256 deployment the consequence is the same as in Section 4.1: the mathematical margin of the primitive is not reduced, but an unprotected implementation exposed to physical access cannot rely on it, and countermeasures against leakage and against faults must be budgeted jointly rather than separately.

4.2. Neural Differential Cryptanalysis

Side-channel work attacks the implementation. A separate and more provocative question is whether learning can attack the cipher itself. Gohr’s CRYPTO 2019 result [5] is the landmark: a residual network trained on Speck32/64 learns a differential distinguisher that beats the best classical one, and bolted onto a Bayesian key search it yields real key recoveries on eleven and twelve rounds. Follow-up work carried the idea to Simon, Simeck and other lightweight designs [4,5]. The accomplishment is genuine and it surprised people.

It is worth being precise about what it is not. The target is a 32-bit block lightweight cipher with fewer rounds, a universe away from full AES-256. And the most interesting line of subsequent analysis asked the deflating question, what is the network actually learning, with evidence that a large part of its edge corresponds to differential structure that classical cryptanalysts can characterize once they know to look for it. So far, neural distinguishers have automated and modestly sharpened classical cryptanalysis rather than uncovering structure beyond its reach. That is valuable; it is not the revolution occasionally advertised. Against full-round AES-256 these methods have produced nothing, and there is no current indication that they will.

A related but distinct line of work asks not for the key but for the name of the algorithm: given only ciphertext, can a model identify which cipher produced it? Hu and Yuan [41] cast the problem as classification, feeding features drawn from the NIST randomness-test suite to a convolutional network that distinguishes five block ciphers, AES among them, at roughly 87.5% in the binary setting, comfortably ahead of classical learners and a multilayer-perceptron baseline. Kowalewski and Grzes [42] pursue the same goal under a deliberately austere budget, extracting only basic byte-level statistics, entropy, mean, variance, and skewness among them, and handing them to lightweight ensembles meant to run on edge and IoT hardware, where Random Forest and Bagging prove the most accurate and stable.

The same pragmatism applies to AI in cipher design [4]. Generative networks have been used to synthesize S-boxes with high nonlinearity and good differential uniformity, reinforcement learning to hunt for differential trails, and learning-based methods to probe the parameter choices of lattice schemes, including LWE instances with sparse secrets [4]. None of this has dented a standardized primitive. Its real contribution is as an aggressive testing layer, another way to stress-test margins before a primitive is trusted, and the honest reading is that standardization is the beginning of scrutiny, not the end of it [4,20,23].

4.3. Networks as Encryption, and the Quantum Backdrop

Could a neural network be the cipher? The Abadi-Andersen construction [16] is the reference point: three networks, Alice, Bob, and Eve, trained adversarially until Alice and Bob communicate in a way Eve cannot follow. It is an elegant demonstration that encryption-like behavior can be learned. It is also not cryptography in any sense a practitioner would accept, because it offers no security proof and no resistance argument, and later analysis duly took such schemes apart [4]. The consensus, which this review shares, is that AI belongs around cryptography, design, evaluation, and attack of implementations, and not within the primitive, where rigorous analysis is non-negotiable.

The quantum backdrop sharpens the same division between the cipher and its setting. Grassl et al. [7] gave the first concrete Grover resource estimate for AES; Jaques, Naehrig, Roetteler and Virdia [19] then implemented the full Grover oracle for AES-128, -192 and -256 and counted the gates honestly, finding that the quadratic speed-up degrades badly under a realistic depth limit because Grover does not parallelize well. Bonnetain, Naya-Plasencia and Schrottenloher [36] quantized the best reduced-round attacks to measure the cipher’s quantum security margin. Neither result supports panic, and both argue for the same hedge the standards bodies recommend: deploy AES-256 within a KEM-DEM construction whose key is established by a post-quantum mechanism such as ML-KEM [6], which mitigates harvest-now, decrypt-later without altering the security of AES-256 itself, and stop treating the primitive as if it were the whole problem. From a post-quantum standpoint, the effective security of a concrete deployment depends far more on its resistance to artificial intelligence-assisted side-channel, fault, and protocol-level attacks than on the residual Grover bound. That conclusion argues for hardened, constant-time implementations evaluated with the very deep learning techniques an adversary would use [1,2,37,38], and for future standardization efforts to include an explicit AI-based evaluation track, in line with the systematic use of deep learning at venues such as CHES and CARDIS in recent years [3,5,10,33].

