{"id":"ff03d796-743b-4507-adf6-3f9db748526e","arxiv_id":"2501.15076","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"The authors apply mutual information neural estimation and a binary classifier to empirically test encryption schemes, finding deterministic ciphers and faulty modes are distinguishable.","lead":"This paper tests two machine learning methods for checking whether encryption leaks information: a neural network estimates mutual information between plaintexts and ciphertexts, and a classifier tries to tell apart ciphertexts made from all-zero messages versus random messages. A generalist might read it as a proposal to use cheap ML audits to spot weak or misconfigured encryption.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"MI estimates contradict a basic information-theoretic sanity check: for fixed-key deterministic ciphers, I(X;Y)=H(X), yet Table II reports values two orders of magnitude smaller, so the MI-leakage claims are unsupported.","rationale":"We agree with the reader's weakest assumption. The MI numbers are the first pillar of the paper's central claim, and they fail an elementary check: with a fixed key, deterministic ciphers have I(X;Y)=H(X), not the small values reported. The constant-XOR baseline is itself a deterministic bijection, so its true MI is also H(X); reporting 5.16 nats shows the estimator is not producing meaningful leakage values. The authors' own statement that the larger network computes larger MI (Section IV-B) is direct evidence that model capacity drives the estimates. The BCE classification part is internally consistent and its successes on deterministic schemes are expected from theory, but it does not support the MI-based 'empirical bound' claim. Therefore the central claim is not adequately supported, and the reader's REJECT verdict should stand unchanged.","tokens_in":16977,"tokens_out":6201,"duration_ms":58869,"concrete_test":"Reproduce the MI estimation for DES, AES-ECB, plain RSA, and the constant-XOR baseline using the exact setup of Section III-A (fixed key, uniform plaintexts, same plaintext length). Compute the true mutual information analytically: for each deterministic bijective encryption, I(X;Y)=H(X), which the paper's no-encryption baseline puts at 11.1 nats (equivalently, H(X) for the actual plaintext distribution). Then train MINE with increasing network sizes (100, 600, and larger). If the estimates do not approach H(X) as capacity grows, Tables I and II reflect optimization/estimation artifacts rather than cryptosystem leakage, and the MI-based claims fail.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The MI-leakage component of the central claim fails a basic information-theoretic sanity check. Under the paper's own setup (Section III-A), a single fixed key is reused for all encryptions. For any deterministic, invertible encryption scheme (DES, AES-ECB, plain RSA, constant-XOR), the ciphertext is a bijective function of the plaintext, so I(X;Y)=H(X). The paper states H(X)=11.1 nats for its no-encryption baseline (Section IV-A). Yet Table II reports test MI values of 0.733 nats (DES), 0.0621 nats (AES-ECB), and 0.7285 nats (plain RSA), and even the constant-XOR baseline is reported as 5.16 nats rather than 11.1 nats (Table I). These discrepancies are 1-2 orders of magnitude, so the reported values cannot be interpreted as leakage. Section IV-B's admission that the larger network 'is able to calculate a larger MI leakage' confirms the numbers track model capacity, not cryptosystem behavior. The foundational claim of an MI-based empirical bound is therefore unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes two machine-learning tools for empirical cryptosystem auditing in a known/chosen-plaintext setting: MINE-based estimation of mutual information between plaintext and ciphertext, and a binary cross-entropy classifier intended to model an IND-CPA indistinguishability game. Experiments are run on baselines (no encryption, one-time pad, constant-XOR), DES, AES-ECB/CTR, plain/padded RSA, faulty variants (counter reset, padding reuse), and the HUNCC network-coding cryptosystem. The authors claim that the classifier correctly flags non-IND-CPA schemes and that smaller networks can identify vulnerabilities with less computing power, providing an empirical security bound.","tokens_in":17261,"tokens_out":8747,"duration_ms":84349,"significance":"A reliable ML-based empirical