SlowGuess/NeurIPS_2023_OCR huggingface dataset:
[1] Ezat Ahmadzadeh, Hyunil Kim, Ongee Jeong, and Inkyu Moon. A Novel Dynamic Attack on Classical Ciphers Using an Attention-Based LSTM Encoder-Decoder Model. IEEE Access, 2021.
[2] Gorjan Alagic, Jacob Alperin-Sheriff, Daniel Apon, et al. Status report on the second round of the nist post-quantum cryptography standardization process. US Department of Commerce, NIST, 2020. https://www.nist.gov/publications/status-report-second-round-nist-post-quantum-cryptography-standardization-process.
[3] Mohammed M Alani. Neuro-cryptanalysis of DES and triple-DES. In Proc. of NeurIPS, 2012.
[4] Martin Albrecht, Melissa Chase, Hao Chen, et al. Homomorphic encryption standard. In Protecting Privacy through Homomorphic Encryption, pages 31-62. Springer, 2021. https://eprint.iacr.org/2019/939.
[5] Martin R. Albrecht. On Dual Lattice Attacks Against Small-Secret LWE and Parameter Choices in HElib and SEAL. In Jean-Sebastien Coron and Jesper Buus Nielsen, editors, Advances in Cryptology - EUROCRYPT 2017, pages 103-129, Cham, 2017. Springer International Publishing. https://eprint.iacr.org/2017/047.
[6] Martin R. Albrecht, Rachel Player, and Sam Scott. On the concrete hardness of learning with errors. Journal of Mathematical Cryptology, 9(3):169-203, 2015. https://eprint.iacr.org/2015/046.
[7] Nada Aldarrab and Jonathan May. Can sequence-to-sequence models crack substitution ciphers? 2020. https://arxiv.org/abs/2012.15229.
[8] Seunggeun Baek and Kwangjo Kim. Recent advances of neural attacks against block ciphers. In Proc. of SCIS, 2020.
[9] Adrien Benamira, David Gerault, Thomas Peyrin, and Quan Quan Tan. A deeper look at machine learning-based cryptanalysis. In Proc. of Annual International Conference on the Theory and Applications of Cryptographic Techniques, 2021.
[10] Luca Biggio, Tommaso Bendinelli, Alexander Neitz, Aurelien Lucchi, and Giambattista Paras-candolo. Neural symbolic regression that scales. 2021. https://arxiv.org/abs/2106.06427.
[11] Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, et al. Language models are few-shot learners. In Proc. of NeurIPS, 2020.
[12] François Charton. Linear algebra with transformers, 2021. https://arxiv.org/abs/2112.01898.
[13] François Charton, Amaury Hayat, and Guillaume Lample. Learning advanced mathematical computations from examples. 2020. https://arxiv.org/abs/2006.06462.
[14] François Charton, Amaury Hayat, Sean T. McQuade, Nathaniel J. Merrill, and Benedetto Piccoli. A deep language model to predict metabolic network equilibria. 2021. https://arxiv.org/abs/2112.03588.
[15] François Charton, Kristin Lauter, Cathy Li, and Mark Tygert. An efficient algorithm for integer lattice reduction, 2023. https://arxiv.org/abs/2303.02226.
[16] Hao Chen, Lynn Chua, Kristin Lauter, and Yongsoo Song. On the Concrete Security of LWE with Small Secret. Cryptology ePrint Archive, Paper 2020/539, 2020. https://eprint.iacr.org/2020/539.
[17] Lily Chen, Dustin Moody, Yi-Kai Liu, et al. PQC Standardization Process: Announcing Four Candidates to be Standardized, Plus Fourth Round Candidates. US Department of Commerce, NIST, 2022. https://csrc.nist.gov/News/2022/pqc-candidates-to-be-standardized-and-round-4.
[18] Yi Chen and Hongbo Yu. Bridging Machine Learning and Cryptanalysis via EDLCT. Cryptology ePrint Archive, 2021. https://eprint.iacr.org/2021/705.
