A AES-CBC#

AES-128 encrypts a 128-bit block under a 128-bit key. Its key schedule produces eleven round keys, including the original key^[6]. Cipher Block Chaining (CBC) applies that block permutation after XOR with the previous ciphertext:

All quantities in this equation are 128-bit vectors. Our interface accepts whole blocks and a separate 16-byte IV for each message; padding is outside its scope. The fixed or public IVs used in tests support reproducibility. Actual CBC encryption also requires the IV conditions specified by the mode, including unpredictability^[13].

Figure 1 AES-128-CBC encryption

Figure 1 separates message chaining from the block cipher. Blocks of one message have a sequential dependency during encryption. Independent messages can be processed together, so the number of messages and the number of blocks per message are distinct workload dimensions.

For a single block, let $X^{(0)}=P\oplus K^{(0)}$. The remaining computation is

SubBytes (SB) applies an 8-bit substitution independently to each byte. ShiftRows (SR) permutes positions, MixColumns (MC) is linear over $\mathbb{F}_2$ when expressed on bits, and AddRoundKey is XOR with a round key. The final round omits MixColumns. Because the same S-box acts independently at every byte, SB and SR commute. This permits a convenient ordering of their tensor operations without changing AES.

B Legal inputs and correctness#

The legal inputs are 128-bit AES blocks and whole-block CBC messages, with keys, IVs, and chaining defined by the target algorithm. A fixed message length gives a fixed input dimension; an outer interface organizes other lengths. We encode each bit as a floating-point 0 or 1. For encoding and decoding maps $\operatorname{enc}$ and $\operatorname{dec}$, the requirement is

The first equality requires correct binary outputs before byte reconstruction. For a regression-based component, prescribed rounding belongs to the deployed module; its unrounded prediction can still differ from the target integer.

C Operator models#

We distinguish three permitted operator sets.

• Affine maps and ReLU. Corner networks, binary Boolean circuits, and bitwise interpolants use these operators and fixed wiring. The bit MLP uses ReLU hidden layers and deterministic clipping expressible with the same operators.
• Elementwise multiplication added. Bipolar encoding replaces XOR by products of state values. It therefore extends the affine-ReLU model.
• Tanh and rounding added. The scalar learned model uses tanh internally and rounds before deterministic bit decoding. Rounding is part of its functional specification.

Permutations use indexing or fixed connections. Ordinary program logic composes modules and manages message chaining. The seven main configurations store constants, coefficients, and round keys as model state; Section VII separately tests fused functions whose coefficients absorb the keys. No custom native AES or S-box operator is invoked inside the cipher graph. AES key expansion runs during ordinary preprocessing, outside encryption timing. TensorCrypt’s integer and bitwise graph is a different operator model.

D Validation levels#

Learning error, inference randomness, numerical differences, and agreement across configurations require separate checks. The first concerns the fitted function; the second concerns sampling or nondeterministic execution; the third concerns finite precision and evaluation order; the fourth concerns devices, batch layouts, and compilation.

We distinguish mathematical equivalence, a finite-precision argument for specified operators, and bitwise tests of deployed configurations. Learned internal values may be approximate, but their prescribed decoded bits must be correct. Later analysis of DNC also shows why exact-real security arguments require scrutiny under floating-point execution^[8,9].

The implemented cipher evaluations cover AES-128-CBC and SM4 on the recorded platform. ChaCha20, MD5, and ECC identify construction requirements. The encoding, mixing, Chow, and obfuscation experiments in Section VII are separate from the seven-configuration performance study.

A Corner construction#

Write $\rho(t)=\max(t,0)$. For each vertex $v\in\{0,1\}^n$, define

The affine expression for the distance is valid on $[0,1]^n$. At a binary input, its argument is one minus the Hamming distance: exactly one detector has value 1, and all others have value 0. Consequently, any Boolean map $f:\{0,1\}^n\to\{0,1\}^m$ has the exact representation

The first layer’s weights and biases specify the detectors. The second layer’s weights contain the output vectors $f(v)$. For an 8-bit S-box, 256 hidden units are shared by all eight output bits. Constructing eight separate sets of input detectors would duplicate work.

Figure 2 Corner-based S-box

In Figure 2, input $\mathtt{53}$ activates one detector and returns $\mathtt{ED}$. The network specifies a continuous extension between vertices, but only its values at valid inputs are needed for cipher correctness.

AES defines this finite mapping through inversion and an affine transformation. For $a$ in $\mathbb{F}_2[t]/(t^8+t^4+t^3+t+1)$, set $b=a^{-1}$ with $0^{-1}=0$. Numbering the least significant bit as zero,

The corner construction installs the 256 results of this definition; it does not perform a field inversion at inference time. A Boolean circuit instead exploits structure and shared intermediate values in the same finite map.

B Round transformations#

For a fixed key bit $k$, XOR is already affine:

Thus a network coefficient can carry key information just as directly as a named key buffer. ShiftRows needs only fixed wiring.

