Source-linked AI summary
Learning to Protect Communications with Adversarial Neural Cryptography
Martín Abadi, David G. Andersen
TL;DR
The paper asks whether neural networks can use secret keys to protect information from neural-network adversaries. It trains Alice, Bob, and Eve end-to-end against secrecy objectives rather than prescribing algorithms, and demonstrates learned encryption, decryption, and selective protection. The resulting systems are automatically generated but provide weaker transparency and assurance than classical cryptography and ZooCrypt.
Problem
The paper addresses how to train neural networks to integrate cryptographic protection and limit what an adversarial neural network learns from communications.
Method
The paper trains communicating neural networks end-to-end and adversarially, using secret keys and secrecy specifications instead of prescribed cryptographic algorithms.
Results
Neural networks learn forms of encryption and decryption and can apply them selectively to meet confidentiality goals.
Takeaways & Limitations
Confidentiality protections can be learned automatically from adversary-based objectives, including settings where only selected information should be hidden.
Takeaways & Limitations
The neural methods provide weaker transparency, assurance, and guarantees than classical cryptography and tools such as ZooCrypt because their adversary model avoids quantification.
Abstract
from arXiv · showhide
We ask whether neural networks can learn to use secret keys to protect information from other neural networks. Specifically, we focus on ensuring confidentiality properties in a multiagent system, and we specify those properties in terms of an adversary. Thus, a system may consist of neural networks named Alice and Bob, and we aim to limit what a third neural network named Eve learns from eavesdropping on the communication between Alice and Bob. We do not prescribe specific cryptographic algorithms to these neural networks; instead, we train end-to-end, adversarially. We demonstrate that the neural networks can learn how to perform forms of encryption and decryption, and also how to apply these operations selectively in order to meet confidentiality goals.
1 INTRODUCTION
The paper explores end-to-end neural systems that protect communications by training against neural adversaries, without prescribing cryptographic algorithms. It also extends protection to selectively hiding information while preserving utility, while acknowledging weaker guarantees than classical cryptography.
- 1 INTRODUCTION: The system uses adversarial goals and training to specify confidentiality properties in terms of what an attacker should not learn.This contrasts with prior work focused mainly on generating or attacking cryptographic keys.
- 1 INTRODUCTION: Neural networks can learn encryption and decryption forms that protect data from other neural networks without being taught specific algorithms.The approach advances end-to-end objectives beyond simple functional specifications.
- 1 INTRODUCTION: Neural networks can learn what to encrypt, selectively hiding plaintext fragments or functions while maximizing utility.Selective protection addresses secrecy requirements beyond merely knowing how to encrypt.
- 1 INTRODUCTION: The resulting cryptosystems are generated automatically rather than hand-crafted, contrasting with symbolic theorem-proving tools such as ZooCrypt.ZooCrypt provides a comparison point because it also concerns automatic cryptosystem synthesis but uses symbolic theorem-proving.
- 1 INTRODUCTION: Compared with classical cryptography and ZooCrypt, the methods offer less transparency, assurance, and security guarantee because the adversary model avoids quantification.The authors describe this as a weaker but simpler model that may sometimes be appropriate.
2 LEARNING SYMMETRIC ENCRYPTION
This section defines a neural Alice–Bob–Eve system trained end-to-end to communicate accurately while limiting Eve’s reconstruction of plaintexts. Experiments show that successful runs can discover non-XOR encryption, though training is unstable and guarantees are weaker than classical cryptography.
- System organization: Alice and Bob share a fresh secret key for each plaintext, while Eve intercepts their ciphertext without access to the key.Alice produces ciphertext C from plaintext P and key K; Bob and Eve attempt to reconstruct P as P_Bob and P_Eve.
- Objectives: The training objective jointly rewards low Bob reconstruction error and high error for the optimal Eve over a plaintext-and-key distribution.Alice and Bob are trained together rather than to implement a prespecified cryptosystem, while Eve minimizes its own reconstruction loss.
- Evaluation: Successful post-training evaluation requires Bob’s error to be at most 0.05 bits while retrained Eves gain only a limited advantage over random guessing.Eve is reset and retrained five times; substantial retrained-Eve advantage indicates a non-robust solution.
- Results: By about 15,000 steps in one N = 16 run, Bob communicates effectively and Eve’s reconstruction error reaches the target region.The graph uses means over 4096 examples; later training increases Eve’s error only slightly.
- Results: 14 of 20 initial N = 16 runs succeeded, while six failed; retrained Eve errors in the successful set ranged from 4.67 to 6.97 bits, with mean 6.1.A failure either left Bob above the 0.05 threshold or Eve below 7.3 bits out of 16.
- Learned scheme: A successful learned encryption scheme depends on both key and plaintext and diffuses single-bit changes across multiple ciphertext elements rather than simply XORing.A key-bit flip typically changes three to six of 16 ciphertext elements substantially, with smaller changes elsewhere.