[19] Yuanmi Chen and Phong Q. Nguyen. BKZ 2.0: Better Lattice Security Estimates. In Proc. of ASIACRPT 2011, 2011.
[20] Jung Hee Cheon, Minki Hhan, Seungwan Hong, and Yongha Son. A Hybrid of Dual and Meet-in-the-Middle Attack on Sparse and Ternary Secret LWE. IEEE Access, 2019.
[21] Jung Hee Cheon, Duhyeong Kim, Joohee Lee, and Yongsoo Song. Lizard: Cut Off the Tail! A Practical Post-quantum Public-Key Encryption from LWE and LWR. In Dario Catalano and Roberto De Prisco, editors, Security and Cryptography for Networks, pages 160–177, Cham, 2018. Springer International Publishing. https://eprint.iacr.org/2016/1126.pdf.
[22] Róbert Csordás, Kazuki Irie, and Jürgen Schmidhuber. The Neural Data Router: Adaptive Control Flow in Transformers Improves Systematic Generalization. In Proc. of ICML, 2022.
[23] Stéphane d'Ascoli, Pierre-Alexandre Kamienny, Guillaume Lample, and François Charton. Deep symbolic regression for recurrent sequences. 2022. https://arxiv.org/abs/2201.04600.
[24] Alex Davies, Petar Velicković, Lars Buesing, Sam Blackwell, et al. Advancing mathematics by guiding human intuition with AI. Nature, (7887), 2021.
[25] Mostafa Dehghani, Stephan Gouws, Oriol Vinyals, Jakob Uszkoreit, and Lukasz Kaiser. Universal transformers. In Proc. of ICLR, 2019.
[26] Aurélien Dersy, Matthew D. Schwartz, and Xiaoyuan Zhang. Simplifying polylogarithms with machine learning, 2022. https://arxiv.org/abs/2206.04115.
[27] The FPLL development team. fpll, a lattice reduction library, Version: 5.4.4. Available at https://github.com/fplll/fplll, 2023.
[28] Elena Dubrova, Kalle Ngo, and Joel Gartner. Breaking a fifth-order masked implementation of crystals-kyber by copy-paste. Cryptology ePrint Archive, 2022. https://eprint.iacr.org/2022/1713.
[29] Aron Gohr. Improving attacks on round-reduced speck32/64 using deep learning. In Proc. of Annual International Cryptology Conference, 2019.
[30] Sergij V Goncharov. Using fuzzy bits and neural networks to partially invert few rounds of some cryptographic hash functions. 2019. https://arxiv.org/abs/1901.02438.
[31] Sam Greydanus. Learning the enigma with recurrent neural networks. 2017. https://arxiv.org/abs/1708.07576.
[32] Kaden Griffith and Jugal Kalita. Solving Arithmetic Word Problems with Transformers and Preprocessing of Problem Text. 2021. https://arxiv.org/abs/2106.00893.
[33] Andrey Gromov. Grokking modular arithmetic, 2023. https://arxiv.org/pdf/2301.02679.pdf.
[34] Pengcheng He, Xiaodong Liu, Jianfeng Gao, and Weizhu Chen. Deberta: Decoding-enhanced BERT with disentangled attention. In Proc. of ICLR, 2021.
[35] Sepp Hochreiter and Jürgen Schmidhuber. Long short-term memory. Neural Computation, 1997.
[36] Lukasz Kaiser and Ilya Sutskever. Neural GPUs learn algorithms. 2015. https://arxiv.org/abs/1511.08228.
[37] Ravi Kannan. Minkowski's Convex Body Theorem and Integer Programming. Mathematics of Operations Research, 12:415-440, 1987.
[57] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Proc. of NeurIPS, 2017.
[58] Emily Wenger, Mingjie Chen, François Charton, and Kristin E Lauter. Salsa: Attacking lattice cryptography with transformers. Proc. of NeurIPS, 2022.