For MixColumns, each output bit is the parity of a fixed set of input bits. If their integer sum is $s\in\{0,\ldots,d\}$, then

The slope alternates on successive unit intervals, giving $s\bmod2$ at every integer argument. Fixed linear maps followed by this piecewise-linear function therefore suffice. Decomposing the same map into XOR gates provides another exact implementation, with different depth, intermediate storage, and opportunities for reuse.

C Composition and finite precision#

Correctness can be checked at module boundaries. Suppose each module agrees with its discrete specification on its legal domain and preserves the encoding required by the next module. Substituting these equalities proves the complete block-cipher equality in (3). Induction over (1) then proves CBC correctness: a correct previous ciphertext yields the correct next XOR input and hence the correct next ciphertext. Exhausting the full AES domain is unnecessary for this compositional argument.

Real-arithmetic identities do not by themselves establish floating-point correctness. One sufficient condition for an integer-coefficient construction is that every operand, product, partial sum, and result be an exactly representable integer, without overflow. A binary format with precision $p$ represents every integer of magnitude at most $2^p$. If the evaluated graph stays within these conditions, induction over its operations establishes exact results. The small ranges in corner detectors and Boolean gates make this condition useful.

This is a sufficient condition for a specified evaluation, not a certification of every compiler rewrite, precision reduction, or backend. It also says nothing about arbitrary nonbinary queries. For learned models, the internal values need not be exact integers; correctness instead depends on a verified decoding margin. We therefore distinguish a mathematical construction, a finite-precision argument under stated assumptions, and tests of particular deployed executions.

D Learning the whole cipher#

Fixing $K$ leaves exactly $2^{128}$ possible AES input blocks. Equation (5) gives an exact full-cipher representation:

The storage term counts raw outputs alone, before input indexing and network connections. We train only small components whose complete input domains can be checked, and compose them with deterministic round transformations.

A Cost of table expansion#

AES-128 applies its S-box 160 times per block. A dense $8\to256\to8$ corner implementation contains 4096 weight products per byte, before counting activation, movement, or layout costs. This algebraic count is not an instruction count, but it explains why a fast native byte lookup need not remain fast when expanded into neural layers.

Reusing the model avoids repeated construction. Sharing the detector bank avoids eight copies of the same matching operation, and batching increases the work available to each kernel. Neither removes the full expansion over 256 possible inputs. A structural optimization must change that representation. At the same time, replacing matrix operations with many small gates may exchange arithmetic redundancy for tensor-launch and storage costs. The alternatives must be evaluated as executable graphs.

B Shared Boolean structure#

On binary inputs, a corner detector is a Boolean minterm:

An output bit is the OR of its selected minterms. Because distinct minterms are mutually exclusive, OR, XOR, and real addition agree on their values. Shared negations, matching prefixes, and repeated subfunctions can therefore replace parts of the expanded network without changing any valid output.

For an output function $g$, Shannon expansion gives

Identical cofactors can share a node, and irrelevant variables can be removed. Decision diagrams formalize such sharing^[18]; their size depends on variable order and representation. Sharing the original 256 detectors is a useful first step, but does not by itself synthesize a small S-box circuit.

C AES S-box circuit#

Consider actual AES inputs with the six-bit prefix $010100$. Let $u,v$ be the final two bits:

Four corner detectors followed by eight sums implement this cofactor. Simplifying the columns gives, in most-significant-bit order,

The terms $q$ and $r$ feed several output bits. For $u=v=1$, the result is $11101101$, or $\mathtt{ED}$. A single shared computation now handles all four inputs; it does not select among four separately executed circuits.

Figure 3 Shared logic in an AES cofactor

Figure 3 shows the shared terms $q,r,t$ for the fixed-prefix cofactor in (12).

For the full substitution, we use the Boyar-Peralta connection implemented by BearSSL^[4]; related low-depth circuit constructions are described in^[3]. This connection differs from the depth-16 version and contains 83 XORs, 32 ANDs, and four output inversions. The grouped equations are extracted from the implementation.

Each gate has a direct neural realization:

Following the circuit dependencies produces a network of affine maps, ReLU, and wiring. Each gate preserves binary outputs, so correctness follows by induction over the dependency graph. This network agrees with the corner construction on binary inputs; their behavior outside that domain can differ, so security properties involving those inputs require separate analysis.

The execution cost of a circuit can be decomposed as

These terms can overlap. Gate count, logic depth, live tensors, and opportunities for operator fusion jointly affect execution; performance must be measured.

Figure 4 organizes the implemented connection into an input linear map, a nonlinear core, a product layer, and an output affine map. The stage interfaces are a 22-bit shared vector $\mathbf u$, a 9-bit vector $\mathbf v$, an 18-bit product vector $\mathbf z$, and the 8-bit output $\mathbf s$. They satisfy $\mathbf u=A\mathbf x$, $\mathbf v=G(\mathbf u)$, $\mathbf z=P(\mathbf u,\mathbf v)$, and $\mathbf s=B\mathbf z\oplus\mathbf c$. The linear maps are over $\mathbb{F}_2$, with $\mathbf c$ encoding byte $\mathtt{63}$; their logical operations are realized neurally using (13). The upper branch carries 18 selected bits of $\mathbf u$ directly to the product layer, preserving shared signals across stages.

