Daily Arxiv

This page organizes papers related to artificial intelligence published around the world.
This page is summarized using Google Gemini and is operated on a non-profit basis.
The copyright of the paper belongs to the author and the relevant institution. When sharing, simply cite the source.

When Intelligence Fails: An Empirical Study on Why LLMs Struggle with Password Cracking

Created by
  • Haebom

Author

Mohammad Abdul Rehman, Syed Imad Ali Shah, Abbas Anwar, Noor Islam

Outline

To explore the applicability of large-scale language models (LLMs) to cybersecurity, we evaluated the password guessing performance based on synthetic user profiles using open-source LLMs, including TinyLLaMA, Falcon-RW-1B, and Flan-T5. We measured the Hit@1, Hit@5, and Hit@10 metrics against plaintext and SHA-256 hashes. All models achieved less than 1.5% accuracy on Hit@10, significantly underperforming existing rule-based and combination-based cracking methods. We analyzed the key limitations of LLMs when applied to the specific domain task of password guessing and derived Takeaways.

Takeaways, Limitations

Despite their language proficiency, LLMs lack the domain adaptation and memory skills required for specific domains, such as password guessing.
Without supervised learning-based fine-tuning, LLM struggles to perform effective password inference.
The LLM demonstrates limitations in adversarial contexts and provides a foundation for future research on security, privacy, and strong password modeling.
👍