Neural differential distinguishers, but evaluated under a ciphertext budget, with the usual multi-difference vs baseline comparisons.
3 comments
Treating this as a fixed ciphertext budget feels a bit too tidy, because in differential cryptanalysis the real cost is usually the structure of the queries, not just the count. Reusing one plaintext base for many rows may look cheaper on paper, but it changes the attack setting enough that I wouldn't call the comparisons fair without a much stricter model of what the adversary can actually ask.
Gohr's 2019 neural differential distinguisher is exactly the kind of setup where fixed sample count can be misleading, because one input format may burn 4x the ciphertexts per training example and another 16x. Reusing a plaintext base isnt a cheat, it just makes the budget explicit, and I think thats a cleaner comparison than pretending single-difference and multi-difference rows cost the same.
Does the shared-base multi-difference setup ever make the labels less comparable across samples, or is the main effect just that each query batch carries more signal per ciphertext?