Improved Differential Neural Distinguishers for SHA-3-256 and Ascon-Hash256

Abstract

The sponge construction serves as a fundamental design framework for hash functions and authenticated encryption algorithms. In differential cryptanalysis of large-state permutations underlying such algorithms, conventional approaches are constrained by state size and diffusion speed. The feature extraction capability of deep learning offers a potential alternative to mitigate these limitations. To improve the distinguishing performance of differential neural distinguishers against sponge-based algorithms, a methodology integrating data construction and network architecture optimization is proposed. Specifically, a multi-sample triplet input format is designed to preserve differential characteristics, and a convolutional block attention module is introduced to capture long-range dependencies along both the channel and spatial dimensions within the large-state permutation. Experimental evaluations were conducted on the Keccak and Ascon algorithms. For Keccak, the maximum distinguishable round number was identified as 3. At this round number, Keccak-p achieved full distinguishability (100% accuracy), while the sponge-based SHA-3-256 attained a distinguishing accuracy of 99.99%, improving upon the previous best result by 0.95 percentage points. For Ascon, the maximum distinguishable round number was 4, where Ascon-p achieved an accuracy of 54.85% with 64 sample pairs—the highest reported accuracy for this setting—while delivering comparable performance at the matched 32-pair setting (53.40% vs. 53.54% in prior work) with approximately one-twelfth of the training epochs; under the same setting, the sponge-based Ascon-Hash256 achieved an accuracy of 53.06%. These findings demonstrate the effectiveness of the proposed framework in enhancing neural distinguisher accuracy against sponge-based algorithms and offer an analytical approach for empirical security evaluation, with results qualitatively consistent with the indifferentiability bound of the sponge construction.

1. Introduction

The sponge construction is a general-purpose design framework that employs a fixed-width public permutation as its core “engine” and can produce outputs of arbitrary length through two phases: absorption and squeezing. The Keccak and Ascon families, built upon this construction, have been adopted as the Secure Hash Algorithm-3 (SHA-3) standard and as the lightweight authenticated encryption and hashing standard, respectively. The indifferentiability proof of the sponge construction establishes that, when the underlying permutation is modeled as an ideal random permutation, the output of the sponge construction remains computationally indistinguishable from a truly random function throughout the absorption and squeezing processes, thereby providing quantifiable security guarantees. Differential neural distinguishers leverage neural networks to learn the statistical characteristics of difference distributions from large sets of ciphertext pairs, enabling the distinction between a random permutation and a cryptographic primitive. In recent years, this approach has emerged as a research focus in symmetric cryptanalysis. Consequently, constructing neural distinguishers for representative sponge-based algorithms and assessing their practical security margins represents a forward-looking research direction.

In 2019, Gohr [1] first introduced neural networks into differential cryptanalysis by constructing a differential neural distinguisher against the reduced-round Speck 32/64 algorithm. Their distinguisher achieved superior performance over conventional statistical differential distinguishers, establishing a new paradigm of deep learning-assisted cryptanalysis. Benamira et al. [2] analyzed the decision mechanism of Gohr’s distinguisher from an interpretability perspective, revealing that its classification performance depends not only on the difference distribution at the final round but also substantially on those at the penultimate and third-to-last rounds. Liu et al. [3] extended the input space by incorporating ciphertext pairs or ciphertext differences after one additional decryption round, achieving longer distinguishable rounds and higher accuracies on the Speck and Simon algorithms. To expand the information dimensions available to the distinguisher, Chen et al. [4] constructed a neural distinguisher for 3-round SHA-3-256 using residual networks, attaining a maximum accuracy of 72.28%; when jointly leveraging 16 ciphertext pairs for decision-making, the accuracy improved to 99.04%, initiating the exploration of multi-ciphertext-pair input paradigms. Research on the Ascon algorithm has been more extensive. Baksi et al. [5] built neural distinguishers for 1- to 3-round Ascon permutations based on a multilayer perceptron architecture, achieving an accuracy of 98.6% for the 3-round permutation. Yang [6] observed that Gohr’s network architecture could effectively learn distinguishers for up to 3.5 rounds of the Ascon permutation. Su et al. [7] employed a residual shrinkage network with multi-ciphertext-pair inputs, improving the distinguishing accuracy for 4-round Ascon permutations to 53.54%; however, the cross-algorithm transferability of their framework has not been systematically validated. Shen et al. [8] proposed a classification strategy based on multi-ciphertext difference score distributions, where the scores output by a distinguisher for multiple ciphertext pairs are aggregated as inputs to a second-stage classifier, raising the accuracy for 4-round Ascon permutations to 69.25%. Yadav et al. [9] focused on optimizing evaluation metrics by manually constructing optimal decision thresholds to distinguish between real and random ciphertext pairs, further improving the accuracy for 4-round Ascon permutations to 99.4%. Notably, the performance gains reported by Shen and Yadav primarily stem from changes in the evaluation methodology rather than from intrinsic enhancements in the distinguisher’s capacity to learn deep cryptographic features. Consequently, these approaches do not address the core bottleneck of differential feature representation capability in single forward inference.