Figure 4 AES S-box structure

Figure 5 lists all 119 assignments, grouped by the four stages. Within each stage, read down each column from left to right.

Figure 5 AES S-box program

D Piecewise-linear interpolation#

A table can also be specified by its values along the integer byte axis. For $y_0,\ldots,y_{255}$, write $d_j=y_{j+1}-y_j$. Then

At an integer $a=k$, the bracket is 1 for $j<k$ and 0 otherwise. The sum telescopes to $y_k$. Choosing each output bit as a separate sequence yields eight curves with shared knot activations. Choosing $y_j=S(j)$ yields a single byte-valued curve, equivalently

At legal byte inputs, each ramp in (15) is 0 or 1. Bit-output coefficients lie in $\{-1,0,1\}$ and scalar-output coefficients in $[-255,255]$. Including the initial value, the magnitudes of all partial sums are bounded by 256 and 65280, respectively. Both are within FP32’s exact integer range, so cancellation in this implementation does not by itself introduce rounding error. Scalar outputs still require bit decoding. The unified comparison uses the bitwise interpolant to preserve the binary AES interface. Both sets of coefficients come directly from the table, without training.

E Learned small-domain models#

We train two fully connected models on all 256 S-box pairs. The bit model first maps its inputs through $2x-1$ and has shape $8\to64\to64\to8$, with ReLU hidden layers and output logits.

Its deployed output uses the deterministic clipping function

High classification accuracy or probabilities close to 0 and 1 would not suffice. We check every logit against the appropriate saturation region and verify the resulting binary values.

The scalar model has shape $1\to1024\to1$, with tanh in the hidden layer. It is trained without prescribing 256 input-indicator units. For a network $f_\theta$ on normalized coordinates, its scales are

Training uses damped Levenberg-Marquardt in FP64; deployment evaluates in FP32 and rounds:

The strict bound avoids rounding ties and is sufficient for exact bytes, which are then decoded into bits. This decoding can also use ReLU: for a rounded byte $r$, visit $w=128,64,\ldots,1$, compute $b_w=\rho(r-w+1)-\rho(r-w)$, and update $r\leftarrow r-wb_w$. Tanh and rounding are part of this deployment model, so it is not a pure ReLU construction.

After freezing a candidate, exhaustive evaluation covers the S-box’s entire input domain. This is a finite-domain validation problem, not a claim about prediction on unseen byte values. Nor does success at this scale establish a practical training method for the complete AES mapping.

F State encoding#

A binary external interface does not require every internal value to use the encoding $\{0,1\}$. With $\sigma_b=1-2b\in\{-1,1\}$,

The two AND expressions agree on bipolar inputs. The first retains ReLU; the second uses a product. XOR becomes multiplication, so this representation extends the affine-ReLU operator set. Calling it merely a smaller instance of the original DNC model would omit that change.

The coefficient $1/2$ is exactly representable in binary floating point. Its presence does not imply approximate computation: exactness depends on the values and operations together. With bipolar states, key addition is multiplication by fixed signs, CBC XOR is elementwise multiplication, and parity becomes

Rewriting MixColumns and retaining the encoding across rounds avoids repeated conversion. We distinguish an S-box-only bipolar variant from a fully bipolar state variant. Their performance difference cannot be attributed solely to changing the gates inside SubBytes.

Figure 6 Binary and bipolar gates

Function representation and state encoding are independent dimensions. Circuits, interpolation, and training specify the substitution, while binary and bipolar encodings specify how modules pass state. Table 1 identifies the seven configurations used below.

Table 1 AES configurations

Extra operators are relative to affine maps, ReLU, and fixed wiring. The state column describes round interfaces, not every hidden value. The fully bipolar configuration also rewrites MixColumns, key addition, and CBC chaining.

A Protocol#

The recorded platform is an Apple M4 with 24 GiB of unified memory, running macOS 15.6, Python 3.11.9, PyTorch 2.14.1, and PyCryptodome 4.0.1. CPU measurements use four threads and eager execution. MPS measurements compile the shared CBC block step. All seven AES representations use FP32. Device comparisons therefore also include a change in execution mode; they do not isolate the speedup due to GPU hardware.

The seven variants are the corner network, binary circuit, bitwise spline, learned bit MLP, learned scalar tanh model, bipolar S-box, and fully bipolar state. The corner variant follows the DNC construction in our framework; Figure 9 separately compares the authors’ original AES cores. The learned and multiplication-based variants have the operator differences specified above.