audit would be valuable, and the classification experiment is a plausible sanity check: it uses held-out test sets, reports near-chance accuracy for CPA-secure modes, and reports high accuracy for deterministic modes and for schemes with faulty parameters. However, the MI-leakage half of the paper is not supportable: the reported estimates contradict elementary information-theoretic facts under the paper's own experimental setup, and the paper itself attributes differences in estimates to network capacity. Because the MI-based 'empirical bound' is a central claimed contribution, this is a load-bearing flaw. The BCE classifier results, while internally plausible, are not sufficient to rescue the paper's overall claims as stated.","major_comments":[{"comment":"Under the setup of Section III-A, the same key is reused for all encryptions. For any tested scheme in which the ciphertext uniquely determines the plaintext (DES, AES-ECB, plain RSA, and even constant-XOR), the true mutual information satisfies I(X;Y)=H(X); the paper itself gives H(X)=11.1 nats for its no-encryption baseline. Table I reports only 5.16 nats for constant-XOR, and Table II reports 0.733, 0.0621, and 0.7285 nats for DES, AES-ECB, and plain RSA. These values are one to two orders of magnitude below the true value, so the estimates cannot be interpreted as leakage measures. The no-encryption baseline estimate of 9.17 nats also shows that the estimator is not calibrated. This invalidates the MI-based empirical-bound claims in the abstract and Section IV-B.","section":"Section III-A, Section IV-A, Tables I and II"},{"comment":"The paper explains that the larger network 'is able to calculate a larger MI leakage,' with AES-ECB moving from 0.0621 to 0.7068 nats. Mutual information leakage of a cryptosystem is a fixed quantity; if the estimate moves by more than a factor of ten with network size, the reported metric is a property of the model and training procedure, not of the cryptosystem. This is direct evidence that the MI results track model capacity, and it further undermines any interpretation of the numbers as security bounds.","section":"Section IV-B"},{"comment":"The one-time-pad baseline contradicts the stated fixed-key protocol. With a single reused key, 'one-time pad' is identical to constant-XOR and would give I(X;Y)=H(X)=11.1 nats and 100% classification accuracy; the reported values of 0.0092 nats and 50.36% are only possible with a fresh key per message. The paper needs to state the key schedule explicitly, because the baseline comparison is otherwise incoherent.","section":"Section III-A and Table I"},{"comment":"The BCE classifier is not an implementation of the IND-CPA game. It is a supervised classifier trained on a fixed labeled dataset and does not perform the adaptive challenge phase of Definition II-A2. Therefore, high accuracy on deterministic schemes is a valid demonstration that those schemes admit a distinguisher for the two chosen plaintext distributions, but a near-50% result for AES-CTR or padded RSA does not 'confirm' IND-CPA security (Section V): it only shows that this classifier fails on this pair of distributions. The paper should soften these security claims.","section":"Section III-D and Section V"}],"minor_comments":[{"comment":"The heading 'CRYTPO-MINE' contains a typo; it should read 'CRYPTO-MINE.'","section":"Section III-B heading"},{"comment":"The BCE definition swaps the roles of the true and predicted distributions: the standard loss is BCE(p, q) = -[p log q + (1-p) log(1-q)] with p the true label and q the predicted probability, whereas the paper writes BCE(ˆp, p) = -[ˆp log p + (1-ˆp) log(1-p)]. This makes Algorithm 2's notation confusing and should be corrected.","section":"Section II-B2"},{"comment":"The epoch axes in Figures 2-4 are garbled in the arXiv rendering (for example, '120140160180110011201140116011801'), making it impossible to read the training curves. The figures should be regenerated with legible tick labels.","section":"Figures 2-4"},{"comment":"The sentence 'only classifying 204 out of the 20,000 ciphers' is clearer as an accuracy value (approximately 98.98%), consistent with the percentages reported in Table III.","section":"Section IV-C"}],"recommendation":"reject","confidential_remarks":"The BCE classifier portion has some merit as an empirical sanity check, but the MI-leakage claims are not correctable by local edits: the