We looked for these biases on a reduced version of LEVIATHAN with 
.
For the PRF-PRF attack, we ran over 256 distinct keys generating 
32-bit LevPair outputs for each, and sorting them to find collisions. We count
as a collision each instance where a distinct pair of inputs result in the same
output; thus, where 
outputs have the same value, we count this as
distinct collisions. For a random function we would expect to
find approximately3
collisions in total across all keys,
while the PRF-PRF attack would predict an expected
.
The experiment found 2350336 collisions; this is 
standard deviations
(SDs) from the expected value in the random function model, and 
SDs from the expected value in the model provided by the PRF-PRF attack. This
shows that this model identifies a substantial bias in the cipher, but there
is a further bias in the collision probability of roughly 0.38% yet to be accounted
for.
For the S-box matching attack, we generated 
LevPair outputs
for each of 256 keys, counting outputs with the 
property.
A random function would generate an expected
such outputs,
while the S-box matching attack predicts that LevPair will generate an expected
such outputs. The experiment found 
such
outputs; this is 
SDs from the expected value in the random function
model, and 
SDs from the expected value in the model provided by
the S-box matching attack. Again, this shows that while a substantial source
of bias has been identified, there is still a bias of 3.66% yet to be accounted
for. Scott Fluhrer has reported finding this attack effective in experiments
against the full LEVIATHAN with 
.
for the number of collisions in a random function 
is very
precise where
is large; where we refer to the predictions
of the random function model, it is the model with this approximation.