The attack targets the Black-Gray-Flip decoder, known as BGF, which the latest BIKE specification recommends for its combination of a fixed number of iterations and favorable decoding-failure behavior. During each iteration, the decoder computes counters that tally unsatisfied parity-check equations for every bit position and compares those counters against a threshold to decide whether candidate bits should be flipped. Because this counter-computation function, often implemented as a routine called ctr, is invoked repeatedly within a single decoding execution, multiple secret-dependent decision points scatter their leakage across the entire measured waveform rather than confining it to convenient, fixed locations. The position and duration of each informative region shift with the evolving decoding state, which makes the resulting traces notoriously difficult to analyze with conventional techniques.

Previous demonstrations that BIKE implementations are vulnerable to side-channel attacks have relied on assumptions that break down in this setting. Earlier work by Cheriere and colleagues combined power consumption analysis with information-set decoding to recover secrets from a software implementation, while Beckwith and colleagues extracted full keys from a hardware implementation using only several dozen traces. A timing attack by Guo and colleagues also exploited input-dependent execution behavior. However, the leakage source exploited by Cheriere and colleagues no longer exists in the latest reference code, where the corresponding polynomial multiplication has been replaced with a constant-time routine. Moreover, all prior attacks depended on informative segments appearing at stable temporal locations that the attacker could identify and segment reliably, an assumption that fails when traces are captured in a fixed window containing timing jitter, silent intervals, and data-dependent duration variation.

The core insight of the new work is that recovering secrets from such long, temporally unstable traces should not be treated as a conventional fixed-window classification problem at all. Instead, the researchers reformulate the task as an alignment-free sequence-to-sequence translation: mapping a long physical waveform directly to a short target bit sequence, with the correspondence between waveform patterns and labels learned implicitly from data rather than imposed through manual segmentation. The specific target is a 16-bit sequence recording the first sixteen counter-comparison branch outcomes during BGF decoding. Each of these bits is a secret-indexed sample of the syndrome vector, because the index into the syndrome is determined by the compact representation of the private-key polynomial h0.

To instantiate this formulation, the team assembled a convolutional recurrent neural network trained with Connectionist Temporal Classification, or CTC, a technique borrowed from speech recognition where input and output lengths are inherently mismatched. The pipeline begins with lightweight preprocessing, applying band-pass filtering, Z-score normalization, and downsampling to the raw power traces. A multi-layer one-dimensional convolutional neural network then extracts local power-consumption signatures and compresses the trace along the temporal dimension. The resulting feature sequence feeds into a deep bidirectional long short-term memory network, stacked in two layers, which models long-range dependencies across the trace. The BiLSTM architecture is essential because informative leakage events are separated by long stretches of silent, key-independent activity, and its gated memory cells allow gradient information to flow across hundreds of time steps during training.

CTC solves the alignment problem that defeats rigid segmentation. The researchers measured that waveform segments associated with a branch-taken outcome occupy roughly 670 sample points, while skipped branches occupy only about 200, meaning that equal trace length does not imply semantic alignment. CTC introduces a blank symbol that absorbs silent intervals and surplus frames, and it marginalizes over all possible alignment paths during training, requiring no frame-level labels or manually annotated points of interest. At inference time, greedy decoding merges repeated labels and strips blank tokens to produce the final 16-bit estimate directly from the complete trace. An ablation study confirmed the importance of every component: removing the BiLSTM collapsed perfect sequence recovery from 95.68 percent to zero, removing the convolutional front-end dropped it to 84.49 percent, and an experiment retaining the identical CNN-BiLSTM encoder but replacing CTC with frame-wise cross-entropy achieved only 15.27 percent perfect recovery, an 80-percentage-point drop that isolates the alignment mechanism itself as the decisive factor.

The experimental campaign was conducted on an ARM Cortex-M4 development board running an unprotected reference implementation of BIKE in a profiled, same-platform setting. Using a Keysight oscilloscope, the team collected 21,200 power traces, each 8,333 sample points long and paired with a known 16-bit ground-truth sequence. Of these, 19,000 traces trained the model, 1,000 served as a validation set, and 1,200 formed an independent test set used solely for final evaluation. Training used PyTorch on an NVIDIA RTX 4090 GPU with the Adam optimizer, a batch size of 128, and thirty epochs. Against rigid-segmentation baselines, the contrast was stark: a CNN-plus-template-matching pipeline achieved only 0.32 percent perfect recovery, and a CRNN constrained to fixed partitions reached 5.60 percent, underscoring that a strong backbone cannot compensate for unreliable temporal boundaries.

The authors are careful to delimit what the attack achieves. The recovered 16-bit sequence is a private-key-dependent intermediate, not the complete BIKE private key. Full key recovery would require accumulating such observations over multiple chosen-ciphertext executions, for example by sending ciphertexts that force the syndrome vector into cyclic rotations of the private-key polynomial, and then applying information-set decoding or combinatorial post-processing of the kind used in earlier BIKE attacks. The study demonstrates and validates this core leakage-extraction step but leaves the complete reconstruction pipeline as future work. The results also apply specifically to a profiled, unprotected, same-platform evaluation; the researchers note that robustness across different devices, acquisition sessions, implementations, keys, and countermeasures such as masking or instruction shuffling remains untested.

Nevertheless, the implications for the post-quantum transition are significant. BIKE is a round-4 candidate in the NIST standardization process, and its latest specification adopted the BGF decoder precisely because it simplifies constant-time implementation. This study shows that even the current reference code, with its most recent countermeasures, remains practically exploitable by a neural attack that needs no manual points of interest and tolerates wildly irregular leakage timing. The alignment-free sequence-to-sequence formulation may also transfer to other code-based schemes and to FPGA or ASIC implementations, where leakage structure differs from software. As quantum-resistant algorithms move from laboratories into real-world infrastructure, the work sends a clear warning to implementers: algorithmic security guarantees mean little unless physical leakage is assessed and mitigated with equal rigor, and the tools that attackers bring to that assessment are growing steadily more powerful.

Subject of Research: A deep learning based side-channel attack recovering private-key-dependent sequences from the BIKE post-quantum key encapsulation mechanism

Article Title: A deep learning based side-channel attack on BIKE

Article References: Chen, G., Li, Y., Sun, S., Wang, Z., Ge, C., Wu, F., & Xu, Q. (2026). A deep learning based side-channel attack on BIKE. Cybersecurity, 9(1), Article 215. https://doi.org/10.1186/s42400-026-00653-9

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00653-9

Keywords: post-quantum cryptography, BIKE, side-channel attack, deep learning, CRNN, connectionist temporal classification, power analysis, ARM Cortex-M4, BGF decoder, key encapsulation mechanism, sequence-to-sequence, cybersecurity