# Targeted Honeyword Generation with Language Models

arXiv: https://arxiv.org/abs/2208.06946 · HTML: https://mlsanity.com/paper/2208.06946/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 9 of its 32 references that are in the map.
- First posted on arXiv 15 Aug 2022.

## Builds on (most cited first, 9 of 9)

- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [Evaluating Large Language Models Trained on Code](https://mlsanity.com/paper/2107.03374/) (2021)
- [Large Language Models are Zero-Shot Reasoners](https://mlsanity.com/paper/2205.11916/) (2022)
- [Zero-Shot Text-to-Image Generation](https://mlsanity.com/paper/2102.12092/) (2021)
- [Prompt Programming for Large Language Models: Beyond the Few-Shot Paradigm](https://mlsanity.com/paper/2102.07350/) (2021)
- [Medically Aware GPT-3 as a Data Generator for Medical Dialogue Summarization](https://mlsanity.com/paper/2110.07356/) (2021)
- [Improving Password Guessing via Representation Learning](https://mlsanity.com/paper/1910.04232/) (2019)
- [GNPassGAN: Improved Generative Adversarial Networks For Trawling Offline Password Guessing](https://mlsanity.com/paper/2208.06943/) (2022)
- [Alice in Passphraseland: Assessing the Memorability of Familiar Vocabularies for System-Assigned Passphrases](https://mlsanity.com/paper/2112.03359/) (2021)

## Built on by (most cited first, 2 of 2)

- [When AI Defeats Password Deception! A Deep Learning Framework to Distinguish Passwords and Honeywords](https://mlsanity.com/paper/2407.16964/) (2024)
- [MAYA: Addressing Inconsistencies in Generative Password Guessing through a Unified Benchmark](https://mlsanity.com/paper/2504.16651/) (2025)

## Abstract (arXiv)

Honeywords are fictitious passwords inserted into databases in order to identify password breaches. The major difficulty is how to produce honeywords that are difficult to distinguish from real passwords. Although the generation of honeywords has been widely investigated in the past, the majority of existing research assumes attackers have no knowledge of the users. These honeyword generating techniques (HGTs) may utterly fail if attackers exploit users' personally identifiable information (PII) and the real passwords include users' PII. In this paper, we propose to build a more secure and trustworthy authentication system that employs off-the-shelf pre-trained language models which require no further training on real passwords to produce honeywords while retaining the PII of the associated real password, therefore significantly raising the bar for attackers. We conducted a pilot experiment in which individuals are asked to distinguish between authentic passwords and honeywords when the username is provided for GPT-3 and a tweaking technique. Results show that it is extremely difficult to distinguish the real passwords from the artifical ones for both techniques. We speculate that a larger sample size could reveal a significant difference between the two HGT techniques, favouring our proposed approach.