reported values contradict the paper's own information-theoretic setup, and the estimates are explicitly model-capacity dependent. A major re-scoping and re-validation would be needed, for example by properly calibrating MINE against known ground-truth values and removing or substantially weakening the MI-based bound claims. Given that the title and abstract center on information-theoretic metrics, I do not see a viable path to acceptance within the current manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"I read this one with the reader's report in hand, and I think the reader is right on the decisive point. The classification side of the paper is fine—it is a straightforward supervised-learning realization of the IND-CPA game. Training a discriminator on labeled ciphertexts of uniform vs. non-uniform plaintexts and getting 100% accuracy on deterministic schemes and 50% on semantically secure ones is exactly what theory predicts. The fault-injection experiments (AES-CTR counter reset, OAEP padding reuse) are a reasonable audit use case, and the HUNCC extension is a legitimate place to point the tool. None of this is novel in a deep sense, but it is clean and reproducible in spirit.\n\nThe MI component is where the paper falls apart. The authors state that a single key is reused across all encryptions (Section III-A). For any deterministic, invertible cipher—DES, AES-ECB, plain RSA, even constant-XOR—the ciphertext is a bijection of the plaintext, so the true mutual information must equal the plaintext entropy. The paper itself reports H(X) = 11.1 nats for no encryption. Yet their constant-XOR baseline is estimated at 5.16 nats, and DES/AES-ECB/RSA all come in below 1 nat. A two-orders-of-magnitude gap is not a nuisance; it invalidates the interpretation of these numbers as leakage estimates. The authors' own observation that the larger network 'is able to calculate a larger MI leakage' confirms that the estimates are tracking model capacity, not cryptosystem behavior.\n\nThe paper also omits code, training hyperparameters, and the MINE stabilization details, which makes the empirical claims hard to audit. The stress-test note is accurate: the MI-leakage claim fails a sanity check, and the paper does not address it.\n\nA decent referee would not let this pass. The classification results are worth a short paper, but the MI section needs either a fundamental rework or a serious reinterpretation—at minimum, a comparison against the known analytic MI for the baselines. As it stands, the central claim about empirical bounds from MI is unsupported.\n\nMy recommendation: reject in current form, but the classification framework has enough merit that a serious editor could send it for review with the expectation of major revision. I would not cite it. I might bring it to a reading group as a cautionary example of MINE gone wrong.","headline":"The classifier experiments are a correct but unsurprising IND-CPA realization; the MI leakage estimates are unsupported because they contradict a basic information-theoretic identity.","tokens_in":17792,"tokens_out":1938,"would_cite":false,"duration_ms":20987,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A60","68T07","94A17"],"pacs":[],"model":"deepseek-v4-flash","headline":"Neural networks using information-theoretic losses can act as a low-cost empirical auditor of encryption schemes, flagging non-IND-CPA ciphers and misconfigured CPA modes in a known-plaintext setting.","keywords":["Cryptography","Mutual information","Entropy","Classification","Plaintext attack","Neural networks","IND-CPA","Information leakage"],"falsifier":"Train the same MI estimator on a deterministic cipher with a fixed key and uniform plaintext, where the true mutual information equals the plaintext entropy (about 11.1 nats in their setup). If the estimate plateaus near the small values in Table II instead of approaching the true value, the reported leakage figures are model-capacity artifacts rather than cryptosystem properties.","tokens_in":16828,"feed_emoji":"🔐","tokens_out":9250,"duration_ms":78730,"temperature":0.7,"pith_summary":"This paper tries to establish that two machine-learning tools—mutual information neural estimation and binary cross-entropy classification—can serve as a cheap, universal empirical audit of encryption schemes in a known-plaintext setting. The authors argue that the BCE classifier effectively plays an IND-CPA