[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-119089-en":3,"doc-seo-119089-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},119089,5909877438554,"Maeve","https://ap-avatar.wpscdn.com/avatar/5600025385ad2bf12a7?_k=1778553567797529272",8,"Research & Report","Salsa Picante - A Machine Learning Attack On LWE with Binary Secrets","Learning With Errors (LWE) is a foundational hard problem for post-quantum cryptography, including NIST-standardized module-LWE based key encapsulation and many ring-LWE based homomorphic encryption libraries. Security can degrade under certain implementation choices, such as using sparse binary secrets for efficiency. Prior work “Salsa” attacks small-dimensional LWE instances with very low Hamming weight but requires millions of samples and breaks down at larger dimensions or higher weights. “Picante” strengthens this machine learning attack by recovering secrets in substantially larger dimensions and higher Hamming weights, using a novel preprocessing step to generate training data from fewer eavesdropped samples and improve transformer training, plus improved recovery and cross-attention based secret reading.","Salsa Picante: A Machine Learning A􀀁ack On LWE with Binary  \nSecrets  \nCathy Yuanchen Li∗ [cathyli@uchicago.edu](cathyli@uchicago.edu)[ ](cathyli@uchicago.edu)Meta AI Seattle, USA  \nMohamed Malhou  \n[mohamed.malhou@polytechnique.edu](mohamed.malhou@polytechnique.edu)[ ](mohamed.malhou@polytechnique.edu)Meta AI Paris, France  \nJana Sotáková∗ [ja.sotakova@gmail.com](ja.sotakova@gmail.com)[ ](ja.sotakova@gmail.com)Meta AI Seattle, USA  \nEvrard Garcelon  \n[evrard.garcelon@gmail.com](evrard.garcelon@gmail.com)[ ](evrard.garcelon@gmail.com)Meta AI Paris, France  \nEmily Wenger  \n[ewenger@uchicago.edu](ewenger@uchicago.edu)[ ](ewenger@uchicago.edu)The University of Chicago Chicago, USA  \nFrançois Charton† [fcharton@meta.com](fcharton@meta.com)[ ](fcharton@meta.com)Meta AI Paris, France  \nKristin Lauter† [klauter@meta.com](klauter@meta.com)[ ](klauter@meta.com)Meta AI Seattle, USA  \nABSTRACT  \nLearning With Errors (LWE) is a hard math problem underpinning many proposed post-quantum cryptographic (PQC) systems. The only PQC Key Exchange Mechanism (KEM) standardized by NIST [13] is based on module LWE, and current publicly available PQ Homomorphic Encryption (HE) libraries are based on ring LWE [2] . The security of LWE-based PQ cryptosystems is critical, but certain implementation choices could weaken them. One such choice is sparse binary secrets, desirable for PQ HE schemes for e􀀁ciency reasons. Prior work Salsa [51] demonstrated a machine learningbased attack on LWE with sparse binary secrets in small dimensions (􀀁 ≤ 128) and low Hamming weights (ℎ ≤ 4) . However, this attack assumes access to millions of eavesdropped LWE samples and fails at higher Hamming weights or dimensions.  \nWe present Picante, an enhanced machine learning attack on LWE with sparse binary secrets, which recovers secrets in much larger dimensions (up to 􀀁 = 350) and with larger Hamming weights (roughly 􀀁/10, and up to ℎ = 60 for 􀀁 = 350) . We achieve this dramatic improvement via a novel preprocessing step, which allows us to generate training data from a linear number of eavesdropped LWE samples (4􀀁) and changes the distribution of the data to improve transformer training. We also improve the secret recovery methods of Salsa and introduce a novel cross-attention recovery mechanism allowing us to read o􀀂 the secret directly from the trained models. While Picante does not threaten NIST’s proposed LWE  \n∗ Co-􀀃rst authors.  \n†Co-senior authors, corresponding author: [fcharton@meta.com](fcharton@meta.com)  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for pro􀀃t or commercial advantage and that copies bear this notice and the full citation on the 􀀃rst page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior speci􀀃c permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org).  \nCCS ’23, November 26–30, 2023, Copenhagen, Denmark  \n© 2023 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 979-8-4007-0050-7/23/11...$15.00  \n[https://doi.org/10.1145/3576915.3623076](https://doi.org/10.1145/3576915.3623076)  \nstandards, it demonstrates signi􀀃cant improvement over Salsa and could scale further, highlighting the need for future investigation into machine learning attacks on LWE with sparse binary secrets.  \nCCS CONCEPTS  \n• Security and privacy → Cryptanalysis and other attacks; • Computing methodologies → Machine learning.  \nKEYWORDS  \nmachine learning, post-quantum cryptography, cryptanalysis ACM Reference Format:  \nCathy Yuanchen Li, Jana Sotáková, Emily Wenger, Mohamed Malhou, Evrard Garcelon, François Charton, and Kristin Lauter. 2023. Salsa Picante: A Machine Learning ","cbCaimEBSohlJig0","https://ap.wps.com/l/cbCaimEBSohlJig0","pdf",567374,1,15,"English","en",105,"# Abstract\n# Introduction\n## Learning With Errors (LWE) overview\n## Prior work: Salsa and its limitations\n# Picante: enhanced attack and results\n## Preprocessing and transformer training\n## Improved recovery and cross-attention mechanism\n# Conclusion and implications for future research","[{\"question\":\"What problem does the paper focus on?\",\"answer\":\"The paper targets Learning With Errors (LWE), a hard mathematical problem underlying many post-quantum cryptographic designs. It studies how to recover LWE secrets under the use of sparse binary secrets.\"},{\"question\":\"How does Picante improve on the prior Salsa attack?\",\"answer\":\"Picante recovers secrets in much larger dimensions and higher Hamming weights than Salsa. It introduces a novel preprocessing step that enables efficient training-data generation and enhances transformer training, along with improved secret-recovery techniques.\"},{\"question\":\"What role does machine learning play in the attack?\",\"answer\":\"Machine learning is used to learn patterns from eavesdropped LWE samples and to recover the secret from the trained models. The paper also proposes a cross-attention recovery mechanism to read the secret directly from model outputs.\"}]","Salsa Picante - A Machine Learning Attack On LWE with Binary Secrets | PDF",1785722278,38,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"salsa-picante-a-machine-learning-attack-on-lwe-with-binary-secrets","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/salsa-picante-a-machine-learning-attack-on-lwe-with-binary-secrets/119089/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04","2026-08-03",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What problem does the paper focus on?","Question",{"text":76,"@type":77},"The paper targets Learning With Errors (LWE), a hard mathematical problem underlying many post-quantum cryptographic designs. It studies how to recover LWE secrets under the use of sparse binary secrets.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"How does Picante improve on the prior Salsa attack?",{"text":81,"@type":77},"Picante recovers secrets in much larger dimensions and higher Hamming weights than Salsa. It introduces a novel preprocessing step that enables efficient training-data generation and enhances transformer training, along with improved secret-recovery techniques.",{"name":83,"@type":74,"acceptedAnswer":84},"What role does machine learning play in the attack?",{"text":85,"@type":77},"Machine learning is used to learn patterns from eavesdropped LWE samples and to recover the secret from the trained models. The paper also proposes a cross-attention recovery mechanism to read the secret directly from model outputs.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":93},[94,98,102,106,111,116,121,124,129,132,136],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":107,"doc_module":4,"doc_module_name":46,"category_name":108,"show_sort_weight":109,"slug":110},5,"Comic",60,"comic",{"id":112,"doc_module":4,"doc_module_name":46,"category_name":113,"show_sort_weight":114,"slug":115},6,"Technology",50,"technology",{"id":117,"doc_module":4,"doc_module_name":46,"category_name":118,"show_sort_weight":119,"slug":120},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":122,"slug":123},30,"research-report",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":126,"show_sort_weight":127,"slug":128},9,"Religion & Spirituality",20,"religion-spirituality",{"id":127,"doc_module":4,"doc_module_name":46,"category_name":130,"show_sort_weight":127,"slug":131},"World Cup","world-cup",{"id":133,"doc_module":4,"doc_module_name":46,"category_name":134,"show_sort_weight":133,"slug":135},10,"Lifestyle","lifestyle",{"id":137,"doc_module":4,"doc_module_name":46,"category_name":138,"show_sort_weight":107,"slug":139},19,"General","general"]