4.4. Countermeasures and Their Cost

The preceding subsections describe an attack surface that has widened considerably. This subsection summarizes the defensive side, which the literature treats far more unevenly, and states what each layer costs. We organize it by the three security properties defined in Section 1, since a countermeasure that protects one of them offers nothing to the others.

Implementation-level countermeasures. The dominant approach remains masking, in which every sensitive variable is split into d + 1 shares such that no proper subset reveals information about the underlying value. The security argument is well established: under a probing model, an attacker restricted to d observations learns nothing [44], and in a noisy leakage model the number of traces required grows exponentially in the masking order [45]. The cost, however, grows quadratically in d for the nonlinear layer, since securing a finite-field multiplication under the ISW construction requires O(d²) partial products and a corresponding volume of fresh randomness [45]. Optimized software implementations have narrowed this gap but have not removed it [46], and in hardware the picture is complicated further by glitches, which invalidate the probing argument unless the design satisfies the stronger non-completeness requirement of threshold implementations [47].

What deep learning changed here is not whether masking works but how much of it is needed. The results surveyed in Section 4.1 show that profiled neural attacks recover masked keys without explicit higher-order combination and without a leakage model supplied by the analyst, which in practice raises the masking order required for a given security margin rather than rendering the countermeasure obsolete. This is the correct reading of the ASCAD results: first-order masked implementations that resisted classical template attacks fall to convolutional models, while the same models require substantially more traces as the order increases. End-to-end evaluations of a certified, fully protected implementation confirm both halves of this statement: full key recovery succeeds against a hardened target that combines masking with shuffling, but only after a profiling set on the order of hundreds of thousands of traces, whereas the attack phase itself requires only a few hundred [48].

Hiding countermeasures, which aim to reduce the signal-to-noise ratio rather than to remove the dependency, have fared worse. Random delays, shuffling and clock jitter all degrade the alignment on which classical attacks depended, but the same desynchronization is substantially neutralized by data augmentation, by convolutional architectures whose pooling confers partial shift tolerance, and more directly by the shift-invariant transformer designs discussed in Section 4.1. Hiding is therefore best regarded as raising the cost of acquisition rather than as an independent line of defense, and it is most effective when composed with masking rather than substituted for it.

Protocol-level countermeasures are addressed in Section 5.4, since they defend metadata privacy rather than the implementation. Algorithm-level measures against the quantum threat are addressed in Section 4.3; we note only that they are orthogonal to the two layers above, and that neither doubling the key length nor adopting a post-quantum key-establishment mechanism affects side-channel leakage at all.

A structural asymmetry runs through this literature and deserves to be stated plainly. Attacks are evaluated against countermeasures that predate them, whereas countermeasures are rarely re-evaluated against attacks that postdate them. Every result in Section 4.1 was obtained against a fixed, previously published protection scheme; comparatively few studies revisit an established defense once a new attack class appears. The practical consequence is that reported security margins for deployed countermeasures should be read as upper bounds established at the time of evaluation, and not as standing guarantees.

Constrained devices. The gap between what is provable and what is deployable is widest on low-cost embedded targets, which are also the most numerous real-world hosts of symmetric encryption. Three constraints compound there. First, the quadratic cost of higher-order masking is prohibitive on 8-bit and low-end 32-bit microcontrollers, where a masked AES already carries a substantial penalty at first order and where the requisite fresh randomness may exceed the available entropy budget; devices in this class frequently lack a hardware random number generator adequate for the purpose. Second, such devices commonly execute AES in software for want of a cryptographic accelerator, which produces long, well-structured traces that are comparatively favorable to a profiled attacker. Third, the attacker’s access model is often more permissive than in the server setting, since the physical device is in hand. It is worth noting in this context that two of the standard evaluation datasets, ASCAD and AES_RD, are themselves captured from 8-bit microcontroller implementations, so a substantial part of the deep learning side-channel literature already describes this deployment class, even where the papers do not frame it that way. What is comparatively scarce is the converse: systematic evaluation of which reduced-cost protection schemes remain effective against neural attacks under a realistic embedded budget. We identify this as an open problem in Section 6.