Although the aforementioned studies have validated the feasibility of neural distinguishers against representative sponge-based algorithms, the field currently faces two critical challenges that warrant further investigation. First, most existing architectures are designed for block-based ciphers and exhibit suboptimal performance when applied to sponge-based hash functions that operate via bit-slicing. The bit-level diffusion mechanisms in such algorithms are not effectively captured for long-range differential dependencies, often necessitating deeper networks or larger datasets to compensate for insufficient receptive fields. Second, existing studies have largely focused on individual algorithms, without systematically distilling the common characteristics of this class of constructions. In light of these limitations, this study selects Ascon and Keccak as representative sponge-based algorithms and adopts a residual network architecture augmented with convolutional block attention modules to capture long-range dependencies along both channel and spatial dimensions. By employing triplet-format datasets and multi-sample-pair input paradigms, the proposed approach aims to improve the distinguishing accuracy of neural distinguishers against sponge-based algorithms, thereby providing new experimental evidence and methodological references for the security evaluation of this class of algorithms under neural distinguishing analysis.

The main contributions of this study are threefold. First, we propose a triplet-format input and extend it to a multi-sample-pair paradigm to amplify weak statistical signals, differing from the single-pair or difference-only inputs in prior work. Second, we introduce a CBAM-enhanced residual network with Optuna-based optimization and a cyclical learning rate to capture long-range dependencies in large-state permutations, whereas other existing approaches focus on post hoc evaluation strategies rather than improving intrinsic representational capacity. Third, we systematically compare distinguishers against core permutations (Keccak-p/Ascon-p) and their sponge-based hash instantiations (SHA-3-256/Ascon-Hash256) under single-message-block settings, a side-by-side comparison not previously conducted. Collectively, our novelty lies not in marginal percentage-point gains, but in the integrated methodology combining data representation, architectural design, and systematic evaluation that advances deep-learning-assisted cryptanalysis for sponge-based constructions. The remainder of this paper is organized as follows. Section 2 provides preliminary descriptions of the Ascon and Keccak algorithms and the fundamentals of multi-ciphertext-pair differential neural distinguishers. Section 3 presents the proposed construction methodology for neural distinguishers. Section 4 applies this methodology to construct four types of distinguishers targeting Ascon-p, Ascon-Hash256, Keccak-p, and SHA-3-256. Section 5 analyzes the experimental results and summarizes the distinguishing characteristics of this class of algorithms. Finally, Section 6 concludes the paper and discusses future research directions.

2. Preliminaries

The sponge construction [10] operates through a fixed-width public permutation that absorbs an arbitrarily long input bitstream and generates an output bitstream of arbitrary desired length. Its standard mathematical formulation is defined as follows:

$$\mathrm{E}\left(·\right)=Sponge\left[f,pad,r\right]\left(M,d\right)$$

(1)

where M denotes the input message, d denotes the output length, f denotes the fixed permutation, and r denotes the rate—i.e., the number of bits processed per absorption or squeezing operation, which reflects the throughput of the algorithm. The parameter pad specifies the padding rule, which extends the input data to a multiple of r bits, enabling sequential XOR operations with the first r bits of the state. In this study, the representative fixed permutations examined are the Keccak permutation and the Ascon permutation. The corresponding sponge-based hash algorithms are primarily SHA-3-256 and Ascon-Hash256.

2.1. Keccak Algorithm

2.1.1. Keccak Permutation

The core Keccak permutation, denoted as Keccak-p[b, n_r] and referred to as Keccak-p throughout this paper, operates on a state of width b = 5 × 5 × ω, where ω = b/25. The internal state of the permutation is illustrated in Figure 1, and n_r denotes the number of iterative rounds. When n_r satisfies the condition in Equation (2),

$$n_r=12+2\times {\log }_2\omega$$

(2)

Keccak-p[b, n_r] is denoted as Keccak-f[b]. In particular, Keccak-f[1600], which applies 24 rounds of iterative updates to a 1600-bit state, serves as the base permutation underlying the SHA-3 algorithm.

2.1.2. SHA-3-256 Algorithm

SHA-3-256 is one of the hash functions in the Secure Hash Algorithm-3 (SHA-3) family [11], officially published by the U.S. National Institute of Standards and Technology (NIST) in 2015. The algorithm is designed based on the Keccak construction. When the state width b is set to 1600 bits, the Keccak algorithm is denoted as Keccak[c](M, d), where c denotes the capacity, M denotes the variable-length message, and d denotes the digest length.

The SHA-3-256 algorithm adopts a sponge construction and is instantiated as Keccak[512](M||01, 256). During the initialization phase, the 1600-bit state is set to zero. In the absorption phase, the message M is appended with a two-bit suffix (01) and padded to a multiple of 1088 bits. Each block is then processed sequentially by XORing it with the first 1088 bits of the current state, followed by the application of the Keccak-p permutation. The updated state is then used for processing the subsequent block until all blocks have been consumed. In the squeezing phase, the first 256 bits are truncated from the 1088-bit rate portion of the current state as the output digest. SHA-3-256 is widely employed as a component in various information security applications, often serving as a generator for pseudo-random components.

