Assuming you’re referring to the birthday bound on blocks (https://sweet32.info https://sweet32.info) that’s a limit on blocks encrypted with a single key. XAES

Assuming you’re referring to the birthday bound on blocks (https://sweet32.info https://sweet32.info) that’s a limit on blocks encrypted with a single key. XAES derives large keys per message, so it achieves what are commonly referred to as “better-than-birthday” bounds.