Artificial intelligence also appears on the defensive side of this contest, in three roles worth distinguishing. First, it appears as an evaluation instrument: the same profiling models that constitute the attack are used by certification laboratories as worst-case leakage detectors, on the reasoning that an implementation which resists the strongest known learner has a measurable margin, and deep learning leakage assessment is progressively entering evaluation practice alongside classical statistical tests. Second, it appears as a design aid, in which learned models guide the placement of countermeasures or search for leakage in pre-silicon simulation, before a device is manufactured. Third, and most directly parallel to the attacks of Section 5, it appears as adversarial-perturbation defenses against traffic fingerprinting such as Mockingbird craft padding patterns specifically optimized to defeat neural classifiers rather than statistical ones, reporting a reduction in the strongest attack’s accuracy from over 98 percent to between 42 and 58 percent at a bandwidth overhead of 58 percent [49]. The asymmetry noted above nevertheless applies with equal force here: a defense optimized against today’s classifier inherits no guarantee against tomorrow’s, and adversarially crafted defenses in particular are exposed to adaptive attacks in a way that information-theoretic designs such as Tamaraw are not.

5. Artificial Intelligence for Encrypted-Traffic Analysis and Anomaly Detection

5.1. From Ports and DPI to Packet-Sequence Models

The results in this section concern neither primitive nor implementation security. They assume throughout that the encryption is unbroken, and quantify what remains observable in spite of that, which is why they bear on the privacy of a deployment rather than on the security of AES-256 as a cipher.

Encrypted-traffic analysis is where this whole subject becomes visible to people who never read a security paper. The old toolkit, port numbers, deep packet inspection of cleartext payloads, and hand-built flow statistics, collapses once TLS, QUIC, and VPNs carry most of the traffic [11,15]. What replaced it treats a flow as a sequence of packet sizes, inter-arrival times, and the shape of the TLS handshake, fed to a network that learns its own features [11,50]. Rezaei and Liu [11] framed the shift early and bluntly: encryption hides the payload, not the silhouette of the traffic wrapped around it, and convolutional and recurrent models read that silhouette well enough to name the application.

The strongest evidence comes from the multimodal line developed by Aceto, Ciuonzo, Montieri and Pescapé. MIMETIC [50] fuses several views of a flow and payload bytes together with packet-length and timing sequences, into one classifier and beats single-view deep models on real mobile traffic; DISTILLER [51] extends the idea to several classification tasks at once. These are not toy results, and they rest on real corpora, including the ISCX VPN and non-VPN captures of Draper-Gil, Lashkari, Mamun and Ghorbani [21]. Datanet [52] showed the machinery runs at the edge, inside an SDN home gateway. FlowPic [53] reached the same conclusion from a different direction, rendering a flow’s size-and-time sequence as an image and handing it to a vision CNN, with accurate separation of regular, VPN and Tor traffic. Pathmaperuma and colleagues [12] added the operationally important ability to flag traffic the model was never trained on, rather than silently misclassifying it.

More recently, the field borrowed BERT wholesale: pre-train on unlabeled traffic at scale, fine-tune on a few labeled examples, and beat the earlier models on the very same VPN, Tor and TLS 1.3 benchmarks [54]. The headroom is the uncomfortable part—it means the leak is even larger than the first generation suggested.

There is a methodological weakness under some of these numbers, and it deserves naming. The same group that built MIMETIC has also documented how easily capture artifacts inflate accuracy: a classifier that looks like it recognizes an application may really be recognizing the testbed [55]. When packet-capture conditions differ between classes, a deep network will happily seize on that difference and report a result that evaporates in the field [13,14]. Anyone reading the headline accuracies in this literature should ask first what the model could be keying on besides the thing it claims to detect.

Table 2 summarizes representative traffic-analysis methods, along with their datasets and principal limitations, while Figure 2 presents the corresponding accuracies.