2.2. Ascon Algorithm

2.2.1. Ascon Permutation

All algorithms in the Ascon family share a unified lightweight permutation, denoted as Ascon-p^n_r (hereafter referred to as Ascon-p, where n_r denotes the number of rounds). Among these, Ascon-p⁸ and Ascon-p¹² serve as the core components of the algorithm. The permutation is based on a Substitution–Permutation Network (SPN), which enables rapid data diffusion with low resource overhead. The permutation state is defined as follows:

$$S=S_0\parallel S_1\parallel S_2\parallel S_3\parallel S_4$$

(3)

The 320-bit internal state S is partitioned into five 64-bit words S_i (0 ≤ i ≤ 4). Each word is treated as a 64-bit unsigned integer, with the rightmost bit being the least significant bit. The round transformation consists of three sequential steps: constant addition $p_C$, nonlinear substitution $p_S$, and linear diffusion $p_L$, as expressed in Equation (4):

$$S\leftarrow p_L\circ p_S\circ p_C\left(S\right)$$

(4)

where $p_C$ denotes the round constant addition, which XORs a specific 64-bit round constant with S₂. Since the first 56 bits of this constant are zero, the operation effectively applies only to the lower 8 bits of S₂. $p_S$ denotes the nonlinear substitution layer, which applies a 5-bit S-box 64 times in parallel using a bit-slicing approach. $p_L$ denotes the linear diffusion layer, which is responsible for bit diffusion within each 64-bit word.

2.2.2. Ascon-Hash256 Algorithm

Ascon-Hash256 [12,13] is a lightweight cryptographic hash function officially standardized by NIST in 2025. It employs Ascon-p¹² as its core permutation, accepts variable-length messages as input, and produces a 256-bit digest. Its rate (r) and capacity (c) are 64 bits and 256 bits, respectively. The algorithm adopts the sponge construction. During the initialization phase, the 320-bit internal state S is initialized according to Equation (5):

$$S\leftarrow \mathrm{A}\mathrm{s}\mathrm{c}\mathrm{o}\mathrm{n}-\mathrm{p}\left[12\right]\left(IV\parallel 0^{256}\right)$$

(5)

where IV denotes the 64-bit initialization vector, and 0²⁵⁶ denotes a 256-bit string of all zeros. The concatenation operator || joins these two components, and the resulting string serves as the input to Ascon-p¹². In the absorption phase, the message is divided into 64-bit blocks (with any incomplete block padded accordingly). Each block is first XORed with the first 64 bits of the state, and the state is then updated through Ascon-p. This process is iterated until all blocks have been processed. In the squeezing phase, the first 64 bits of the current state are extracted as output, while the state is fed into the subsequent permutation. After four sequential squeezing operations, the obtained bit strings are concatenated to form the 256-bit digest.

2.3. Differential Neural Distinguisher with Multi-Sample-Pair Input

Differential cryptanalysis is an effective attack method against iterated block ciphers, first introduced by Biham and Shamir [14] in 1991. Its core premise is that, as plaintext differences propagate through the cipher, the corresponding ciphertext differences exhibit non-random statistical imbalances. By tracking the propagation patterns of input differences, distinguishers can be constructed to differentiate a block cipher from a random permutation. Traditional differential distinguishers rely on hand-crafted differential characteristics or mathematical structures, rendering their construction process relatively complex and difficult to generalize directly to algorithms with higher round numbers or larger state sizes.

Differential neural distinguishers represent a fusion of classical differential cryptanalysis and deep learning techniques. The input to such a distinguisher consists of ciphertext pairs, and the output is a score between 0 and 1, indicating the confidence that the sample belongs to the encryption class. A threshold of 0.5 is typically adopted, where scores above 0.5 are classified as encryption and those below as random, thereby distinguishing the encryption distribution from the uniform distribution.

Chen et al. [4] improved distinguishing accuracy by increasing the number of input ciphertext pairs, effectively elevating the distinguishing task from marginal distribution testing to joint distribution testing. When the input format is extended from a single ciphertext pair to multiple pairs for joint decision-making, the distinguishing probability is derived as follows.

Let S = {X₁, …, X_m} denote a set of m independent and identically distributed samples. The posterior probability that the i-th sample belongs to the encryption class is denoted as p_i. Let Y ∈ {1, 0} be the class variable, where Y = 1 denotes the encryption class and Y = 0 denotes the random class. For the i-th sample, the posterior odds O_i in favor of the encryption class over the random class are defined as:

$$O_i={\displaystyle \frac{Pr\left(Y_i=1|X_i\right)}{Pr\left(Y_i=0|X_i\right)}}={\displaystyle \frac{p_i}{1-p_i}}$$

(6)

This ratio reflects the relative likelihood that the sample originates from the encryption class versus the random class. When all samples are drawn from the same class distribution, the joint posterior odds O_joint in favor of all samples belonging to the encryption class equal the product of the individual odds:

$$O_{joint}={\displaystyle {\prod }_{i=1}^m}{O}_i={\displaystyle {\prod }_{i=1}^m}{\displaystyle \frac{p_i}{1-p_i}}$$

(7)

Converting the joint odds back to the joint posterior probability, i.e., the probability P_joint that all m samples originate from the encryption class, yields:

$$P_{joint}={\displaystyle \frac{O_{joint}}{1+O_{joint}}}={\displaystyle \frac{{\displaystyle {\prod }_{i=1}^m}\frac{p_i}{1-p_i}}{1+{\displaystyle {\prod }_{i=1}^m}\frac{p_i}{1-p_i}}}={\displaystyle \frac{1}{1+{\displaystyle {\prod }_{i=1}^m}\frac{1-p_i}{p_i}}}$$

(8)

Equation (8) reveals the information accumulation effect inherent in multi-ciphertext-pair decision-making. By accumulating weak deviations across multiple samples, the decision confidence can be substantially enhanced, thereby reducing, to a certain extent, both Type I and Type II errors and improving the overall distinguishing accuracy.