3 LEARNING WHAT TO PROTECT
The paper studies selective protection: producing a useful estimate of D while preventing an adversary from learning C. Alice and Bob are trained end-to-end with a shared key, while Eve attempts to recover C from the public estimate and ciphertext.
- 3.1 THE PROBLEM: Selective protection asks whether neural networks can learn what information to protect under confidentiality objectives defined by an adversary.The goal is broader than encrypting an entire plaintext: some correlated values may be published while others remain hidden.
- 3.1 THE PROBLEM: The experiment uses correlated tuples ⟨A, B, C, D⟩ to produce both an accurate D prediction and a D-public estimate that reveals no information about C.D-public is defined as the best possible estimate of D that does not reveal C.
- 3.2 APPROACH: Alice outputs D-public and a ciphertext; Bob uses both with a shared key to improve D, while Eve tries to recover C.This organization tests whether encrypted information can augment a privacy-preserving public estimate.
- 3.2 APPROACH: The augmented architecture combines eight key bits and four values through a 12-input, 12-output fully connected layer before the Section 2.4 network.The design is intended to predict D while also producing a prediction decorrelated with C.
- 3.2 APPROACH: Eve minimizes squared error for C, while Alice and Bob jointly balance D-prediction errors against the covariance between Eve’s estimate and C.The Alice/Bob loss is computed batch-wise using a linear combination of the three terms.
- 3.2 APPROACH: End-to-end adversarial training avoids separately designing prediction and encryption modules, instead learning selective hiding from a high-level confidentiality specification.The approach is evaluated with Blind Eve, whose error supplies a baseline for information recoverable from C’s distribution alone.
- 3.3 RESULTS: As training proceeds, Eve’s advantage over Blind Eve falls from 0.1–0.2 to zero while the public estimate remains only slightly worse than Bob’s.At zero relative advantage, Eve cannot reconstruct more information about C than is possible from the distribution of C alone.
4 CONCLUSION
The paper demonstrates that neural networks can learn to protect communications using adversarial training, and identifies further cryptographic tasks for future work.
- Neural networks can learn to protect communications without prescribing particular cryptographic algorithms or application procedures.
- The training models attackers as neural networks, while alternative adversary models may be enabled by reinforcement learning.
- Future work may extend neural cryptography beyond encryption to steganography, pseudorandom-number generation, and integrity checks.
- Neural networks may also support attacks such as metadata interpretation and traffic analysis, although cryptanalysis may remain difficult.
A LEARNING ASYMMETRIC ENCRYPTION
This section examines asymmetric, or public-key, encryption using definitions and experiments paralleling the symmetric-encryption treatment.
- Asymmetric encryption is also known as public-key encryption and is examined in parallel with the paper’s symmetric-encryption approach.
A.1 DEFINITIONS
In the asymmetric formulation, public keys are derived from secret keys, and a neural public-key generator makes the public key available to every node while Bob retains the secret key.
- Each principal has a secret key, from which a public key is derived; messages encrypted with the public key require the secret key for decryption.
- A neural public-key generator receives the secret key and outputs a public key available to every node, while only Bob accesses the underlying secret key.
- The public-key generator’s parameters are trained jointly with Alice’s and Bob’s parameters through the loss functions.
A.2 EXPERIMENTS
Asymmetric-encryption experiments reused the symmetric setup but produced fragile results: one run resisted repeated Eve retraining, while most runs did not achieve robust secrecy and the likely explanation remained uncertain.
- A.2 EXPERIMENTS: The asymmetric experiments reused the symmetric-encryption network structure and training approach.
- A.2 EXPERIMENTS: Most training runs failed to achieve a robust outcome, and retraining Eve often enabled decryption nearly as well as Bob.
- A.2 EXPERIMENTS: One training run remained resistant after five Eve reset/retrain cycles, with Eve unable to decrypt Alice and Bob’s messages.
- A.2 EXPERIMENTS: Figure 6 compares Bob’s and Eve’s reconstruction errors under the asymmetric formulation.
- A.2 EXPERIMENTS: The network structure was insufficient for general mathematical components such as integer modular arithmetic, and the successful run was fragile.
- A.2 EXPERIMENTS: Future work may strengthen asymmetric results through new network designs, training procedures, or learned lattice-based ciphers.
B BACKGROUND ON NEURAL NETWORKS
Neural networks specify parameterized functions by composing modular building blocks into an architecture that determines their wiring and parameters. Common layers include fully connected transformations and convolutional operations, which trade expressive connectivity for parameter efficiency and repeated local processing.
- Neural networks are parameterized functions built from sequences of somewhat modular building blocks.
- A fully connected layer transforms input x using matrix multiplication and vector addition, Ax + b, followed by a nonlinear function.
- Fully connected layers are powerful but require substantial memory for large networks.
- Convolutional layers slide a parameterized window across inputs, using far fewer parameters than equivalent fully connected layers.
- Convolutional layers apply the same function at every point in an input.
- An architecture specifies layer types, parameterization such as input and output counts, and how layers are wired in a graph.