Nonlinear invariant attack
A generalisation of the invariant subspace attack in which the preserved pattern is a nonlinear Boolean function rather than a subspace.
Todo, Leander and Sasaki showed in 2016 that it suffices to find a function g such that g(x) ⊕ g(F(x)) is constant for the round function F. Then g of the plaintext predicts g of the ciphertext for every matching key, however many rounds there are. Unlike linear cryptanalysis, there is nothing probabilistic about it: the relation holds with certainty or not at all.
The attack broke SCREAM, iSCREAM and Midori64 for weak-key classes, and in some modes of operation known ciphertexts alone were enough to leak information about the plaintext. As with the subspace attack, the culprit was a thin key schedule and overly simple round constants — lightweight ciphers that had saved one gate too many.