3. Construction of Differential Neural Distinguishers

3.1. Dataset Generation

Plaintext pairs (P₀, P₁) are processed through an r-round encryption algorithm E_r(·), producing corresponding ciphertext pairs (C₀, C₁). Each ciphertext pair is associated with a label Y: pairs generated from a fixed input difference are labeled as 1 (positive), while those generated from random plaintext pairs are labeled as 0 (negative). Traditional differential neural distinguishers rely solely on non-random features extracted from ciphertext pairs for classification. To capture all potential features, we constructed a triplet input format that includes the ciphertext difference term in addition to the original ciphertext pair. This explicitly preserves the differential features along the spatial dimension. The data generation procedure is illustrated in Algorithm 1, and the format of a single sample pair is given as (C₀, C₁, C₀ ⊕ C₁), as shown in Figure 2a. For multi-sample input, multiple triplets are concatenated along the feature dimension to form the final input tensor, the structure of which is depicted in Figure 2b, where S denotes the number of sample pairs. This approach provides high-quality training data for the neural network.

The input difference Δ was set to a Hamming weight of 1, i.e., Δ = 0 × 01. Positive and negative samples were generated separately according to Algorithm 1, with each class accounting for half of the total dataset. After generation, all samples were randomly shuffled. For all single-message-block experiments on sponge-construction hash algorithms, each message consists of a single block with no additional padding applied. Specifically, SHA-3-256 processes a single 1088-bit message block using the standard sponge construction with a rate of 1088 bits (capacity 512 bits), while Ascon-Hash256 operates on a single 64-bit message block with a rate of 64 bits (capacity of 256 bits).

Algorithm 1: Data generation for training and validation

Input: r-round algorithm Er(·), dataset size N, difference Δ Output: Training and validation dataset D 1.  D ← ∅ 2.  For i = 1 to N do 3.      P0 ← Random() 4.      Y ← Random({0, 1}) 5.      If Y == 0 then 6.          P1 ← Random() 7.      If Y == 1 then 8.          P1 ← P0 ⊕ Δ 9.      C0 ← Er(P0) 10.      C1 ← Er(P1) 11.     Append D with: 12.     (C0, C1, C0 ⊕ C1, Y) 13. Return D

3.2. Network Architecture

The attention mechanism was introduced by Bahdanau et al. [15] in 2014 and was originally applied to machine translation. This mechanism assigns differentiated weights to different features, thereby directing the model to focus on salient information. Attention has also been effective in cybersecurity tasks like DDoS detection [16]. Deng et al. [17] incorporated a multi-head self-attention mechanism [18] into the output layer of a residual network for analyzing the security of the Speck algorithm, achieving some distinguishing performance. However, when applied to sponge-based algorithms that operate via bit-level diffusion, this approach yielded limited effectiveness and incurred considerable computational cost.

The convolutional block attention module (CBAM) [19] is a lightweight attention mechanism designed to enhance the feature representation capability of a convolutional neural network (CNN). In this study, a residual network architecture augmented with CBAM—denoted as CBAM-ResNet—was adopted, the structure of which is shown in Figure 3. The network comprises four components: a preprocessing layer, a bit-slicing layer, an iterative layer, and a prediction head.

The preprocessing layer receives the triplet state as input and partitions it into words. For the Keccak and Ascon algorithms, the word length is 64 bits. The output is reshaped into a two-dimensional matrix of shape (64, Num_block), where Num_block denotes the number of input blocks. The bit-slicing layer consists of a convolutional network with a kernel size of 1, which facilitates the learning of bit-slicing operations in the target algorithm. The number of filters (Num_filters) was set to 64, expanding the channel dimension from Num_block to 64. This expansion enables the network to further capture the word-oriented feature space of the algorithm.

The iterative layer is composed of one residual block, which contains two convolutional layers, with CBAM introduced after the second convolutional layer. This module adaptively enhances feature responses along both the channel and spatial dimensions in sequence, as illustrated in Figure 4. The input to this module originates from the iterative layer, with a data format of (64, 64), where the first 64 denotes the sequence dimension and the second 64 denotes the channel dimension.

The channel attention module performs both global average pooling and global max pooling along the sequence dimension, generating two distinct spatial context descriptors. These descriptors are separately fed into a shared two-layer perceptron, which reduces and then expands the dimensionality to control the parameter count. The two output feature vectors are then combined via element-wise summation, resulting in a fused representation of shape (1, 64). A Sigmoid function is subsequently applied to constrain the channel-wise weights to the range (0, 1), and the channel attention is applied to the input data through element-wise multiplication.

