发表机构
Lehigh University; Singapore University of Technology & Design（理海大学; 新加坡科技设计大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
PassGPT+通过字符感知分词将GPT-2语言先验用于密码建模，在RockYou基准上以10^8次猜测恢复22.53%保留密码，相对PassGPT提升16%，并验证了自回归方法优于扩散模型。
AI 中文摘要
密码仍然是在线认证的主要机制，理解人类如何选择密码对于防御强度评估和攻击模拟都至关重要。最近基于学习的方法，如PassGAN和PassGPT，已经表明深度生成模型可以直接从泄露的语料库中学习密码结构。然而，这两种方法都是从随机初始化开始，仅基于密码数据进行训练。语言先验知识在密码建模中的作用，以及它揭示了人类如何创建秘密的哪些信息，在很大程度上仍未得到充分探索。在此，我们通过PassGPT+来弥补这一空白，该方法通过字符感知的分词将GPT-2的语言先验适应于密码观测。我们还引入了PassDiffusion，这是首个用于密码生成的吸收态离散扩散模型，作为非自回归方法是否具有竞争力的探针。在RockYou基准测试上，PassGPT+在10^8次猜测中恢复了22.53%的保留密码，相对于PassGPT有16%的相对提升，并且在不重新训练的情况下迁移到不重叠的2020年泄露数据集时，保持了这一匹配率的79%，这表明语言先验捕捉了人类密码生成的持久规律。PassDiffusion的性能低了两到三个数量级，表明自回归建模比迭代去噪更适合密码生成的离散、精确匹配特性。
英文摘要
Passwords remain the dominant online authentication mechanism, and understanding how humans choose them is essential for defensive strength estimation and attack simulation alike. Recent learning-based approaches such as PassGAN and PassGPT have shown that deep generative models can learn password structure directly from leaked corpora. However, both train from random initialization on password data alone. The role of linguistic prior knowledge in password modeling, and what it reveals about how humans create secrets, remains largely underexplored. Here, we address this gap with PassGPT+, which adapts the linguistic prior of GPT-2 to password observations through character-aware tokenization. We also introduce PassDiffusion, the first absorbing-state discrete diffusion model for password generation, as a probe of whether non-autoregressive approaches are competitive. On the RockYou benchmark, PassGPT+ recovers 22.53% of held-out passwords at 108 guesses, a 16% relative gain over PassGPT, and retains 79% of this match rate when transferred without retraining to a disjoint 2020 leak dataset, demonstrating that linguistic priors capture persistent regularities of human password generation. PassDiffusion underperforms by two to three orders of magnitude, indicating that autoregressive modeling is substantially better matched than iterative denoising to the discrete, exact-match nature of password generation.
Comments3 figures, 2 tables. Code is available at https://github.com/CodesByNeeraj/PassGPTPlus