Three fresh processes repeat the same 20 key/input workloads. Each workload is measured at four shapes $(M,B)$: $(1,1)$, $(1,16)$, $(32,16)$, and $(256,16)$, where $M$ is the number of messages and $B$ the blocks per message. This yields 60 measurements per configuration. Models and compiled steps are reused, with round-key state updated outside timing. Construction, key expansion and updates, training, compilation, and warmup are excluded. Processes can share an on-disk compilation cache, so these runs do not measure fully cold compilation.

Core latency starts with plaintext and IV bit tensors resident on the device and ends with raw ciphertext bits, including CBC chaining. Byte-interface latency includes packing, transfers, inference, the exact-binary output check, and conversion back to bytes. MPS timing synchronizes at measurement boundaries. Calibration selects between 2 and 30 internal repeats; those repeats are averaged rather than treated as independent observations.

The two latency measures are sampled separately. An occasional byte-interface mean below a core mean is therefore not evidence of negative conversion cost, and their difference is not a precise transfer measurement. The native comparison uses PyCryptodome CBC with a new context for each message, including that context creation in the measured call.

Table 1 lists the seven configurations. Tables 2 and 3 use our corner implementation; Figure 9 reports the additional author-code comparison.

B Correctness#

Validation checks the NIST CBC known-answer example, message permutation and partitioning, continuation through successive chunks, empty inputs, and rejected invalid lengths. Separate S-box checks enumerate all 256 inputs under batches of 1, 3, 32, and 256, including reordered and repeated values and a sweep through every byte position. They exercise eager CPU and compiled MPS component execution.

Across processes, workloads, variants, execution configurations, and shapes, there are $3\times20\times7\times2\times4=3360$ complete-encryption comparisons. Raw output bits, decoded bytes, and repeated results agree in every case. All deployed decoders are deterministic. These checks support the recorded hardware, formats, layouts, and execution modes. The all-input mathematical argument remains the compositional one given above; testing does not exhaust the full AES domain or certify arbitrary future backends.

The author-code comparison separately checks $20\times9\times2\times4=1440$ complete encryptions: two original DNC implementations and our seven configurations. Raw bits, decoded bytes, and repeated results all agree. These are repeated checks of the same 20 key/input workloads, rather than that many independent keys.

C Latency#

Table 2 AES-CBC latency, 32 messages of 16 blocks (ms)

Means of 60 measurements: 20 workloads in each of three processes. CPU is eager; MPS is compiled. Native CBC takes 0.1528 ms through its byte interface. Setup, compilation, and warmup are excluded.

For $(M,B)=(32,16)$, the compiled MPS binary circuit takes 6.937 ms through the byte interface, versus 12.479 ms for the corner construction. Keeping the complete state bipolar reduces this to 4.562 ms. The ordering changes on eager CPU: the learned bit MLP takes 15.658 ms and is fastest among the neural variants at this shape, while the binary circuit takes 76.890 ms. A lower Boolean gate count therefore does not determine the fastest neural implementation.

Even the fastest neural result in Table 2 is slower than native CBC, which takes 0.1528 ms for the same workload. The experiment measures tradeoffs between representations in a neural runtime; it does not establish a replacement for optimized native AES.

To compare variants without discarding workload pairing, let $s$ index processes and $g$ index the repeated workloads:

Here $T$ is byte-interface latency. We resample process and workload indices independently and retain their crossed combinations, using 2000 bootstrap draws. At $(32,16)$ on MPS, the fully bipolar state has a median speedup of 1.48 relative to the binary circuit, with a 95% bootstrap interval of $[1.44,1.53]$; it is faster in 59 of 60 pairs.

Figure 7 AES-CBC encoding speedup

Points show median paired speedups relative to the binary circuit; horizontal bars show 95% bootstrap intervals. The workload is 32 messages of 16 blocks on compiled MPS. The dashed line marks a speedup of 1. The medians and intervals are computed from paired latency ratios, rather than ratios of the means in Table 2.

Figure 7 compares the local and full-state encoding changes. Changing only the S-box encoding gives a median ratio of 1.000, an interval of $[0.980,1.028]$, and 30 faster pairs. It does not show a stable end-to-end gain under this protocol. The full variant also changes MixColumns and conversion boundaries, so its improvement cannot be assigned to S-box encoding alone. These intervals describe resampling of the recorded processes and workloads, not variability across hardware families.

Figure 8 AES-CBC batch latency

Each message contains 16 blocks; message counts are 1, 32, and 256. The panels show eager CPU and compiled MPS execution, with shared logarithmic axes. Each point is a mean of 60 byte-interface measurements. Line styles and markers distinguish four neural variants and native AES. Table 3 gives the complete numerical data, including the single-block workloads. Native AES runs on CPU; the same CPU reference is shown in both panels.

Table 3 CBC byte-interface latency across workloads (ms)

Means of 60 measurements: the same 20 workloads repeated in three processes. CPU is eager; MPS is compiled. Bipolar state denotes the fully bipolar variant. Native AES includes context creation for each message. Setup, compilation, and warmup are excluded.