[59] Mingyu Zong and Bhaskar Krishnamachari. Solving math word problems concerning systems of equations with GPT-3. In Proc. of AAAI, 2022.
A.1 Parameters
Table 9. LWE, preprocessing, and training parameters. For the adaptive increase of preprocessing parameters, we start with blocksize  $\beta_{1}$  and LLL-delta  $\delta_{LLL1}$ , and upgrade to  $\beta_{2}$  and  $\delta_{LLL2}$  at a later stage. Parameters base  $B$  and bucket size  $r$  are used to tokenize the numbers for transformer training.
n	log2q	q	β1	δLLL1	β2	δLLL2	base B	bucket size r
256	12	3329	35	0.99	40	1	417	1
14	11197	35	0.99	40	1	1400	1
16	42899	35	0.99	40	1	5363	4
18	222553	35	0.99	40	0.99	27820	16
20	842779	35	0.99	40	0.99	105348	64
350	21	1489513	30	0.96	40	0.99	186190	128
27	94056013	30	0.96	40	0.99	5878501	4096
512	41	2199023255531	18	0.93	22	0.96	137438953471	134217728
VERDE runs data preprocessing with the parameters shown in Table 9 in parallel using multiple CPUs. We fully parallelize when the time to process one matrix is greater than 24 hours—e.g., for  $n = 350, \log_2 q = 27$ , we used 5000 CPUs. Otherwise, we parallelize on fewer CPUs depending on the attack time allowed—e.g., preprocessing is completed on 270 CPUs in less than 4 days for  $n = 256, \log_2 q = 14$ , and on 990 CPUs in less than 3 days for  $n = 256, \log_2 q = 18$ .
In VERDE, the tokenization used by the transformer mirrors the strategy in §4 of [42], but uses smaller bases  $B$  and larger bucket sizes  $r$  for better performance (Table 9, 10 of [42]). Decreasing  $B$  is further supported by Table 10, evaluated on a low modulus data using VERDE's preprocessing  $(n = 256, \log_2 q = 16)$ . Full ternary secret recovery and partial Gaussian secret recovery both improve with smaller  $B = 5363$ .
Table 10. Secret recovery for different bases.  $n = 256$ ,  $\log_2 q = 16$ . We show full ternary secret recovery and partial Gaussian secret recovery when using  $B = 7150$  and 5363 on the same datasets and secrets.
h	ternary	Gaussian
8	9	10	11	12	3	4	5	6
B=7150	2/10	0/10	1/10	0/10	1/10	5/10	6/10	1/10	1/10
B=5363	2/10	0/10	2/10	0/10	2/10	5/10	6/10	1/10	3/10
A.2 More seeds for initialization
The ML attacks benefit from running multiple times with different seeds, or initializations, as was demonstrated in PICANTE [42, Section 6.4]. More seeds improve both the success probability and the number of epochs required. Table 11 shows how binary secret recovery improves with more seeds, for different Hamming weights  $h$  when  $n = 256$  and  $\log_2 q = 12$ .
Table 11. Secret recovery with 1 vs 5 seeds.  $n = 256$ ,  $\log_2 q = 12$ , binary secrets. For 1 seed, epoch is the epoch of secret recovery; For 5 seeds (ran on the same secrets as the 1 seed experiments), epoch is the lowest epoch of secret recovery among the 5 initializations for each secret.
h	3	4	5	6
recovery, 1 seed epoch	5/10	1/10	1/10	1/10
0,0,0,8,17	0	17	13
recovery, 5 seeds epoch	7/10	3/10	1/10	2/10
0,0,0,7,7,8,17	0,5,5	7	4,7
Table 12 shows the results for ternary secrets on  $n = 512$ ,  $\log_2 q = 41$ , where we run 5 initializations for each secret. While most initializations partially recovered the secret, only a few got full recovery within 20 epochs. Full recovery benefits from more initializations, especially for high  $h$ .
