The Learning With Errors (LWE) problem is one of the major hard problems in post-quantum cryptography. For example, 1) the only Key Exchange Mechanism KEM standardized by NIST [14] is based on LWE; and 2) current publicly available Homomorphic Encryption (HE) libraries are based on LWE. NIST KEM schemes use random secrets, but homomorphic encryption schemes use binary or ternary secrets, for efficiency reasons. In particular, sparse binary secrets have been proposed, but not standardized [2], for HE. Prior work SALSA [49] demonstrated a new machine learning attack on sparse binary secrets for the LWE problem in small dimensions (up to n = 128) and low Hamming weights (up to h = 4). However, this attack assumed access to millions of LWE samples, and was not scaled to higher Hamming weights or dimensions. Our attack, PICANTE, reduces the number of samples required to just m = 4n samples. Moreover, it can recover secrets with much larger dimensions (up to 350) and Hamming weights (roughly n/10, or h = 33 for n = 300). To achieve this, we introduce a preprocessing step which allows us to generate the training data from a linear number of samples and changes the distribution of the training data to improve transformer training. We also improve the distinguisher/secret recovery methods of SALSA and introduce a novel cross-attention recovery mechanism which allows us to read-off the secret directly from the trained models.

翻译：带错误学习（LWE）问题是后量子密码学中的主要困难问题之一。例如：1）NIST标准化的唯一密钥封装机制KEM [14]基于LWE；2）当前公开可用的同态加密（HE）库均基于LWE。NIST KEM方案使用随机秘密，但同态加密方案为提高效率而采用二值或三值秘密。特别地，稀疏二值秘密已被提出用于HE，但尚未标准化[2]。先前工作SALSA [49]展示了针对小维度（n ≤ 128）和低汉明重量（h ≤ 4）LWE问题中稀疏二值秘密的新型机器学习攻击。然而，该攻击需访问数百万个LWE样本，且无法扩展至更高汉明重量或维度。我们的攻击PICANTE将所需样本数降至仅m = 4n个样本，并能恢复具有更大维度（最高350）和汉明重量（约n/10，即n=300时h=33）的秘密。为实现这一目标，我们引入了预处理步骤，可从线性数量样本生成训练数据，并改变训练数据分布以改进Transformer训练。我们还改进了SALSA的区分器/秘密恢复方法，并提出了新型交叉注意力恢复机制，可直接从训练模型中读取秘密。