Figure 8 shows that the ranking depends on workload size. Among the four plotted neural variants on eager CPU, Corner has the lowest latency at one message, the bit MLP at 32 messages, and the fully bipolar state at 256 messages. The fully bipolar state has the lowest latency among the plotted neural variants at all three compiled-MPS batch sizes. Larger batches expose parallelism between messages, but never remove the dependency between blocks within one CBC encryption. These panels compare the recorded execution configurations; CPU and MPS also differ in compilation mode. TensorCrypt principally reports CTR results and also compares CPU timings for CBC and other modes^[2]. Its reported throughput is therefore not a prediction for the CBC workloads here.

For a direct comparison with the original code, we integrate NeuralAESBase and TTablesNeuralAES at commit b2c230fc^[7]. The source files are unchanged; a common wrapper supplies CBC chaining and the byte interface. Both use ten rounds, c_parameter=1.0, protected=False, and FP32. Our seven configurations are remeasured in the same process. Hashes confirm that keys, plaintexts, and IVs match the earlier three-process workloads. CPU remains four-thread eager execution; MPS compiles the shared block step. Models, key buffers, and compiled code are reused, with preparation excluded.

Figure 9 Performance relative to DNC

Panel (a) uses eager CPU and panel (b) compiled MPS. Both measure the complete FP32 byte interface for 32 messages of 16 blocks. Points are medians of 20 paired speedups; horizontal bars are 95% bootstrap intervals, with medians printed at the right. The panels share logarithmic axes. The dashed reference is DNC T-table at 1; values above 1 are faster and values below 1 slower.

Figure 9 comes from a separate fresh process, unlike the three-process measurements in Figures 7 and 8. Each ratio divides DNC T-table latency by the corresponding candidate latency. The interval resamples workloads 2000 times and describes within-process variation only.

On compiled MPS, the binary circuit and fully bipolar state achieve paired median speedups of 2.78 and 4.08 over the authors’ T-table version, with intervals $[2.72,2.84]$ and $[4.04,4.15]$; both are faster in all 20 pairs. On eager CPU, the binary circuit gives 0.47, with interval $[0.46,0.48]$, while the bit MLP gives 2.38, with interval $[2.15,2.49]$. Circuit substitution therefore remains dependent on execution conditions.

The fully bipolar configuration adds multiplication and must be distinguished from an affine-ReLU binary circuit. Whole-implementation differences also include MixColumns, key handling, and encoding boundaries, so the complete gain cannot be assigned to the S-box circuit alone.

D State and resources#

Table 4 Parameters and stored state

Parameters count learned weights and biases. Persistent tensor storage also includes buffers, fixed coefficients, and round keys. The archive excludes source code, the runtime, and compiled artifacts.

Table 4 distinguishes learned parameters, persistent tensor storage, and serialized state. Learned parameters are frozen for deployment. Constructed networks retain fixed coefficients, state, and keys, many stored as buffers, even when they have no learned parameters.

Fourteen additional processes record resource use for the seven variants on CPU and MPS. The reported process high-water RSS ranges from 327.8 to 393.8 MiB on CPU and from 536.7 to 575.8 MiB on MPS. These values include the interpreter, framework, and compilation/runtime resources. MPS allocator and driver readings are post-execution snapshots, not peak device-memory measurements. On unified memory, adding these readings to process RSS would also risk double counting.

E Training replication#

Table 5 Training across seeds

Bit MLP: minimum signed logit. Scalar tanh: maximum byte error after conversion to FP32. All 256 decoded outputs are correct in every run.

Both learned models are retrained sequentially with seeds 0, 1, and 2 in one fresh process, using all 256 S-box pairs and four CPU threads. Seed 0 reproduces the state tensors of the frozen checkpoints selected before unified timing. Other seeds are reported as training repetitions, not substituted into those timing results.

For the bit MLP, the reported minimum signed logit is $m=\min_{a,j}(2S(a)_j-1)z_j(a)$, with target bit $S(a)_j$ and score $z_j(a)$; $m\geq1$ suffices for (17) to decode correctly. The bit MLP uses full-batch binary cross-entropy with logits and Adam at learning rate 0.01. Its stopping condition is a minimum signed logit of at least 3, checked every 100 steps, or a limit of 5000 steps. All three runs satisfy the condition at 200 steps. At inference, (17) converts the checked margins into exact bits.

The tanh model uses damped dual Levenberg-Marquardt in FP64. Initial first-layer weights and biases are scaled by 512; all layers remain trainable. Damping starts at $10^{-4}$, is multiplied by 0.3 after an accepted step and by 10 after rejection, with at most 12 trial steps. Training stops when the maximum byte error falls below $10^{-9}$, backtracking fails, or 200 iterations are reached. The three runs use 25, 16, and 25 iterations. Conversion to FP32 precedes deployment validation.

For a fixed scalar model, numerical portability is governed by the remaining decoding margin. An output perturbation $\delta(a)$ preserves the rounded byte whenever

The frozen model’s maximum raw byte error is approximately 0.003113 on CPU and 0.005508 on MPS in the recorded checks. Its real-valued predictions differ across configurations, while every rounded output agrees. This is evidence of a margin in those executions, not a backend-independent error bound.

