Some notes about Anthropic’s new results

关于 Anthropic 最新研究成果的一些笔记

Yesterday Anthropic published two new cryptanalysis results, both outputs of Claude Mythos, their (still) unreleased advanced model. The first of these results attacks a signature scheme called HAWK, while the second is an improved attack against reduced-round AES. Anthropic also released a blog post describing the research process that produced these results. A few people online have asked me what this all means. While I’m not sure I have all the answers, I figured it wouldn’t hurt to write a bit about my current understanding. These are only my thoughts and other folks will probably differ (including domain experts in the two areas at issue) so take them for what they are. The two new results cover two very different areas, and are overall just very different in quality. Before we get to broad statements about the world, and whether you should sell all your cryptocurrency, let’s take a minute to talk about the substance.

昨天，Anthropic 发布了两项新的密码分析成果，均出自其尚未发布的先进模型 Claude Mythos 之手。第一项成果针对一种名为 HAWK 的签名方案，第二项则是针对简化轮次 AES 的改进攻击。Anthropic 还发布了一篇博客文章，描述了产生这些成果的研究过程。网上有一些人问我这些意味着什么。虽然我不确定自己是否掌握了所有答案，但我想写一点我目前的理解也无妨。这些仅是我个人的想法，其他人（包括相关领域的专家）可能会有不同意见，所以请仅供参考。这两项新成果涵盖了两个截然不同的领域，且整体质量差异很大。在我们对世界做出宏大陈述，或者讨论你是否应该抛售所有加密货币之前，让我们先花点时间谈谈其实质内容。

Hawk. The first is a new key recovery algorithm against the non-standard signature scheme HAWK. HAWK is a proposed post-quantum-safe signature scheme that’s based on the module Lattice Isomorphism Problem (module-LIP). For a brief Claude-written summary of the result itself, see here. There are five things you need to know about this result: HAWK is not a deployed or standards-adopted algorithm, it’s a proposed algorithm. It is related to the Falcon signature scheme, which is being standardized, but the attack does not transfer to that setting (which is based on a different hard problem.) However, HAWK was somewhat far along in the process of being evaluated for a future standard. The attack does not break “real deployed” HAWK in the sci-fi sense. The resulting attack is still exponential time, but roughly halves the number of “bits” of security in the algorithm. That means it could theoretically be fixed by doubling key sizes. The downside is that this makes the scheme less efficient, and, since HAWK is entirely motivated by being more efficient than alternatives, that makes the existence of the scheme much harder to justify. The attack produced real code that runs in a few hours of wall-clock time against a weakened “challenge instance” of HAWK that the authors provided for this purpose. While this instance doesn’t use the parameters that were proposed for real deployment, it does demonstrate the cryptanalytic weakness well enough. What’s particularly concerning (and so especially ripe for AI) is that the attack does not invent fundamentally new mathematics. It simply extends a bunch of tools that were lying around and well-known, and gets a good result. This last part is important. I asked Claude for its thoughts, and it doesn’t mince words: “what makes this genuinely interesting — and, frankly, a little embarrassing for the field — is that none of the ingredients are exotic.” The TL;DR is that someone just did a much more thorough job applying all of our known tools. This is the sort of things that attack AIs excel at.

Hawk。 第一项成果是一种针对非标准签名方案 HAWK 的新型密钥恢复算法。HAWK 是一种基于模格同构问题（module-LIP）的后量子安全签名方案。关于该成果的简要总结（由 Claude 撰写），请参阅此处。关于这一成果，你需要了解五件事：HAWK 并非已部署或被标准采纳的算法，它只是一个提议中的算法。它与正在标准化的 Falcon 签名方案有关，但该攻击无法迁移到 Falcon 上（后者基于不同的难题）。然而，HAWK 在未来标准的评估过程中已经走得比较远了。这种攻击并非科幻意义上“破解了实际部署的”HAWK。该攻击仍属于指数时间复杂度，但大约将算法的“安全比特数”减半了。这意味着理论上可以通过加倍密钥长度来修复它。缺点是这会降低方案的效率，而由于 HAWK 的核心动机就是比替代方案更高效，这使得该方案的存在变得难以证明。该攻击产生了真实代码，在作者为此提供的弱化版“挑战实例”上，仅需几小时的挂钟时间即可运行。虽然该实例没有使用提议用于实际部署的参数，但它足以证明其密码分析上的弱点。特别令人担忧（也因此特别适合 AI 发挥）的是，该攻击并没有发明任何根本性的新数学。它只是扩展了一堆现成的、众所周知的工具，并取得了不错的结果。最后这一点很重要。我询问了 Claude 的看法，它直言不讳：“真正有趣的是——坦率地说，对该领域来说有点尴尬——没有任何成分是新奇的。” 简而言之，就是有人更彻底地应用了我们已知的所有工具。这正是攻击型 AI 所擅长的事情。