game: given a ciphertext, it guesses whether the plaintext was uniform random bits or all-zero bits. In their experiments it reaches 100% accuracy on schemes known not to be IND-CPA secure (DES, AES-ECB, plain RSA), random-level accuracy on secure randomized modes, and high accuracy again when secure modes are run with faulty parameters such as a resetting AES-CTR counter. They also report that a smaller network is generally enough to flag vulnerabilities, letting an auditor decide whether to spend more resources on larger networks that might break the scheme. If true, this provides a practical first-pass sanity check for cryptosystems and their implementations.","feed_headline":"Small neural nets spot weak ciphers at near-perfect accuracy","feed_subtitle":"Known-plaintext classifier catches deterministic DES, RSA, and AES-ECB, plus faulty CPA modes, in seconds.","key_machinery":"Two load-bearing pieces carry the argument. The first is the Donsker–Varadhan representation of KL divergence, which expresses mutual information as a supremum over test functions and lets a neural network $F_\\phi$ estimate a lower bound on $I(X;Y)$ from samples; the paper adds a stabilization term to control variance. The second is a binary cross-entropy classifier with a sigmoid output that maps a ciphertext to the probability that its plaintext was uniform rather than all-zero, trained by stochastic gradient descent. Both algorithms consume the same dataset structure: 100,000 known plaintext–ciphertext pairs per scheme, encrypted with a reused key, with 20,000 held out for testing. The small network has two hidden layers of 100 nodes and the large network four hidden layers of 600 nodes, and the comparison between them supports the paper's claim that small models suffice for vulnerability screening.","core_discovery":"The paper's central claim, stated on its own terms, is that a neural-network binary classifier trained with binary cross entropy on labeled ciphertexts can act as a concrete adversary in an IND-CPA indistinguishability game. The classifier is trained on ciphertexts produced from two plaintext classes—uniform random bits and all-zero bits—and then asked to guess which class a challenge ciphertext came from. Reported test accuracies are 100% for deterministic DES, AES-ECB, and plain RSA; about 50% for non-deterministic DES, AES-CTR, and padded RSA; and up to 99.5% for deliberately faulty variants such as a reduced counter field or reused OAEP padding. The companion MI estimator, built on the regularized Donsker–Varadhan objective, reports higher leakage for deterministic than randomized modes, which the paper reads as evidence that the estimators capture real dependencies in the known-plaintext setting.","pith_inferences":["The reported MI values are best read as relative lower bounds rather than absolute leakage: for a deterministic cipher with a fixed key and uniform plaintext the true mutual information equals the plaintext entropy, far above the values in Table II, so the practical signal is the ordering across schemes.","A stronger indistinguishability test would use two random plaintext classes instead of all-zero versus uniform; the accuracy drop under that variant would show how much of the classifier's success comes from exploiting the specific all-zero distribution.","The same BCE machinery could be pointed at IND-CCA-style games or at membership-inference audits, since it only requires labeled ciphertext samples from two groups.","The 100% classification scores should be understood as indistinguishability breaks, not key recovery or plaintext recovery; the paper's 'sanity check' framing is the right scope."],"forward_implications":["An auditor can use a cheap small-network classifier as triage: only when it flags a scheme is it worth deploying larger, more expensive models that might fully break the cipher.","The same framework catches implementation faults—counter resets, padding reuse—that undermine otherwise CPA-secure ciphers, making it usable for continuous monitoring of deployed systems.","Because the algorithms need only known plaintext–ciphertext pairs and a choice of two plaintext classes, they apply to any cryptosystem without scheme-specific cryptanalysis, including network-coding-based designs.","The MI estimates provide a relative ordering of leakage across schemes and modes, so security comparisons can be made on a common empirical