Technical Summary: Benchmarking Large Language Models for Cryptanalysis and Side-Channel Vulnerabilities

Problem Statement

While Large Language Models (LLMs) have demonstrated significant advancements in natural language understanding and generation, their capabilities and vulnerabilities in the domain of cryptanalysis remain underexplored. Cryptanalysis involves analyzing encrypted information (ciphertext) to recover the original message (plaintext) without direct knowledge of the encryption process. The authors identify a critical gap: LLMs may struggle to generalize across different text encodings, creating opportunities for "mismatched generalization attacks."

Attackers could potentially exploit these generalization failures by translating harmful instructions into ciphers (e.g., Caesar, Morse, or Bacon codes) or using alternative languages and formats (such as ASCII art or bijection encoding) to bypass safety protocols. This "jailbreaking" technique relies on the model's inability to recognize that an obfuscated input contains a harmful intent, or its failure to correctly decrypt the message while still "comprehending" its structure. Furthermore, a representational mismatch exists between encryption schemes (often operating at the character or block level) and LLM training (primarily on word or sub-word tokens), which may limit their effectiveness in cryptographic tasks.

Methodology

To address this gap, the authors introduced a comprehensive benchmark dataset and evaluation framework designed to assess the cryptanalytic potential of state-of-the-art LLMs.

Dataset Construction

The authors curated a novel dataset comprising 4,509 entries. The dataset features:

• Diverse Plaintexts: Content spans multiple domains (Scientific, Medical, News, Legal, Business, Literature, Quotes, Social Media), writing styles (including Shakespearean and dialect texts), and lengths (Short: ≤100 characters; Long: ~300 characters).
• Encryption Algorithms: Each plaintext was encrypted using nine distinct algorithms, categorized by difficulty:
  • Easy: Caesar, Atbash, Morse Code, Bacon.
  • Medium: Rail Fence, Playfair, Vigenère.
  • Hard: RSA, AES.
• Implementation: The dataset includes both human-generated and LLM-generated content to ensure balanced representation.

Experimental Setup

The study evaluated seven state-of-the-art LLMs (including Claude 3.5 Sonnet, GPT-4o, GPT-4o-mini, GPT-o4-mini, Mistral, Mistral Large, and Gemini 1.5 Pro) under two primary settings:

1. Zero-Shot: Models were tasked with decrypting ciphertexts without prior examples.
2. Few-Shot: Models were provided with nine examples (one for each encryption method) to guide the decryption process.
3. Chain-of-Thought (CoT): Prompts included instructions for the model to explain its reasoning process.

The evaluation focused on three objectives:

1. Decryption Accuracy: Reconstructing the exact plaintext.
2. Comprehension: Assessing the model's ability to identify hidden messages or partial structures even if exact decryption fails.
3. Algorithm Identification: Determining if the model could correctly identify the encryption method used.

Evaluation Metrics

Performance was measured using:

• Exact Match (EM): Strict character-level accuracy.
• BLEU Score: N-gram overlap based metric.
• Normalized Levenshtein Similarity (NL): Semantic similarity metric.
• Precision, Recall, and F1: Used for the classification of encryption algorithms.

Key Results

Decryption Performance

• Difficulty Gradient: All models exhibited significant challenges with Medium and Hard encryption methods (e.g., AES, RSA, Vigenère), often achieving near-zero Exact Match scores.
• Easy Ciphers: Performance varied significantly on "Easy" ciphers.
  • Claude 3.5 Sonnet demonstrated superior performance, achieving high EM scores on Caesar (0.98) and Morse (0.96).
  • GPT-4o showed strong performance on Caesar (0.66) but struggled with Atbash and Bacon.
  • Mistral and Gemini showed minimal success, often failing to comprehend even simpler algorithms like Morse Code or Caesar.
• Token Inflation: The study found a strong correlation between token inflation (the increase in token count after encryption) and decryption failure. For instance, the Bacon cipher caused a 7.93x token inflation, leading to poor performance across all models, whereas Morse Code, despite high inflation (6.9x), was better understood due to frequent exposure in pre-training data.

Comprehension vs. Decryption

A critical finding was the divergence between comprehension and exact decryption.

• Models like GPT-4o-mini often achieved high NL and BLEU scores (indicating semantic understanding of the structure) but low EM scores (failing to replicate the exact sequence).
• This "partial comprehension" suggests that while models may not fully decrypt a message, they can recognize patterns and structures, potentially exposing them to side-channel attacks where the model's internal reasoning is exploited even if the output is not perfectly accurate.

Few-Shot Learning

• Few-shot learning significantly improved performance on simpler ciphers (e.g., Caesar), with GPT-4o's EM score jumping from 0.66 to 0.90.
• However, this improvement did not translate to complex ciphers (AES, RSA), where models maintained near-zero performance regardless of the number of examples provided.
• Reasoning models (e.g., GPT-o4-mini) showed better generalization to new bijections (like Atbash) compared to their non-reasoning counterparts, though they still lagged behind Claude 3.5.

Domain and Style Sensitivity

• Performance varied across domains, with models generally performing better on familiar content (Quotes, Literature) and struggling with specialized domains (Medical, Technical).
• Unfamiliar writing styles (e.g., Shakespearean prose) caused a drop in Exact Match scores, indicating that models rely heavily on familiar language patterns for successful decryption.

Key Contributions

1. Benchmark Dataset: The introduction of a diverse, multi-domain benchmark dataset pairing plaintexts with nine different encryption algorithms, specifically designed to test LLM cryptanalysis capabilities.
2. Comprehensive Evaluation: A systematic zero-shot and few-shot evaluation of state-of-the-art LLMs, highlighting the disparity between decryption accuracy and semantic comprehension.
3. Safety Implications: An analysis of how partial comprehension and token inflation create vulnerabilities. The authors argue that high NL/BLEU scores in the absence of high EM scores indicate a susceptibility to "long-tail" jailbreak attacks, where models understand the intent of obfuscated harmful prompts without fully decrypting them.

Significance and Claims

The paper posits that the ability of LLMs to partially comprehend encrypted texts represents a dual-use risk. While high decryption capabilities are desirable for benign tasks, they also indicate a model's vulnerability to adversarial inputs designed to bypass safety filters through obfuscation.

The authors claim that current safety measures may be insufficient against generalization-based attacks. They suggest that:

• Partial Comprehension is a Vulnerability: Models that can "understand" the structure of a cipher but fail to decrypt it exactly may still be susceptible to jailbreaking if the obfuscated input triggers a harmful response.
• Token Inflation Matters: Security mechanisms must account for token inflation, as high inflation can disrupt model performance, but specific patterns (like Morse code) may still be learned if present in pre-training data.
• Need for Targeted Safeguards: LLM safeguards should explicitly handle partial comprehension of long-tail texts and obfuscated inputs. The authors propose that future safety alignment should aim for high decryption scores on benign texts while maintaining low scores on harmful, obfuscated prompts.

The study concludes that while LLMs are not yet capable of breaking modern cryptographic standards (AES, RSA), their ability to decode classical ciphers and partially interpret obfuscated text highlights a critical area for AI safety research, particularly in preventing the exploitation of generalization failures for malicious purposes.