Training times include optimization and stopping checks, excluding process startup, initialization, and saving.

A SM4#

SM4 retains much of the construction vocabulary: an 8-bit substitution, XOR, and fixed wiring. Its state consists of four 32-bit words and evolves through 32 rounds^[10]:

where $\tau$ substitutes each of the four bytes. The encryption and key-schedule linear maps are

Rotations are permutations of bit positions. Replacing the S-box and connecting these operations therefore yields an SM4 network, with the final word reversal specified by the cipher. A dedicated substitution circuit can avoid the affine wrappers around an AES circuit^[11,12]. The artifact includes a tensor key schedule as a separate setup computation; neither the AES nor SM4 encryption timings include key expansion.

The SM4 comparison replaces an affine-AES-circuit-affine S-box with Saarinen’s dedicated SM4 circuit^[10,11,12], preserving the encryption round function, packing, linear maps, and round keys. In the recorded operation accounting, the original S-box has 113 XORs, 32 ANDs, and eight inversions; the dedicated one has 81 XORs, 14 XNORs, and 34 ANDs. Both are evaluated with bipolar arithmetic.

Each configuration uses the same 20 workloads at 1, 16, 256, and 4096 independent 16-byte blocks. The isolated S-box and complete cipher are timed separately. The existing tensor key-schedule module is checked against the ordinary reference and supplies identical round keys to both variants outside the timed encryption.

Table 6 SM4 core latency for 4096 bytes (ms)

Means of 20 workloads. The isolated layer substitutes each of 4096 bytes once; full SM4 performs 32 rounds, so the columns measure different work. CPU is eager; MPS is compiled.

Table 6 reports the 4096-byte workload. The dedicated circuit improves complete-cipher latency in all listed configurations, but isolated S-box gains depend on the execution format; the MPS FP16 layer times are nearly equal. Native SM4 through cryptography/OpenSSL averages 0.02171 ms for this workload. The separate native S-box reference is a standalone C lookup helper compiled with cc -O3, not an exported OpenSSL S-box interface.

All 256 substitutions, known-answer vectors, random complete encryptions, repeated executions, and the recorded batch partitions pass the bit and byte checks. This supports replacing a reused component with a suitable cipher-specific circuit on this platform. It does not establish that the dedicated circuit is best on every backend.

B Integer arithmetic#

ChaCha20 and MD5 add modular word arithmetic. Prime-field curves additionally need multiword operations and reduction. A single FP32 scalar cannot represent all unsigned 32-bit integers exactly. Bit vectors, or bounded limbs with explicit carry handling, avoid relying on such a scalar representation.

For least-significant-bit-first operands and $c_0=0$, a full adder is

Discarding the final carry computes addition modulo $2^w$; retaining it gives a $(w+1)$-bit sum. AND, XOR, and NOT are available from (13), and OR follows by De Morgan’s law. Ripple carry has depth $O(w)$. Parallel-prefix carry reduces depth at the cost of additional nodes and wiring; we have not compared their neural execution costs.

Multiplication follows from partial products and adders:

This notation describes significance and addition of bit vectors with enough output bits. It does not require storing a large integer sum in one floating-point value. Comparison can use subtraction borrow or a most-significant-bit prefix. Conditional choice is also a Boolean operation:

Selection acts componentwise on word or point encodings.

For $a,b<p$, compute $t=a+b$ with the extra carry bit. A modular adder then uses

Comparison, subtraction, and selection are bit-vector subcircuits. Since $t<2p$, one conditional subtraction suffices. Dropping the extra bit before comparison would be incorrect.

A simple modular multiplier maintains reduced states. Starting with $r_0=0$ and $q_0=b$, use the bits $a_j$ of $a$:

The invariant $r_j,q_j<p$ preserves the modular-adder precondition, and $r_w=ab\bmod p$. For a public exponent $e=\sum e_j2^j$, a fixed sequence of modular multiplications gives

Public exponent bits determine wiring during construction. Secret exponent inputs instead require selection between candidate results. These are finite arithmetic constructions, not proposals to train an exhaustive table over the large operand domain.

C ChaCha20#

ChaCha20 uses sixteen 32-bit words. Its quarter round combines modular addition, XOR, and rotations^[14]:

All additions are modulo $2^{32}$. Ten column/diagonal double rounds are followed by wordwise addition of the initial state, little-endian serialization, and XOR with the message to produce the stream-cipher output. The main new unit beyond AES is carry-aware word addition; rotations and Boolean operations are already available.

A complete interface must specify the key, nonce, counter, and message length, rather than treat a fixed-nonce example as a complete deployment. We give a construction route for ChaCha20, but no implementation or measurements.