AES. The second result is a new attack on reduced-round AES. This result initially sounds more exciting, since most people hear “attack on AES” and panic. However, this is also the result that’s much, much less interesting. Most folks reading this blog will know that AES is a standard block cipher that’s used just about everywhere. It’s been a standard since 2001, and the deployed version has so far withstood everything significant that’s been thrown at it: that includes a substantial amount of non-public testing performed by the NSA. Since attacking full ciphers is very difficult, it’s standard for cryptanalysts to do their work against weakened, or “reduced-round” versions of a cipher. The full AES cipher runs for either 10, 12 or 14 rounds depending on key size. The new Anthropic result attacks a weaker 7-round variant of the cipher. Critically, attacks against 7-round AES are not new: there have been several of these. In fact, this new Anthropic result is a modest constant-factor improvement on previous work from back in 2013. To give you a sense of how far these attacks are from really “breaking” AES, I’d note the headline results: the new attack requires 289 cipher operations and, even worse, this work is only possible after you’ve somehow convinced a real encryptor to produce 2105 encryptions of chosen plaintexts under their secret key! Neither of these things is remotely practical in the real world. And while the new result modestly speeds up this attack over the previous result, it’s not even clear how “real” the speedup in this result is: since the actual attack requires 289 operations and can’t really be “run”, what we have is an on-paper analysis that may or may not yield an actual runtime improvement if all details are actually worked out. This does not make the result bad! In fact it’s still interesting from a techniques point of view. But it is very much a small increment in our knowledge, not a practical new attack like the HAWK work. So TL;DR: no wildly new mathematical results here. But still, real cryptanalytic progress of the sort that make scientists excited. And certainly the HAWK result is very meaningful, since that scheme had a real chance at standardization and is now (very likely) not going to be.

AES。 第二项成果是对简化轮次 AES 的新攻击。这个结果起初听起来更令人兴奋，因为大多数人听到“攻击 AES”就会恐慌。然而，这也是一个非常、非常不那么有趣的结果。阅读此博客的大多数人都知道，AES 是一种几乎随处可见的标准分组密码。自 2001 年以来，它一直是标准，且其部署版本迄今为止经受住了所有重大考验：包括美国国家安全局（NSA）进行的大量非公开测试。由于攻击完整密码非常困难，密码分析人员通常会对密码的弱化版或“简化轮次”版本进行研究。完整的 AES 密码根据密钥长度运行 10、12 或 14 轮。Anthropic 的新成果攻击的是该密码的一个较弱的 7 轮变体。关键在于，针对 7 轮 AES 的攻击并不新鲜：之前已经有过多次此类攻击。事实上，Anthropic 的这项新成果只是对 2013 年之前工作的一个适度的常数因子改进。为了让你了解这些攻击距离真正“破解”AES 有多远，我指出其核心数据：新攻击需要 289 次密码操作，更糟糕的是，这项工作只有在你以某种方式说服真实的加密器在密钥下生成 2105 次选择明文加密后才有可能实现！这两者在现实世界中都完全不切实际。虽然新结果比之前的结果适度加快了攻击速度，但这种加速有多“真实”尚不清楚：由于实际攻击需要 289 次操作，且无法真正“运行”，我们所拥有的只是纸面分析，如果所有细节都落实到位，它可能会也可能不会带来实际的运行时间改进。这并不意味着该结果很糟糕！事实上，从技术角度来看，它仍然很有趣。但它在很大程度上只是我们知识的一小步增量，而不是像 HAWK 那样具有实际意义的新攻击。所以简而言之：这里没有极其新颖的数学成果。但它仍然是让科学家们感到兴奋的那种真正的密码分析进展。当然，HAWK 的结果非常有意义，因为该方案原本很有机会被标准化，而现在（极有可能）不会了。

Now let’s talk about how we got here, and what it all means. How did Anthropic get these results? The Anthropic post is detailed about what they did, and honestly, it’s kind of hilarious. No, the team at Anthropic was not a large set of domain experts that carefully tuned their AI to find novel results. They appear to have just told it to get some results and then strapped its nose to the grindstone until it found some. If you doubt me, here are some examples of the prompts they used (cited from their post): So yes, the AIs are getting pretty good. In short: they are now capable of understanding existing cryptanalysis results, synthesizing them into real new attacks, and even extending them. They can apparently do this without det

现在让我们谈谈我们是如何走到这一步的，以及这一切意味着什么。Anthropic 是如何获得这些结果的？Anthropic 的文章详细介绍了他们的做法，老实说，这有点滑稽。不，Anthropic 的团队并不是由一大群精心调整 AI 以寻找新颖结果的领域专家组成的。他们似乎只是告诉 AI 去获取一些结果，然后让它埋头苦干，直到找到为止。如果你怀疑我，这里有一些他们使用的提示词示例（引自他们的文章）：所以是的，AI 确实变得越来越厉害了。简而言之：它们现在有能力理解现有的密码分析结果，将其综合成真正的新攻击，甚至对其进行扩展。显然，它们可以在没有……的情况下做到这一点。