scale."],"supporting_citations":[{"why":"Supplies the mutual information neural estimation technique underlying the paper's MI-leakage algorithm.","marker":"[18]"},{"why":"Adds the stabilization term used in the MI loss objective of Equation (1).","marker":"[30]"},{"why":"Earlier work on MI neural estimation for cryptosystems, extended here to classification and more schemes.","marker":"[1]"},{"why":"Defines HUNCC, the network-coding cryptosystem analyzed in Section IV-D, and its security guarantees.","marker":"[35]"},{"why":"Defines individual IND-CPA and the partial-encryption security game used to test HUNCC for individual secrecy.","marker":"[38]"},{"why":"Provides the OAEP randomized padding used for the padded-RSA and reused-padding experiments.","marker":"[37]"},{"why":"Provides DES, one of the standardized deterministic ciphers the classifier is tested on.","marker":"[32]"},{"why":"Provides AES, whose ECB and CTR modes are tested, including the reduced-counter fault.","marker":"[33]"},{"why":"Provides RSA, used for plain RSA and padded/OAEP RSA experiments.","marker":"[34]"}],"fun_headline_variants":["ML classifier catches broken ciphers with tiny networks","Neural net detects weak encryption, even with faulty params","Cryptanalysis via ML metrics exposes cipher weaknesses fast","Small nets flag DES, RSA, AES-ECB as insecure in seconds","Binary net scores IND-CPA security from ciphertexts alone"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the neural estimates of mutual information and the classifier accuracies reflect properties of the cryptosystem rather than the network's capacity, initialization, or training dynamics; the paper's own observation that larger networks report larger MI values is the point where that premise is most exposed.","fun_headline_variants_meta":{"raw":{"variants":["ML classifier catches broken ciphers with tiny networks","Neural net detects weak encryption, even with faulty params","Cryptanalysis via ML metrics exposes cipher weaknesses fast","Small nets flag DES, RSA, AES-ECB as insecure in seconds","Binary net scores IND-CPA security from ciphertexts alone"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000205,"raw_usage":{"total_tokens":1443,"prompt_tokens":1045,"completion_tokens":398,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":661,"completion_tokens_details":{"reasoning_tokens":315}},"tokens_in":661,"tokens_out":398,"duration_ms":4294,"temperature":1.0,"reasoning_tokens":315,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T14:39:35.984751+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train the same MI estimator on a deterministic cipher with a fixed key and uniform plaintext, where the true mutual information equals the plaintext entropy (about 11.1 nats in their setup). If the estimate plateaus near the small values in Table II instead of approaching the true value, the reported leakage figures are model-capacity artifacts rather than cryptosystem properties.","supporting_citations":[{"cited_title":"Regularized mutual information neural estimation,","cited_arxiv_id":null,"evidence_quote":"Adds the stabilization term used in the MI loss objective of Equation (1)."},{"cited_title":"Crypto-mine: Cryptanalysis via mu- tual information neural estimation,","cited_arxiv_id":null,"evidence_quote":"Earlier work on MI neural estimation for cryptosystems, extended here to classification and more schemes."},{"cited_title":"Network coding-based post-quantum cryptography,","cited_arxiv_id":null,"evidence_quote":"Defines HUNCC, the network-coding cryptosystem analyzed in Section IV-D, and its security guarantees."},{"cited_title":"Partial encryption after encoding for security and reliability in data systems,","cited_arxiv_id":null,"evidence_quote":"Defines individual IND-CPA and the partial-encryption security game used to test HUNCC for individual secrecy."},{"cited_title":"Optimal asymmetric encryption,","cited_arxiv_id":null,"evidence_quote":"Provides the OAEP randomized padding used for the padded-RSA and reused-padding experiments."},{"cited_title":"Data encryption standard,","cited_arxiv_id":null,"evidence_quote":"Provides DES, one of the standardized deterministic ciphers the classifier is tested on."},{"cited_title":"Aes proposal: Rijndael,","cited_arxiv_id":null,"evidence_quote":"Provides AES, whose ECB and CTR modes are tested, including the reduced-counter fault."}],"review_version":1}