Evaluating PQC KEMs, Combiners, and Cascade Encryption via Adaptive IND-CPA Testing Using Deep Learning

Simon Calderon; Niklas Johansson; Onur Günlü

cs.CRApr 8, 2026

Evaluating PQC KEMs, Combiners, and Cascade Encryption via Adaptive IND-CPA Testing Using Deep Learning

Authors: Simon Calderon, Niklas Johansson, Onur Günlü

Organizations: Department of Electrical Engineering, Linköping University, Sweden · Sectra Communications, Sweden · Lehrstuhl für Nachrichtentechnik, Technische Universität Dortmund, Germany

Abstract

Ensuring ciphertext indistinguishability is fundamental to cryptographic security, but empirically validating this property in real implementations and hybrid settings presents practical challenges. The transition to post-quantum cryptography (PQC), with its hybrid constructions combining classical and quantum-resistant primitives, makes empirical validation approaches increasingly valuable. By modeling IND-CPA games as binary classification tasks and training on labeled ciphertext data with BCE loss, we study deep neural network (DNN) distinguishers for ciphertext indistinguishability. We apply this methodology to PQC KEMs. We specifically test the public-key encryption (PKE) schemes used to construct examples such as ML-KEM, BIKE, and HQC. Moreover, a novel extension of this DNN modeling for empirical distinguishability testing of hybrid KEMs is presented. We implement and test this on combinations of PQC KEMs with plain RSA, RSA-OAEP, and plaintext. Finally, methodological generality is illustrated by applying the DNN IND-CPA classification framework to cascade symmetric encryption, where we test combinations of AES-CTR, AES-CBC, AES-ECB, ChaCha20, and DES-ECB. In our experiments on PQC algorithms, KEM combiners, and cascade encryption, no algorithm or combination of algorithms demonstrates a significant advantage (two-sided binomial test, significance level $α= 0.01$ ), consistent with theoretical guarantees that hybrids including at least one IND-CPA-secure component preserve indistinguishability, and with the absence of exploitable patterns under the considered DNN adversary model. These illustrate the potential of using deep learning as an adaptive, practical, and versatile empirical estimator for indistinguishability in more general IND-CPA settings, allowing data-driven validation of implementations and compositions and complementing the analytical security analysis.

Figures & tables

	AES-CBC	AES-CTR	AES-ECB	ChaCha20	DES
AES-CBC		X	X	X	X
AES-CTR	X		X		X
AES-ECB	X	X		X
ChaCha20	X	X	X		X
DES	X	X		X

Table 1: The selection of combinations for DNN classification of cascade combiner ciphers. The rows correspond to the inner cipher, the columns to the outer cipher. X denotes that the combination is tested.

	Small Network	Big Network
Number of intermediate layers	2	4
Nodes in intermediate layers	100	600

Table 2: Overview of the two different DNN setups used for each scenario.

Cryptographic	Small Network		Big Network
algorithm	Accuracy	p-value	Accuracy	p-value
Plain RSA ∗	100%	$2^{-199,999}$	100%	$2^{-199,999}$
RSA-OAEP	50.02%	0.86	49.90%	0.37
ML-KEM	50.10%	0.38	50.04%	0.72
BIKE	49.94%	0.57	50.05%	0.65
HQC	50.26%	0.02	50.06%	0.61

Table 3: Accuracies and p-values for the application of Algorithm 1 to single (i.e., non-hybridized) algorithms.

Figure 1: The validation accuracies plotted over training epochs for the KEMs encryption scenario. The validation accuracy is computed on the validation dataset.

KEM	Asymmetric	Small Network		Big Network
	cipher	Accuracy	p-value	Accuracy	p-value
ML-KEM	RSA OAEP	49.93%	0.51	50.22%	0.54
ML-KEM	Plain RSA	50.00%	0.97	49.87%	0.25
ML-KEM	Plaintext	50.00%	1.00	49.73%	0.01
HQC	RSA OAEP	50.16%	0.16	50.15%	0.17
HQC	Plain RSA	49.88%	0.28	50.21%	0.06

Table 4: Accuracies and p-values for the application of Algorithm 2 to KEMs combined with asymmetric ciphers using combiners of the form

k=F(k_{1},c)\oplus F(k_{2},c)

Figure 2: The validation accuracies computed on the validation dataset vs. training epochs for hybridized KEMs.

	AES-CBC	AES-CTR	AES-ECB	ChaCha20	DES
AES-CBC		50.02%	50.10%	50.19%	50.01%
		(0.82)	(0.37)	(0.10)	(0.92)
AES-CTR	49.97%		49.90%		50.08%
	(0.80)		(0.35)		(0.48)
AES-ECB	49.85%	50.21%		49.88%
	(0.18)	(0.06)		(0.30)

Table 5: The test validation accuracies and p-values, within the small network setup, for tests on cascade symmetric encryption. The rows correspond to the inner cipher, the columns to the outer cipher.