Table 2. Representative AI-based methods in encrypted-traffic analysis, with the best performance reported by each work ¹.

Method/Reference	Dataset	Key Advantage	Main Limitation	Reported Accuracy
DL overview, CNN/RNN (Rezaei & Liu [11])	Various encrypted-traffic corpora	Established the metadata-only classification paradigm	Survey-level; early architectures	Not applicable (survey)
Multimodal fusion, MIMETIC (Aceto et al. [50])	Mobile traffic; ISCX VPN/non-VPN [21]	Fuses payload with size and timing; beats single-modality	Needs labeled multimodal data; capture-condition bias [55]	89.5% (Android), 89.1% (iOS), 80.0% (FB/FBM)
Flow-as-image, FlowPic (Shapira & Shavitt [53])	ISCX VPN/non-VPN; Tor	Simple image representation; regular/VPN/Tor split	Coarse for fine-grained tasks; resolution-sensitive	>96% (categories), >99.2% (VPN), >89% (Tor)
Edge classifier, Datanet (Wang et al. [52])	SDN home-gateway traffic	Runs at the network edge	Gateway-specific; limited application scope	~98.8% precision (SAE), ~98.5% (CNN), full dataset
Unknown-data detection (Pathmaperuma et al. [12])	Encrypted application traffic	Flags out-of-distribution traffic	Open-set thresholds hard to calibrate	90%+ (trained activities), 79% avg. (unseen)
Website fingerprinting, DL (Rimmer et al. [56])	Tor traces (closed/open world)	Fingerprints Tor despite fixed-size cells	Closed-world assumptions; large training sets	>96% (100 sites), 94% (900 sites, closed world)
Deep Fingerprinting (Sirinam et al. [57])	Tor; padding-defended traces	Defeats padding-based WF defenses	Tor-specific; degrades under heavy or randomized defenses	98.3% (Tor, undefended); 90% (against WTF-PAD)
Trustworthy DL (Li et al. [13])	Encrypted-traffic classification	Uncertainty and calibration; can abstain	Added complexity; calibration itself drifts	87.4% (ISCX VPN-nonVPN), 99.1% (USTC-TFC2016);
Drift study (Malekghaini et al. [14])	Longitudinal encrypted traffic	Quantifies drift and gives architecture adaptations that recover accuracy	Adaptations are manual; periodic retraining still needed	Not comparable (drift study)

¹ Datasets are those reported by the cited works. The last column reports the best accuracy stated by each work on the dataset indicated, or precision where the work reports precision. Because datasets, class counts and open- versus closed-world settings differ, these values are not directly comparable across rows. All limitations listed are drawn from the reproducible experimental studies cited, not from theoretical inference.

Figure 2. Reported performance across encrypted-traffic studies, annotated per setting. Values are taken from Aceto et al. [50], Pathmaperuma et al. [12], Rimmer et al. [56], Sirinam et al. [57], Wang et al. [52], Li et al. [13] and Shapira & Shavitt [53]. Values are accuracies except Datanet (precision) and Rimmer et al. (success rate), and are not comparable across studies.

5.2. What Website Fingerprinting Already Settled

The traffic-classification literature and the website-fingerprinting literature study the same physical fact, that encryption leaves metadata exposed, and they mostly do not cite each other. Read together, the privacy verdict is much harsher than the networking papers alone suggest. Website fingerprinting comes out of the anonymity community, and it targets the hardest case, Tor, which already pads packets to fixed cell sizes specifically to destroy the size signal. Rimmer, Preuveneers, Juarez, Van Goethem and Joosen [56] showed that deep networks fingerprint Tor sites anyway, learning automatically the features that earlier attacks hand-engineered. Sirinam, Imani, Juarez and Wright [57] went further and broke the defenses: their Deep Fingerprinting attack defeats padding-based countermeasures explicitly designed to stop exactly this.

That result should reframe how the rest of this section is read. If a convolutional network can identify a website over a channel engineered to be unidentifiable, the padding and obfuscation defenses proposed elsewhere for ordinary TLS and QUIC [15,53] are facing a losing arms race, not a solvable engineering task. Confidentiality of the payload and unlinkability of the behavior are different properties, and the second is far weaker than users assume. AES-256 protects the first absolutely and the second not at all.

