SAT and Neural Network Filters for Misinjections in Fault Attacks

What it is

A September-to-October 2026 ePrint preprint (2026/2537, received 19 October 2026) by Hanbeom Shin, Dongwoo Kang, Donggeun Kwon, Seokhie Hong and HeeSeok Kim. It gives three key-independent filters that remove misinjections before an elimination fault attack uses the data. A misinjection is an injection that misses the fault form the attack assumes, and it can make the attack discard the correct key.

How it works

• SAT filter: it models differential propagation from the injected round to the end of the cipher. It rejects an injection when the model has no solution for the assumed fault and the observed ciphertext difference. It works on one injection at a time and needs no secret key.
• Neural network filter: a network trained for the same accept/reject decision. An injection passes when its score is at least 0.5.
• Combined filter: an injection passes only if the network passes it and the SAT model of that injection also has a solution.

Preconditions / Affected

Misinjections arise when the attacker has not determined the device's timing. A random-delay countermeasure wider than the S-box layer can force them even on an attacker who has. The filters were measured on clock-glitch faults into GIFT-64, GIFT-128 and BAKSHEESH on a microcontroller. Three settings were tested: a non-profiling attacker without random delay, a non-profiling attacker with it, and a profiling attacker with it.

Results

• The SAT filter rejected none of the 14669 intended faults.
• For the non-profiling attacker without random delay, it rejected at least 0.940 of misinjections at the full-diffusion round, with at least 385 misinjections in each case.
• For the same attacker, ToFA success on BAKSHEESH (which recovers the master key) rose from 5.2% to 61.2% with the SAT filter and to 96.2% with the combined filter, each over 2000 trials.

Caveats

The abstract gives headline numbers only for the non-profiling attacker without random delay. It does not report rejection rates or ToFA success for the two random-delay settings, or results for GIFT-64 and GIFT-128 key recovery. Those are in the full paper, which the page text here does not include.