Large language models (LLMs) successfully model natural language from vast
amounts of text without the need for explicit supervision. In this paper, we
investigate the efficacy of LLMs in modeling passwords. We present PassGPT, a
LLM trained on password leaks for password generation. PassGPT outperforms
existing methods based on generative adversarial networks (GAN) by guessing
twice as many previously unseen passwords. Furthermore, we introduce the
concept of guided password generation, where we leverage PassGPT sampling
procedure to generate passwords matching arbitrary constraints, a feat lacking
in current GAN-based strategies. Lastly, we conduct an in-depth analysis of the
entropy and probability distribution that PassGPT defines over passwords and
discuss their use in enhancing existing password strength estimators.

本篇论文研究了大型语言模型在密码建模中的效力，介绍了一种名为 PassGPT 的大型语言模型，并在密码生成中表现出众，比起之前基于生成对抗网络的方法，猜对了两倍数量的新密码，同时，文章提出了引导密码生成的概念，利用 PassGPT 采样过程生成符合任意约束的密码。最后，文章对 PassGPT 定义密码的熵和概率分布进行了深入分析，并讨论其在增强现有密码强度评估器方面的应用。

PassGPT: 基于大语言模型的密码建模和（指导性）生成

PassGPT: Password Modeling and (Guided) Generation with Large Language  Models

With the development of deep learning processors and accelerators, deep
learning models have been widely deployed on edge devices as part of the
Internet of Things. Edge device models are generally considered as valuable
intellectual properties that are worth for careful protection. Unfortunately,
these models have a great risk of being stolen or illegally copied. The
existing model protections using encryption algorithms are suffered from high
computation overhead which is not practical due to the limited computing
capacity on edge devices. In this work, we propose a light-weight, practical,
and general Edge device model Pro tection method at neuron level, denoted as
EdgePro. Specifically, we select several neurons as authorization neurons and
set their activation values to locking values and scale the neuron outputs as
the "asswords" during training. EdgePro protects the model by ensuring it can
only work correctly when the "passwords" are met, at the cost of encrypting and
storing the information of the "passwords" instead of the whole model.
Extensive experimental results indicate that EdgePro can work well on the task
of protecting on datasets with different modes. The inference time increase of
EdgePro is only 60% of state-of-the-art methods, and the accuracy loss is less
than 1%. Additionally, EdgePro is robust against adaptive attacks including
fine-tuning and pruning, which makes it more practical in real-world
applications. EdgePro is also open sourced to facilitate future research:
this https URL

本文提出了一种基于神经元级别的轻量级、实用的边缘设备模型保护方法，即 EdgePro，该方法使用一些特定神经元作为授权神经元，并将它们的激活值设置为锁定值，并在训练过程中将神经元输出缩放为密码，从而保护模型安全，实现正确的解密需要满足密码匹配的条件。实验结果表明，EdgePro 的推理时间增加只有先进方法的 60％，而精度损失小于 1％。

通过神经元授权实现边缘深度学习模型保护

Edge Deep Learning Model Protection via Neuron Authorization

State-of-the-art password guessing tools, such as HashCat and John the
Ripper, enable users to check billions of passwords per second against password
hashes. In addition to performing straightforward dictionary attacks, these
tools can expand password dictionaries using password generation rules, such as
concatenation of words (e.g., "password123456") and leet speak (e.g.,
"password" becomes "p4s5w0rd"). Although these rules work well in practice,
expanding them to model further passwords is a laborious task that requires
specialized expertise. To address this issue, in this paper we introduce
PassGAN, a novel approach that replaces human-generated password rules with
theory-grounded machine learning algorithms. Instead of relying on manual
password analysis, PassGAN uses a Generative Adversarial Network (GAN) to
autonomously learn the distribution of real passwords from actual password
leaks, and to generate high-quality password guesses. Our experiments show that
this approach is very promising. When we evaluated PassGAN on two large
password datasets, we were able to surpass rule-based and state-of-the-art
machine learning password guessing tools. However, in contrast with the other
tools, PassGAN achieved this result without any a-priori knowledge on passwords
or common password structures. Additionally, when we combined the output of
PassGAN with the output of HashCat, we were able to match 51%-73% more
passwords than with HashCat alone. This is remarkable, because it shows that
PassGAN can autonomously extract a considerable number of password properties
that current state-of-the art rules do not encode.

本研究提出 PassGAN，一种基于理论的机器学习算法，使用生成对抗神经网络从实际数据泄露中学习密码列表的分布，并生成高质量的密码猜测，实验证明，该方法优于基于规则和最先进的机器学习密码猜测工具，而且不需要任何关于密码或常见密码结构的先验知识，可以提取许多其他工具无法编码的密码属性。