	AES-CBC	AES-CTR	AES-ECB	ChaCha20	DES
AES-CBC		50.00%	50.16%	49.85%	50.27%
		(0.97)	(0.14)	(0.17)	(0.02)
AES-CTR	50.05%		50.11%		50.02%
	(0.68)		(0.32)		(0.86)
AES-ECB	49.98%	50.14%		49.74%
	(0.88)	(0.20)		(0.02)

Table 6: The test validation accuracies and p-values, within the big network setup, for tests on cascade symmetric encryption. The rows correspond to the inner cipher, the columns to the outer cipher.

Figure 3: The validation accuracies plotted over training epochs for the cascade encryption scenario. The validation accuracy is computed on the validation dataset.

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 354 papers

Jul 15, 2026

Towards quantum machine learning for assessing the resilience of post-quantum cryptography

The potential capabilities of quantum computers motivated the development of cryptographic protocols suitable for securing communication against adversaries with access to large fault-tolerant quantum computers. However, even though current quantum computers are limited in terms of size and precision, they can still be useful for finding loopholes and weaknesses in the post-quantum cryptographic protocols. In this work, we present an attempt to utilize the capabilities of Quantum Generative Adversarial Networks (QGANs), one of the promising architectures used in quantum machine learning, for this purpose. We describe an example application of QGAN architecture for the purpose of loading the probability distribution of the hash-based digital signatures into the memory of a quantum computer. Our results confirm that near-term hybrid quantum-classical methods possess capabilities required for this purpose. The presented approach can be used as a first step in the workflow, enabling the utilization of quantum computing for attacking post-quantum cryptographic primitives.

Jarosław A. Miszczak

Institute of Theoretical and Applied Informatics, Polish Academy of Sciences, Baltycka 5, 44-100 Gliwice, Poland

Post-Quantum Cryptography

Ask PDF

May 23, 2026

AI-Driven Adaptive Adversaries and the Erosion of Cryptographic Trust in Public Key Systems

This paper examines the erosion of Public Key Cryptography (PKC) security under adaptive adversarial optimisation driven by artificial intelligence. The problem addressed is the growing mismatch between algorithm-centric cryptographic security models and operational attack realities, where adversaries exploit implementation-level observability rather than breaking cryptographic primitives.

Petar Radanliev

Department of Computer Sciences, University of Oxford, Wolfson Building, Parks Rd, Oxford OX1 3QG · The Alan Turing Institute, British Library, 96 Euston Rd., London NW1 2DB

Adversarial Attacks Cybersecurity

Ask PDF

Sep 24, 2026

Encryptability As a Coordinate Choice: Depth-One Homomorphic Federated Learning of Quantum Neural Networks

Encrypted training relies on keeping server-side updates low-degree. This constraint traditionally excludes models whose weights inhabit a compact Lie group (notably variational quantum circuits, where every trainable weight is an

\mathrm{SU(2)}

rotation). Expressed in Euler angles or discrete alphabets, these updates appear transcendental, historically demanding prohibitive costs: one client--server round per gate, or upwards of

25{,}000

operations per weight. This penalty is strictly an artefact of coordinates. In the unit-quaternion (spin) chart, group composition is exactly bilinear (degree two, with coefficients in

\{-1,0,+1\}

). Consequently, encrypted rotation updates cost one multiplicative level and federated averaging costs zero in any levelled homomorphic scheme, completely eliminating bootstrapping. This implementation-independent algebraic property is confirmed across two cryptographic backends, introducing only

0.0

and

-2.0\times10^{-12}

rad of aggregation error. Leveraging this reduction yields a non-interactive protocol for encrypted federated training of hybrid quantum--classical networks. It includes correctness proofs for aggregation and sign handling, plus a compilation lemma proving parameterised entanglers add only constant-factor overhead without altering the depth class. Empirically, a paired five-seed study confirms zero measurable utility tax (

Δ=+9\times10^{-6}

MSE,

p=0.92

), and a noise-budget ablation falsifies the hypothesis that encryption noise regularises. These convergence trends replicate across datasets and scale to

20

clients. Finally, hardware validation on a

156

-qubit processor achieves

0.9918

fidelity against a

0.99957

unencrypted control.

Marcel Mordarski, Nathan Mani, Arshad Patel +2

Department of Computing, Imperial College London London SW7 2AZ, United Kingdom

Quantum Federated Learning Privacy-Preserving ML Federated Learning Homomorphic Encryption Quantum Neural Networks Hybrid Quantum-Classical ML

Ask PDF

Abstract

Cybersecurity

Explore similar work

Towards quantum machine learning for assessing the resilience of post-quantum cryptography

AI-Driven Adaptive Adversaries and the Erosion of Cryptographic Trust in Public Key Systems

Encryptability As a Coordinate Choice: Depth-One Homomorphic Federated Learning of Quantum Neural Networks