[Paper Review] Learning to Protect Communications with Adversarial Neural Cryptography

Martı́n Abadi, David G. Andersen|arXiv (Cornell University)|Oct 21, 2016

Adversarial Robustness in Machine Learning19 references119 citations

TL;DR

The paper trains neural networks (Alice, Bob, Eve) end-to-end to learn encryption and selective protection of information through adversarial objectives, without predefined cryptographic algorithms.

ABSTRACT

We ask whether neural networks can learn to use secret keys to protect information from other neural networks. Specifically, we focus on ensuring confidentiality properties in a multiagent system, and we specify those properties in terms of an adversary. Thus, a system may consist of neural networks named Alice and Bob, and we aim to limit what a third neural network named Eve learns from eavesdropping on the communication between Alice and Bob. We do not prescribe specific cryptographic algorithms to these neural networks; instead, we train end-to-end, adversarially. We demonstrate that the neural networks can learn how to perform forms of encryption and decryption, and also how to apply these operations selectively in order to meet confidentiality goals.

Motivation & Objective

• Investigate whether neural networks can learn to protect communications from an adversarial observer.
• Demonstrate end-to-end training that yields encryption and decryption learned by neural nets.
• Explore selective information protection where only certain aspects of data are safeguarded.
• Compare learned cryptosystems to traditional cryptographic guarantees in a neural setting.

Proposed method

• Propose a three-network system (Alice, Bob, Eve) with shared keys for symmetric encryption.
• Formulate objectives where Eve minimizes plaintext reconstruction while Alice/Bob maximize secure communication.
• Define L1-based reconstruction losses and a composite Alice/Bob objective that subtracts Eve’s advantage.
• Use a mix & transform neural architecture to allow learned mixing of plaintext and key, followed by convolutional layers.
• Train with SGD (Adam) in an adversarial, alternating fashion between Alice/Bob and Eve.
• Evaluate robustness by retraining Eve multiple times and assessing if Bob maintains low reconstruction error while Eve remains close to random guessing.

Experimental results

Research questions

• RQ1 Can neural networks discover encryption and decryption schemes without hand-crafted algorithms?
• RQ2 Can they learn to encrypt selectively so that an adversary cannot infer certain components while preserving utility?
• RQ3 How robust are learned cryptosystems to retraining of the adversary?
• RQ4 What are the characteristics of the encryption patterns that emerge from end-to-end adversarial training?

Key findings

• Neural networks can learn forms of encryption and decryption, and apply these operations selectively to meet confidentiality goals.
• The learned cryptosystems depend on the secret key and plaintext, and the ciphertexts exhibit diffusion across multiple output elements rather than simple XOR.
• Adversarial training can drive Bob’s reconstruction accuracy down while increasing Eve’s reconstruction error toward random guessing, though success is not guaranteed on every run.
• Training dynamics resemble evolutionary processes and can be unstable; success rates vary with hyperparameters like minibatch size.
• Selective protection experiments show that it is possible to hide certain components of data while allowing useful leakage about others, through end-to-end learning.