The spatial attention module receives the output of the channel attention module and performs both average pooling and max pooling along the channel dimension, producing two-dimensional feature maps that are then concatenated into a tensor of shape (64, 2). A one-dimensional convolutional layer with a kernel size of 7 is applied to transform this concatenated two-channel attention feature map into a spatial weight map of shape (64, 1). A Sigmoid function is then used to constrain the positional weights to the range (0, 1), and the spatial attention is applied to the input data via element-wise multiplication to produce the final output. Residual connections are employed after each residual block and after each attention module to alleviate the vanishing gradient problem.

The prediction head comprises a flatten layer that compresses the output of the iterative layer into a one-dimensional vector, followed by two fully connected layers for dimensionality reduction. A Sigmoid activation function is finally applied to perform binary classification using the learned features.

3.3. Hyperparameter Selection

It was identified in [20] that, among all 22 hyperparameters, the L2 regularization coefficient, the learning rate, and the kernel size exert the most significant influence on model performance. In this study, the Optuna framework was employed to automatically search for the optimal values of these three hyperparameters. A cyclical learning rate scheduler was adopted, which varies the learning rate periodically between predefined lower and upper bounds and updates it after each training batch. This strategy assists the model in escaping local optima and improving convergence behavior. The principal hyperparameters of the model are listed in

Table 1. Model hyperparameters.

Hyperparameters *	Keccak-p	SHA-3-256	Ascon-p	Ascon-Hash256
Batch-size	10,000	1000	10,000	1000
Num_block	25	4	5	4
Num_filters	64	64	64	64
L2 (×10−5)	99.97	0.251	1.35	2.17
Base_lr (×10−5)	2.17	7.84	44.6	48.9
Max_lr (×10−3)	3.80	4.46	1.89	2.73
Kernel_size	1	1	5	7

* Optuna performed 100 trials per configuration. Search ranges: L2 in [10⁻⁶, 10⁻³] (log scale), base_lr in [10⁻⁵, 5 × 10⁻⁴] (log scale), max_lr in [10⁻³, 5 × 10⁻³] (log scale), kernel size in {1, 3, 5, 7}; objective: maximize validation accuracy. The large L2 for Keccak-p (99.97 × 10⁻⁵) is due to larger model capacity (Num_block = 25) and cyclic LR (max_lr = 3.80 × 10⁻³), requiring stronger regularization to prevent overfitting; confirmed as the Optuna-selected optimum.

.

The Swish activation function was adopted as a replacement for ReLU. By allowing small negative values to pass through, Swish alleviates the dying neuron problem and provides the network with richer representational capacity. The Adam algorithm was chosen as the optimizer, and binary cross-entropy was used as the loss function. The training process was conducted over 10 epochs.

Three evaluation metrics were employed to assess the training performance of the model: accuracy (Acc), true positive rate (TPR), and true negative rate (TNR). TPR denotes the proportion of actual positive samples that are correctly predicted as positive by the model, while TNR denotes the proportion of actual negative samples that are correctly predicted as negative. Accuracy serves as the baseline validation metric, representing the proportion of predictions that match the true labels.

4. Experimental Results

All experiments were conducted using the TensorFlow 2.10.0 and Keras 2.10.0 deep learning frameworks, with CUDA 11.3.1 and cuDNN 8.2.1 for model training and inference. Hyperparameter optimization was performed using Optuna v4.9.0. The experiments were performed on a computing platform equipped with an NVIDIA RTX 3090 GPU and 64 GB of RAM. Two data scales were employed in this study. For the 1-round to 3-round configurations, the training and validation sets consisted of 10⁶ and 10⁵ randomly generated sample pairs, respectively. For the 4-round configurations, enlarged datasets of 10⁷ training and 10⁶ validation sample pairs were used, as the deeper round reduction substantially diminishes the residual differential signal and requires a larger data budget to achieve comparable statistical power. The complete source code for reproducing all experiments is available as Supplementary Material accompanying this submission.

To ensure rigorous statistical interpretation of our experimental results, we define the following criterion for distinguishing effectiveness. A configuration is considered ‘effectively distinguishable’ if its validation accuracy exceeds the upper bound of the 95% binomial confidence interval around the 50% random-guessing baseline; conversely, a configuration is considered ‘not effectively distinguishable’ if its validation accuracy falls within this interval, indicating that the observed deviation from 50% can be attributed to sampling noise. For a balanced validation set of size N, the approximate 95% confidence half-width is $1.96\times \sqrt{0.5\times 0.5∕N}$, yielding ±0.098 percentage points for N = 10⁶ and ±0.031 percentage points for N = 10⁷. Thus, at N = 10⁷, validation accuracies below 50.031% are statistically indistinguishable from random guessing. We further distinguish between statistical significance and practical cryptanalytic significance: while accuracies above the confidence bound may be formally statistically significant, those below, for example, 55% are of limited practical value for cryptanalysis, as they provide insufficient advantage over random guessing to be operationally useful. This two-tiered framework is applied consistently throughout the interpretation of our experimental results. Differential neural distinguishers were constructed for the Keccak and Ascon algorithms, respectively.

4.1. Differential Neural Distinguishers for the Keccak Algorithm

Differential neural distinguishers were constructed for reduced-round Keccak-p and reduced-round SHA-3-256, respectively. Under the single-sample-pair setting, the output state size of Keccak-p is 1600 bits, resulting in a triplet state size of 4800 bits. For SHA-3-256 under the single-message-block setting, the output state size is 256 bits, resulting in a triplet state size of 768 bits. The distinguishing accuracies of the two distinguishers are presented in

Table 2. Distinguishing accuracy of the Keccak algorithm under the single-sample-pair setting.

