Amit Singh Bhati, Sundas Tariq, and Tomer Ashur of 3MI Labs published an algebraic attack on round-reduced Poseidon on IACR ePrint (2026/1692).1
Target
The paper studies Poseidon over the KoalaBear field with state width 24 and S-box degree 3. This is the instance the Ethereum Foundation’s Poseidon Cryptanalysis Initiative designated for LeanVM. The standard configuration has 4 full rounds, 23 partial rounds, and 4 more full rounds, 31 in total.12
Technique
The attack restricts inputs to subspaces on which selected S-boxes become inactive. This lets the attacker skip S-boxes in the first full round and in several partial rounds, producing a distinguisher that holds with probability one. The distinguisher is then combined with interpolation, resultant, and Gröbner basis methods to solve the CICO problem, the constrained-input, constrained-output problem used to measure the security of algebraic hashes.1
Results
On a variant with one initial full round instead of four, the authors solve CICO-1 for 28 of 31 rounds and CICO-2 for 25 of 31 rounds in practical time. On the standard configuration, the attacks reach 20 rounds for CICO-1 and 15 for CICO-2. On a smaller 3/10/3 instance, estimated costs fall from 2^560 to 2^121 for F4 and from 2^404 to 2^71 for FGLM. Full-round Poseidon is not broken.1