# Universal Neural-Cracking-Machines: Self-Configurable Password Models from Auxiliary Data

arXiv: https://arxiv.org/abs/2301.07628 · HTML: https://mlsanity.com/paper/2301.07628/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 81 references that are in the map.
- First posted on arXiv 18 Jan 2023.

## Builds on (most cited first, 21 of 21)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Language Models are Few-Shot Learners](https://mlsanity.com/paper/2005.14165/) (2020)
- [An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale](https://mlsanity.com/paper/2010.11929/) (2020)
- [Neural Machine Translation by Jointly Learning to Align and Translate](https://mlsanity.com/paper/1409.0473/) (2014)
- [On the Opportunities and Risks of Foundation Models](https://mlsanity.com/paper/2108.07258/) (2021)
- [Sequence to Sequence Learning with Neural Networks](https://mlsanity.com/paper/1409.3215/) (2014)
- [Deep Learning with Differential Privacy](https://mlsanity.com/paper/1607.00133/) (2016)
- [Meta-Learning in Neural Networks: A Survey](https://mlsanity.com/paper/2004.05439/) (2020)
- [The Composition Theorem for Differential Privacy](https://mlsanity.com/paper/1311.0776/) (2013)
- [Debugging Differential Privacy: A Case Study for Privacy Auditing](https://mlsanity.com/paper/2202.12219/) (2022)
- [PassGAN: A Deep Learning Approach for Password Guessing](https://mlsanity.com/paper/1709.00440/) (2017)
- [Improving Password Guessing via Representation Learning](https://mlsanity.com/paper/1910.04232/) (2019)
- [Reducing Bias in Modeling Real-world Password Strength via Deep Learning and Dynamic Dictionaries](https://mlsanity.com/paper/2010.12269/) (2020)
- [On the Economics of Offline Password Cracking](https://mlsanity.com/paper/2006.05023/) (2020)
- [Interpretable Probabilistic Password Strength Meters via Deep Learning](https://mlsanity.com/paper/2004.07179/) (2020)
- [Might I Get Pwned: A Second Generation Compromised Credential Checking Service](https://mlsanity.com/paper/2109.14490/) (2021)
- [When Privacy meets Security: Leveraging personal information for password cracking](https://mlsanity.com/paper/1304.6584/) (2013)
- [Exploring the Impact of Password Dataset Distribution on Guessing](https://mlsanity.com/paper/1809.07221/) (2018)
- [DAHash: Distribution Aware Tuning of Password Hashing Costs](https://mlsanity.com/paper/2101.10374/) (2021)

## Built on by (most cited first, 2 of 2)

- [When Intelligence Fails: An Empirical Study on Why LLMs Struggle with Password Cracking](https://mlsanity.com/paper/2510.17884/) (2025)
- [Red-Teaming the Agentic Red-Team](https://mlsanity.com/paper/2606.24496/) (2026)

## Abstract (arXiv)

We introduce the concept of "universal password model" -- a password model that, once pre-trained, can automatically adapt its guessing strategy based on the target system. To achieve this, the model does not need to access any plaintext passwords from the target credentials. Instead, it exploits users' auxiliary information, such as email addresses, as a proxy signal to predict the underlying password distribution. Specifically, the model uses deep learning to capture the correlation between the auxiliary data of a group of users (e.g., users of a web application) and their passwords. It then exploits those patterns to create a tailored password model for the target system at inference time. No further training steps, targeted data collection, or prior knowledge of the community's password distribution is required. Besides improving over current password strength estimation techniques and attacks, the model enables any end-user (e.g., system administrators) to autonomously generate tailored password models for their systems without the often unworkable requirements of collecting suitable training data and fitting the underlying machine learning model. Ultimately, our framework enables the democratization of well-calibrated password models to the community, addressing a major challenge in the deployment of password security solutions at scale.