Distinguisher	Acc/% *
	1 Round	2 Rounds	3 Rounds	4 Rounds
Keccak-p	100	100	100	50.27
SHA-3-256	100	100	88.91	50.12

* For 4-round results, the 95% confidence half-width is ±0.098 percentage points (N = 10⁶). Values within this interval are statistically indistinguishable from random guessing.

.

Under the single-sample-pair setting, the maximum distinguishable round number for both Keccak-p and SHA-3-256 is 3 rounds, with distinguishing accuracies of 100% and 88.91%, respectively. At 4 rounds, the accuracies drop to 50.27% and 50.12%, both close to the random guessing baseline of 50%. For the 3-round SHA-3-256 distinguisher, as shown in

Table 3. Distinguishing performance for 3-round SHA-3-256 under the single-sample-pair setting.

Distinguisher	Training Data Volume	Acc/%	TPR/%	TNR/%
Ref. [4] *	2 × 106	72.28	77.27	63.10
This paper	106	88.91	99.59	81.56

* The model used in Ref. [4] is a plain residual network. The proposed model was trained on 10⁶ sample pairs, which is half of the 2 × 10⁶ used in Reference [4].

, for this specific configuration (3-round SHA-3-256, single-sample-pair setting), the training data volume was 10⁶, which is half of the 2 × 10⁶ used in [4]. Under this reduced data budget, our model achieved an accuracy of 88.91%, representing an improvement of 16.63 percentage points over the residual network reported in [4], with TPR and TNR improvements of 22.32 and 18.46 percentage points, respectively. It should be noted that this data-efficiency advantage applies only to this configuration; other experiments in this paper employ different data scales as explicitly stated.

As the number of sample pairs increases, the distinguishing accuracy of the 3-round SHA-3-256 distinguisher exhibits an upward trend (

Table 4. Distinguishing accuracy for 3-round SHA-3-256 under the multi-sample-pair setting.

Number of Sample Pairs	Acc/%
	Ref. [4]	Ours
1	72.28	88.91
2	81.49	96.88
4	92.40	99.76
8	97.10	99.97
16	99.04	99.99

). Under identical data scales, the proposed model consistently outperforms [4]. To achieve a distinguishing accuracy greater than 0.99, the proposed model requires only four sample pairs, which is one-quarter of the 16 pairs required by [4]. At 16 sample pairs, the accuracy reaches 99.99%, representing an improvement of 0.95 percentage points over the best result reported in [4].

For the 4-round Keccak algorithm, we additionally conducted experiments with enlarged datasets comprising 10⁷ training and 10⁶ validation samples, respectively. Under the multi-sample-pair setting, taking 32 sample pairs as an example, the distinguishing accuracies for Keccak-p and SHA-3-256 were 50.05% and 50.06%, respectively. Applying the criterion defined in Section 4, the 95% confidence half-width for the validation set of size N = 10⁶ is ±0.098 percentage points, so the 50% baseline confidence interval extends to 50.098%. Both 50.05% and 50.06% fall well within this interval, meaning they are statistically indistinguishable from random guessing. We therefore classify the 4-round Keccak configurations as not effectively distinguishable under our experimental framework. This statistical conclusion is further supported by evaluations conducted over three independent random seeds, which confirmed the stability of these near-baseline results with standard deviations below 0.02 percentage points. These findings indicate that the differential characteristics have been fully diffused by the round function after 4 rounds, approaching a level of computational indistinguishability.

4.2. Differential Neural Distinguishers for the Ascon Algorithm

Differential neural distinguishers were constructed for reduced-round Ascon-p and reduced-round Ascon-Hash256, respectively. Under the single-sample-pair setting, the output state size of Ascon-p is 320 bits, resulting in a triplet state size of 960 bits. For Ascon-Hash256 under the single-message-block setting, the output state size is 256 bits, resulting in a triplet state size of 768 bits. The distinguishing performance of the two distinguishers is presented in

Table 5. Distinguishing accuracy of the Ascon algorithm under the single-sample-pair setting.

Distinguisher	Acc/% *
	1 Round	2 Rounds	3 Rounds	4 Rounds
Ascon-p	100	100	100	50.13
Ascon-Hash256	100	100	99.84	50.01

* For 4-round results, the 95% confidence half-width is ±0.098 percentage points (N = 10⁶). Values within this interval are statistically indistinguishable from random guessing.

.

Under the single-sample-pair setting, the maximum distinguishable round number for both Ascon-p and Ascon-Hash256 is 3 rounds, with distinguishing accuracies of 100% and 99.84%, respectively. At 4 rounds, the accuracies drop to 50.13% and 50.01%, both close to the random guessing baseline of 50%.

For the 4-round Ascon algorithm, experiments were additionally conducted with enlarged training and validation sets of 10⁷ and 10⁶ randomly generated samples, respectively. This data scale was selected to compensate for the substantially weaker differential signal at 4 rounds, as accuracies near the 50% baseline require larger samples to resolve statistically meaningful deviations. Under the multi-sample-pair input strategy, the distinguishing performance of the 4-round Ascon algorithm is shown in

Table 6. Distinguishing performance of the 4-round Ascon algorithm under the multi-sample-pair setting.