D MD5#

MD5 pads its message, appends the length, and processes 512-bit blocks as sixteen little-endian words through 64 compression steps^[15]. Its four word functions are

With the function $f$ selected by the step, public constant $T_j$, rotation $s_j$, and message index $g_j$, an update is

Additions are modulo $2^{32}$, and the final working state is added to the incoming chaining value. The same gates and modular adders therefore cover compression. A complete hash also needs padding, length handling, and chaining across blocks. We do not implement it here. MD5’s collision resistance is unsuitable for modern collision-resistant applications^[17]; it serves only as an example of the required computation.

E Prime-field elliptic curves#

For a prime $p>3$, consider a nonsingular short Weierstrass curve^[16]:

Field elements use $\lceil\log_2p\rceil$ bits, with additional width retained as required by intermediate computations; an additional flag represents the point at infinity $\mathcal O$. Curve parameters are public. The intended input domain must specify valid points and scalars, and include point and subgroup validation if required by the target algorithm.

For $P=(x_1,y_1)$ and $Q=(x_2,y_2)$ with $x_1\ne x_2$, affine addition is

For doubling with $y_1\ne0$,

Thus ECC adds multiword modular addition, subtraction, multiplication, inversion, and exceptional-case selection.

For a fixed prime, inversion has the finite construction

Fixing the public exponent in (30) produces a fixed modular-arithmetic network. At zero, exponentiation still has a value, but that value is not an inverse. Flags and selection must handle the exceptional cases:

Ordinary-addition and doubling candidates can be computed and selected by valid bit conditions, using a defined dummy result for a zero denominator. Complete formulas for a chosen curve provide another route. Projective coordinates reduce intermediate inversions, but still require a specified infinity representation and final coordinate conversion.

Extended Euclid is an alternative inversion method. Starting from $(r_0,r_1)=(p,a)$ and $(t_0,t_1)=(0,1)$, it repeats

At termination with $r_0=1$, $t_0a\equiv1\pmod p$. Division, signed coefficients, and a variable iteration count require additional treatment before this loop becomes a fixed graph. A bound on unrolling and preservation of the terminal state would need proof. Fixed-exponent inversion gives the more direct existence construction here.

Finally, scan the scalar bits $k_{m-1},\ldots,k_0$ from high to low:

Selection covers both coordinates and the infinity flag; the result is $R_0=[k]P$. Correct arithmetic units, complete exceptional-case logic, and preserved encodings suffice for functional equivalence. This argument establishes neither side-channel resistance nor competitive performance. ECC, ChaCha20, and MD5 remain constructions in this paper, distinct from the implemented AES and SM4 results.

A Black-box interfaces#

Suppose the interface accepts only legal byte strings, performs encoding and deterministic decoding internally, and returns only IV and ciphertext. The required equality is

Under the same key distribution, IV rules, and query restrictions, forwarding each query to ordinary AES-CBC produces the same answer. This remains true for adaptive interaction. The claim is conditional interface equivalence, not security stronger than AES. A public generator supplies no additional target parameters through these answers. Equality is required on every legal input; timing, error details, and other state leakage are outside this argument and were not evaluated. CBC still requires its prescribed IV conditions^[13].

Allowing arbitrary floating-point vectors exposes behavior outside the binary domain. Checking shape, FP32 format, and device does not check membership in $\{0,1\}^n$. DNC treats this query surface and gives input/output protection in an exact-real model^[1]. Later work reports a floating-point bypass that recovers the first round key in 128 chosen queries and proposes clamping before rounding^[8,9]. These are literature results, not independently reproduced experiments in this study.

A tensor interface therefore needs an explicit policy for nonbinary, out-of-range, and nonfinite inputs, checked along its actual numerical path. Query protection alone does not establish key hiding when parameters become readable.

B Readable models#

Static analysis reads the graph, weights, biases, and serialized state. We examine explicit key state, fused encodings, white-box compilation, and parameter obfuscation.

The seven main configurations store eleven round keys; AES-128 round key zero is the master key. Binary values $b_{j,i}$ or bipolar values $\sigma_{j,i}$ decode as

The same 20 keys across seven configurations form 140 targets. Both state encodings are checked for each target, giving 280 successful static recoveries. Median extraction time is 0.0596 ms, with 0.3897 ms for separately measured deserialization. Recovery makes no model queries. Absorbing a key into the affine coefficients of (7) does not hide it either.

The inspected DNC code at commit b2c230fc also retains buff_round_keys; protected=True wraps the same core^[7]. Reading its complete state therefore still exposes the master key. This conclusion follows from source inspection.

To remove explicit round-key buffers, we first fuse key operations with SubBytes, MixColumns, or their fragments and add local encodings. We then add invertible 32-bit linear mixing at each column-contribution output. Neither deployment separately stores round keys, encoding seeds, or decoding matrices. A visible first-round function in the local-encoding version satisfies

Here $\beta_i$ is an unknown bijection and $c_i$ a round-key share. Constant XOR and output relabeling preserve collision classes. The public S-box produces distinct partitions for the 256 candidate key bytes, allowing bytewise matching. Corner-network coefficients reveal the finite function statically, without model execution.

