Password Guessing Using Large Language Models

Yunkai Zou, Maoxiang An, Ding Wang

34th USENIX Security Symposium · Day 1

This groundbreaking paper introduces **PassLLM**, an innovative framework that leverages **Large Language Models (LLMs)** with **Low-Rank Adaptation (LoRA)** techniques for advanced password guessing attacks. Authored by Yunkai Zou, Maoxiang An, and Ding Wang from Nankai University, PassLLM addresses the inherent limitations of general-purpose LLMs in specialized tasks like password guessing, where static knowledge and a disconnect from real-world password creation behaviors hinder their effectiveness. The work presents a novel technical route, demonstrating how modern LLMs can be efficiently fine-tuned and optimized for this critical security domain.

AI review

Solid applied ML security research that actually moves the needle on password guessing. The LoRA fine-tuning approach is sensible, the eval is comprehensive across 11 datasets, and the distillation work makes this practically deployable. Not revolutionary—it's applying known techniques to a well-studied problem—but the execution is clean and the results are real.