5.3. Trust, Drift, and the Arms Race

Two honest caveats keep the offensive picture from running away with itself, and both cut against naive deployment of these classifiers. Li and colleagues [13] argue that a traffic classifier wired to take action, to block a flow, throttle a user, or escalate a session, has no business reporting a confident label it cannot stand behind, and add uncertainty estimation and calibration so the model can abstain. Malekghaini and colleagues [14] document data drift, the failure everyone suspected and few measured: train on last year’s traffic and accuracy decays as application versions, protocol revisions, and network conditions shift underneath the model. A static classifier is a depreciating asset.

In practice, the fight between traffic analysis and privacy defenses is a never-ending cycle. Attackers must constantly retrain their models as network data changes, while defenders are forced to invent new defenses once the old ones are bypassed. Neither side ever wins for good. The survey of Sharma and colleagues [15] catalogs the breadth of what metadata gives up, including protocol identification, application classification, user-action inference, and malware and anomaly detection, and the recurring thread is that the leak is structural, a property of how these protocols put bytes on the wire, not a bug awaiting a patch.

5.4. Protocol Design, Privacy, and the Combined Adversary

Three consequences follow for anyone designing systems rather than attacks. First, payload indistinguishability does not buy metadata privacy; strong encryption and leaky flows coexist comfortably [11,12,15]. Second, the countermeasures that could narrow the gap, padding, cover traffic and constant-rate transmission, cost real bandwidth and latency and, as Deep Fingerprinting [57] shows, are not guaranteed to work even then. Third, the dual-use problem is unavoidable: the classifier that catches data exfiltration on a corporate network is, feature for feature, the classifier that profiles users at a national gateway [13,15].

The post-quantum angle is almost an aside, and that is precisely the point. Whether a session key comes from classical Diffie-Hellman, ML-KEM [6], or a hybrid of both, the flow it protects has the same observable shape. Traffic analysis is orthogonal to the key-exchange primitive, which means migrating to post-quantum cryptography does nothing for metadata privacy, essentially, a fact worth stating plainly because the migration’s own guidance documents [9,23,35] are only beginning to acknowledge it.

This is where the threat models converge. A serious adversary need not choose between capabilities. It can read metadata at the network edge, exploit implementation leakage with the deep learning side-channel methods of Section 4 [1,2,10], and bank ciphertext today in anticipation of tomorrow’s quantum machine [7,19]. Against that adversary, AES-256 in an authenticated mode is one necessary component among several: post-quantum key establishment [6], implementations hardened and then tested with the same models the attacker will use [37,38], and protocol-level metadata defenses that, in candor, the field does not yet know how to make robust [56,57]. Crypto-agility, meaning negotiable algorithms, routine key rotation and observability built in from the start, is the architecture that lets a system survive being wrong about any one of these [9,35]. Whether deployments will keep pace with the standards is the question no standard can answer.

The picture on the defensive side of traffic analysis can be stated quantitatively, because the website-fingerprinting literature has converged on a common evaluation practice: a defense is characterized by its bandwidth overhead, its latency overhead, and the residual accuracy of the strongest available attack against defended traffic. Table 3 summarizes the main families. Provable-security designs such as Tamaraw regularize traffic into fixed-rate patterns and offer formal upper bounds on attacker accuracy, but at bandwidth and latency costs frequently exceeding 100 percent, which has kept them out of deployment [58]. Adaptive padding, represented by WTF-PAD, fills statistically unusual gaps between bursts with dummy packets at zero added latency and a bandwidth overhead reported between roughly 32 and 54 percent across evaluations [59,60]; it defeated the classical attacks it was designed against, but deep learning classifiers recover over 90 percent accuracy against it [57,60]. Walkie-Talkie molds burst sequences in half-duplex communication at a reported 31 percent bandwidth and 34 percent latency overhead, and by design bounds the strongest attack near 50 percent accuracy, at the price of modifying browser behavior [61]. Zero-delay randomized defenses such as FRONT concentrate dummy traffic at the start of a page load, where fingerprinting information density is highest, matching or improving on WTF-PAD at comparable bandwidth cost and no added latency [59]. Rate-regularizing designs such as RegulaTor occupy the middle ground, reporting reductions in a timing-aware deep learning attack to near 11 percent accuracy at approximately 40 percent bandwidth and 15 percent latency overhead [62].