Number of Sample Pairs	Acc/% *
	Ascon-p	Ascon-Hash256
1	50.13	50.01
2	50.15	50.08
4	50.23	50.16
8	51.64	50.20
16	52.21	51.51
32	53.40	52.24
64	54.85	53.06

* For 4-round results, the 95% confidence half-width is ±0.098 percentage points (N = 10⁶). Values within this interval are statistically indistinguishable from random guessing.

. As the number of sample pairs S increases, the distinguishing accuracies of both 4-round Ascon-p and 4-round Ascon-Hash256 exhibit an upward trend. When 64 sample pairs are used as input, the 4-round Ascon-p distinguisher achieves a maximum accuracy of 54.85%. Under the criterion established in Section 4, the 95% confidence half-width for the validation set of size N = 10⁶ is ±0.098 percentage points. Accordingly, single-sample-pair accuracies of 50.13% (Ascon-p) and 50.01% (Ascon-Hash256) are statistically indistinguishable from random guessing, as both lie within the 50% ± 0.098% interval. As the number of sample pairs increases, the accuracies gradually rise above this threshold, with the 64-pair Ascon-p result reaching 54.85%, which is statistically significant and represents a genuine, albeit modest, improvement in distinguishability. It should be noted, however, that from a practical cryptanalytic perspective, an accuracy of 54.85% remains far below the threshold required for a viable attack; the practical significance of this result lies primarily in demonstrating the information accumulation effect of the multi-sample-pair strategy rather than in constituting a cryptanalytic breakthrough.

A comparison of the 4-round Ascon-p distinguisher with existing results is presented in

Table 7. Comparison of neural distinguisher accuracy for 4-round Ascon-p.

Distinguisher	Model	Epochs	Number of Sample Pairs	Acc/%
Ref. [7]	RSB-ResNet	120	32	53.54
Ref. [8]	MLP	50	32	52.63
Ours	CBAM-ResNet	10	32	53.40
			64	54.85 *

* Results obtained with different numbers of sample pairs are not directly comparable; the 64-pair result is reported to demonstrate the information accumulation effect of the multi-sample-pair strategy.

. When the number of sample pairs is 32, the proposed CBAM-ResNet model achieves a distinguishing accuracy of 53.40% in only 10 epochs, whereas the RSB (Residual Shrinkage Block)-ResNet model in [7] requires 120 epochs to attain a comparable accuracy. The Multilayer Perceptron (MLP) model in [8] achieves an accuracy of 52.63% under the same conditions, and the proposed model outperforms it by 0.77 percentage points. When the number of sample pairs is increased to 64, the proposed model attains an accuracy of 54.85%, which is the highest reported accuracy for 4-round Ascon-p in the literature. It should be noted that this result is obtained with a larger number of sample pairs (64 vs. 32) than that used in [7], and therefore does not constitute a directly equivalent comparison. At the matched setting of 32 sample pairs, the proposed model achieves 53.40%, which is 0.14 percentage points lower than the 53.54% reported in [7]. The key advantage of the proposed method lies in its training efficiency: comparable accuracy is achieved with approximately one-twelfth of the training epochs (10 vs. 120).

5. Discussion

For typical sponge-based algorithms, the structural characteristics involve the repeated application of a large-state fixed permutation. Both Ascon-p and Keccak-p, as core permutations, employ bit operations based on a bit-slicing structure. In this study, the CBAM was incorporated into the differential neural distinguishers for these two core permutations to capture long-range dependencies along both the channel and spatial dimensions within the large state. As shown in Figure 5a (and detailed in Table 3 and Table 4), CBAM-ResNet and triplet input consistently outperform the plain ResNet with conventional input in Ref. [4]—by 16.63 percentage points under the single-sample-pair setting (88.91% vs. 72.28%), and by 0.95 percentage points at 16 sample pairs (99.99% vs. 99.04%). These results serve as an ablation study confirming that the triplet input preserves richer differential information, while CBAM enhances feature extraction beyond the plain residual network.

The round function in the core permutation introduces subtle statistical biases in the output distribution that are often undetectable from a single sample pair due to the limited signal-to-noise ratio. When adopting the multi-sample-pair triplet input format, the distinguishable round number for Ascon-p increased from 3 to 4, with the 4-round accuracy reaching 54.85%; to the best of our knowledge, this is the current highest reported accuracy for 4-round Ascon-p using neural distinguishers. This finding suggests that the aggregated statistical information from multiple sample pairs can amplify weak statistical signals and assist in extracting hidden features between sample pairs. However, for the 4-round Keccak-p distinguisher, even under the multi-sample-pair setting, effective distinguishability was not achieved. This indicates that while increasing the number of sample pairs can amplify weak statistical signals and improve accuracy when residual distinguishing information exists (as in the case of 4-round Ascon), it cannot recover information that has been completely diffused (as in 4-round Keccak). In other words, the multi-sample-pair strategy enhances the utilization of available information but does not create new distinguishing features beyond those already present in the data.