The 32-bit mixing preserves the cipher through commutation of linear maps and XOR. Although it defeats the original partition template, the visible fragment remains an S-box under an unknown linear projection. For candidate key byte $t$,

For the correct key, each collision class is a coset of the linear kernel. Enumerating candidates and checking binary rank bypasses the unknown mixing matrix. Both versions yield the master key in all 20 paired workloads, with uniqueness checked for every candidate. Each version also passes 240 complete CPU/MPS encryption comparisons. Mixing increases persistent tensor storage by 86.22%; paired encryption-time ratios at $32\times16$ are 1.812 on CPU and 1.750 on MPS, without corresponding key-hiding evidence.

We next compile the full Chow construction from OpenWhiteBox at commit b7fcb3c27b63^[19,20]. The compiler $C$ reads only serialized deployment tables $W_K$, without construction keys, seeds, or encoding matrices, and requires

Corner networks represent finite functions of sizes $8\to4$, $8\to32$, and $8\to128$, preserving mixing, inverse mixing, encoded XOR, and inter-round connections. No new activation or custom cipher operator is needed. The model contains 3008 finite functions grouped into 104 modules, each function with a 256-element input domain. Encoded XOR must retain the interface

Ordinary XOR on encoded labels would be incorrect. Small integer detectors, single active terms, and binary outputs meet the composition and FP32 conditions of Section III. We use identity external input/output encodings to expose standard AES-CBC; the results do not cover deployment that relies on private external encodings.

Compilation preserves an invertible parameter structure: identifying input rows and packing output coefficients gives $D(C(W_K))=W_K$. All 20 targets yield exactly the original 770048-byte table artifact through static analysis. Original white-box analyses can then be applied; when they require local execution, the recovery workflow includes those steps.

We also transform all 104 modules through hidden-unit permutation, positive scaling, unit splitting, and output affine factorization, retaining module boundaries. For permutation matrix $P$ and positive diagonal $D$, ReLU homogeneity gives

Each detector $h_a=\rho(w_ax+b_a)$ with output row $v_a$ is split into two positively scaled units with canceling output shares. Writing $B=R^{-1}$,

Output translations are canceled by corresponding biases; general matrix changes occur only in affine layers after ReLU. Powers-of-two scales and bounded integer matrices keep the relevant legal-input accumulations below $2^{14}$ in magnitude and binary denominators at most 8, retaining exactness on the evaluated FP32 path.

The original reader fails on the changed structure. An adapted static analysis normalizes detector directions, merges duplicate units, and folds the output factors using (49). It processes constants only, without target execution, construction seeds, or the original tables. All 20 obfuscated targets yield the original Chow tables. These local transformations are therefore algebraically removable in the tested construction.

C Execution and faults#

After reconstructing the Chow tables, we run OpenWhiteBox’s existing SAS recovery program locally, supplying chosen inputs to the extracted second- and third-round functions^[20]. The master key is recovered for all 20 original and all 20 obfuscated networks.

Table 7 Model exposure experiments

Counts refer to the targets in each experiment. Local-encoding copying comes from an earlier run; the Chow rows use the 20-workload paired study. Static programs receive only the target artifact and public structure; an evaluator subsequently checks keys and fresh messages. Both versions in the obfuscation study pass 240 complete CPU/MPS encryption comparisons each. All 61,603,840 component-input checks pass, covering each component’s complete input domain.

Table 8 Cost of Chow obfuscation

Encryption uses 32 messages of 16 blocks, FP32 eager execution, and includes byte conversion, transfers, and binary checks. Each measurement uses two warmups and three timed repeats; CPU uses four threads and MPS synchronizes at timing boundaries. Static reconstruction has a paired median time ratio of 2.540 with interval $[2.461,2.614]$. Persistent tensor storage grows by 2.086, while paired encryption-time ratios are 2.053 on CPU and 1.548 on MPS. Identical reconstructed tables mean that the small difference in local recovery time does not indicate changed attack complexity. Total wall time including process startup also shows no stable increase. Reported attack runtime excludes human analysis and development.

A separate Chow compilation experiment compares the original Go white-box implementation with the network. Both yield keys in all 20 trials, with median local recovery times of 2.037 s and 2.144 s. At the same $32\times16$ workload, mean encryption times are 7.574 ms for Go and 114.138 ms for MPS, with a median paired time ratio of 13.76. Slower network inference does not stop an adversary from reconstructing tables and using the original implementation.

Functional copying does not require key recovery. All 140 main-configuration targets, and all 20 local-encoding and 20 mixing targets, correctly process fresh messages after their state is loaded in independent processes. Chow and obfuscated targets also support execution through reconstructed tables. The tested implementations therefore establish no restriction on reuse in a compatible environment.

Differential fault analysis additionally requires faults that satisfy a specified model and access to normal and faulty outputs^[21]. In an encoded network, modifying one neuron need not correspond to a single-byte fault in the logical AES state. We have not verified that mapping or performed DFA injection and recovery. DFA is included only as a conditional risk supported by prior work.