Table 3. Reported cost and effectiveness of representative website-fingerprinting defenses. Figures are those reported by the cited evaluations, which use different datasets and attack models; they indicate orders of magnitude rather than a controlled comparison.

Defense	Mechanism	Bandwidth Overhead	Latency Overhead	Attack Accuracy (Defended)
Tamaraw [58]	Fixed-rate traffic regularization	Very high (>100%)	Very high	Provable upper bound
WTF-PAD [60]	Adaptive padding of inter-burst gaps	32–54%	~0%	>90% (deep learning)
Walkie-Talkie [61]	Half-duplex burst molding	31%	34%	~50%
FRONT [59]	Randomized front-loaded padding	~30–50%	0%	20–60% TPR (DF ~60%)
RegulaTor [62]	Rate regularization	~40%	~15%	~11% (timing-aware DL)

Two observations follow. First, the pattern of Section 4 repeats at the protocol level: every defense in Table 3 except the provable-security family was evaluated against the attacks of its time, and the deep learning generation of classifiers subsequently degraded several of them, most visibly WTF-PAD. Reported effectiveness figures should therefore be read against the attack model in force at publication. Second, none of these mechanisms is deployed at scale in TLS or QUIC today; padding provisions exist in both protocols but are left to implementations, so the measured leakage described in Section 5.1 through Section 5.3 is the leakage of essentially undefended traffic. The gap between what the defense literature can achieve and what deployed protocols actually do is at present the largest single factor in the metadata-privacy property defined in Section 1.

6. Conclusions and Future Work

The main conclusion of this review is simple. The security of a system using AES-256 cannot be assessed solely at the level of the primitive; it also depends on the implementation, the surrounding protocol, and the threat model.

Three observations follow. First, deep learning side-channel analysis has matured to the point where an unprotected or weakly protected AES-256 implementation should not be assumed secure against an adversary with physical access and trace-acquisition capability, even as limited portability across devices remains one of the barriers that keep many of these attacks in the laboratory [2,10,34]. Second, encrypted-traffic analysis shows that metadata remains informative even where payload confidentiality is fully preserved, independently of which post-quantum primitive is used for key establishment, and the website-fingerprinting results show that defenses against it are an arms race rather than a settled engineering problem [56,57]. Third, running Grover against AES-256 at scale remains extremely expensive, and once circuit depth is accounted for it is operationally even weaker than the headline 128-bit figure [19]; successive analyses have optimized the oracle’s gate count, but the depth-constrained cost that actually governs feasibility has not fallen.

The unresolved problems identified through this review fall into three research tracks, which we state with the concrete questions each implies. In hardware security, the first open problem is cross-device transferability: no published profiling attack yet demonstrates reliable key recovery against a device population it was not trained on, and until portability is either achieved or shown to be structurally hard, laboratory results will keep overstating or understating field risk in ways that cannot be audited. The second is evaluation: guessing entropy and success rate are estimated differently across papers, as reproduction studies have exposed [22,25,38], and the field lacks an agreed, statistically grounded protocol for reporting them, which is a precondition for any standardized AI-aided certification of masked implementations. In network security, the immediate problem is drift: traffic classifiers degrade as protocols, content delivery and user behavior evolve [14], and self-adapting classifiers with automatic drift detection remain undemonstrated at scale; on the defensive side, the padding provisions of TLS 1.3 and QUIC are unused in practice, and the design of metadata-resistant defaults that survive real deployment constraints is open. In post-quantum hybrid cryptography, the composition of ML-KEM with AES-256 in a KEM-DEM construction would benefit from formal security proofs covering the joint construction rather than its components, and lightweight instantiations of that construction for the constrained devices of Section 4.4 remain to be established and evaluated against the side-channel attack surface that this review shows is already practical. The most useful future work would treat AI-based evaluation, side-channel hardening and post-quantum migration as a single design problem rather than three separate ones.