The sponge construction also exerts a certain influence on distinguishing performance. For the Keccak algorithm, under the single-sample-pair input setting, the 3-round Keccak-p distinguisher achieved an accuracy of 100%, which is higher than the 88.91% accuracy of the sponge-based 3-round SHA-3-256. For the Ascon algorithm, under the single-sample-pair setting, the distinguishing accuracies of Ascon-p and the sponge-based Ascon-Hash256 from 1 to 4 rounds were generally comparable. However, under the multi-sample-pair setting (Figure 5b), the 4-round Ascon-p distinguisher consistently outperformed the sponge-based 4-round Ascon-Hash256. In summary, the distinguishing accuracies of sponge-based hash algorithms were lower than those of their corresponding core permutations. The indifferentiability proof of the sponge construction [10] states that the difficulty of attacking the sponge construction is equivalent to that of attacking its underlying core permutation. To understand this empirical observation, it is essential to clarify three parameters of the sponge construction: the rate (r), which determines the number of input bits absorbed per permutation call; the capacity (c), which governs the security level; and the exposed output, which refers to the number of output bits actually returned during the squeezing phase. For the single-message-block sponge-based algorithms, SHA-3-256 has a rate of r = 1088 bits (i.e., 68% of the 1600-bit Keccak state) and a capacity of c = 512 bits; however, the truncated output during a single squeezing operation is only 256 bits, corresponding to 16% of the original permutation state. Similarly, Ascon-Hash256 has a rate of r = 64 bits (i.e., 20% of the 320-bit Ascon state) and a capacity of c = 256 bits, with a truncated output of 64 bits, also corresponding to 20% of the state. Critically, the fraction of the state exposed as output—not the rate itself—is the key factor limiting the information available to the neural distinguisher. In both cases, the truncated output exposes only a limited portion of the full permutation state, and this restricted observability reduces the statistical signal that the distinguisher can exploit. When the data volume is limited, the available empirical information is generally low, making it more difficult for the differential neural distinguisher to extract difference distribution features. A careful interpretation of this observation in light of the sponge construction’s theoretical foundations is warranted. The indifferentiability proof of the sponge construction [10] establishes a security bound: it demonstrates that any successful distinguisher against the sponge construction can be converted into a distinguisher against the underlying permutation, with the advantage bounded by the capacity. Importantly, this result does not establish a simple equivalence between attacking the full hash function and attacking the underlying permutation, nor does it imply that the two tasks are equally difficult for any particular distinguisher family. Our experimental results—obtained with a specific family of neural distinguishers under finite data budgets—do not and cannot validate the indifferentiability proof itself, as that is a mathematical result with its own established validity. Rather, our findings are consistent with expectations derived from the indifferentiability bound: if the large-state permutation becomes difficult to distinguish under the constraints of our experimental setup, then the sponge-based hash algorithm built upon it is also expected to be difficult to distinguish. The observed performance gap between the core permutation distinguishers and their sponge-based counterparts can be understood as a consequence of three interacting factors: output truncation (which reduces the available statistical signal), restricted observability (which limits the information accessible to the distinguisher), and the specific inductive biases of the neural distinguisher architecture (which determine how effectively the available signal can be exploited). This framing provides a more rigorous bridge between the theoretical security model and our empirical findings, situating the latter as an illustrative instantiation of the former’s implications in a practical neural-distinguisher setting, rather than as a confirmation of the former’s truth.

6. Conclusions

This paper focuses on typical sponge-based algorithms and proposes a framework for constructing differential neural distinguishers that integrates network architecture, data construction, and training strategies. In terms of data construction, a triplet input format was designed to explicitly preserve differential features, and a multi-sample-pair input structure was adopted to extract the joint difference distribution and complex dependencies between sample pairs. In terms of network architecture, the CBAM was introduced to efficiently capture long-range dependencies along both the channel and spatial dimensions within the large-state permutation. Experimental results on the SHA-3-256 and Ascon-Hash256 algorithms demonstrate that the proposed framework effectively improves the accuracy of differential neural distinguishers, offering a viable analytical paradigm [21] for the security evaluation of this class of algorithms, and also highlights its practical relevance to real-world lightweight cryptographic applications, such as those in VANETs [22]. Furthermore, the proposed framework achieves comparable distinguishing accuracy to prior work at matched settings while requiring significantly fewer training epochs (approximately one-twelfth), demonstrating its efficiency in practical scenarios.

The core objective of a differential neural distinguisher is to identify input sample pairs whose corresponding outputs exhibit detectable statistical biases, enabling the distinguisher to differentiate the target permutation from a random permutation. The distinguishing features applicable to typical sponge-based algorithms are not limited to difference distributions; they also include Internal Differences [23], Linear Masks [24], and the statistical properties leveraged by mainstream distinguishing methods such as Zero-Sum Distinguishers [25] (which exploit the algebraic degree of the permutation) and Cube Attacks [26] (which analyze the polynomial representation). All these features can potentially be used to construct corresponding neural distinguishers. The model employed in this study reflects, to a certain extent, the application potential of deep learning techniques in differential cryptanalysis; however, it does not represent the upper bound of deep learning model performance in this domain. With the continued emergence of more powerful architectures—such as Transformers and state-space models—further exploration of deep learning applications in cryptanalysis remains a promising direction for future work.