Table 12. Ternary secret recovery with 5 initializations.  $n = {512}$  . -': recovery did not occur in  $\leq  {20}$  epochs.
h	45	46	50	55	58	60
epoch of partial recovery	4,4,6,6,7	1,1,1,1,1	3,4,5,7,-	5,6,6,6,7	6,6,8,10	5,8,8,8,12
epoch of full recovery	10,-,-,-,-	5,7,-,-,-	4,10,14,17,-	16,-,-,-,-	11,11,-,-,-	-,-,-,-,-
A.3 Comparison with PICANTE
To demonstrate the power of the new preprocessing in SALSA VERDE, we run a set of experiments on  $n = 256$ ,  $\log_2 q = 23$ , where PICANTE also showed success. Using blocksize  $\beta = 40$ , each matrix is processed by VERDE in about 1.5 days; PICANTE took 2.2 days/matrix. VERDE achieves a reduction factor of 0.25, compared to 0.33 in PICANTE. As shown in Table 1, the difference in the preprocessing step is even more striking for lower  $q$ .
The highest  $h$  recovered by PICANTE was  $h = 31$  in 4 out of 20 experiments; VERDE recovered  $h = 43$ . In Table 13, we see that for  $h = 26 - 31$ , VERDE significantly outperforms PICANTE in both the success rate and the number of epochs required. In other words, better preprocessing results in lower training time and better secret recovery.
Table 13. Epochs of secret recovery for PICANTE vs. VERDE.  $n = 256$  and  $\log_2 q = 23$ . ' -' means secret not recovered. 5 secrets per  $h$ , except for PICANTE  $h = 31$  (20 secrets).
h	26	27	28	29	30	31
PICANTE	2,3,4,7,-	10,-,-,-,-	5,-,-,-,-	5,9,11,-,-	17,20,32,-,-	6,12,26,27 (out of 20 secrets)
VERDE	0,0,2,2,7	2,6,-,-,-	0,0,0,1,2	0,1,1,1,-	0,1,2,3,-	1,2,3,4,-
A.4 Distinguisher tested on reduced data outperforms random data
We compare the performance of running the distinguisher on the preprocessed data that were held out from the training set  $(\mathrm{Dist}_{\mathrm{BKZ}})$  with running on random vectors  $(\mathrm{Dist}_{\mathrm{rand}})$ . We run both set of experiments with the same model initialization seeds, and record a success for the method(s) that recovers the secret at the earliest epoch. Table 14 indicates that  $\mathrm{Dist}_{\mathrm{BKZ}}$  performs better.
Table 14. Secret recovery by running the distinguisher on the random vectors and bkz preprocessed data.  $n = 256$ ,  $\log_2 q = 23$ , on data processed using PICANTE's approach.
h	27	28	29	30	31
DistBKZ	2/5	1/5	1/5	0/5	0/5
Distrand	1/5	0/5	0/5	0/5	0/5
A.5 Dimension reduction techniques
Most of the entries in a sparse secret are zero, so prior work [5] has suggested the idea of randomly assuming a subset of the entries to be zero and removing them to reduce the dimension of the lattice problem. The assumption will be correct with some probability depending on the secret's sparsity. Here we explore an improvement on this strategy: we use the partially trained model to glean signal on which entries should be kicked out. We can either try to kick out zeros, which we call dimension reduction, or in the binary case, kick out 1s, which we call Hamming reduction, or combined.
This technique will be better than random when the model has begun to learn information about the bits, reflected in their relative rankings. Specifically, the ranking strategies described in [42, Section 4.3] are used to compute scores which estimate the likelihood of secret bits being 1. Once the model has started to learn, we can assume that the highest ranked bits will correspond to secret bits which are equal to 1, and the lowest ranked bits will correspond to zeros. So we use this information to reduce the dimension of the problem by kicking out low-ranked bits which we guess to be zero or high-ranked bits which we guess to be 1. Then, we retrain a model on the smaller dimensional samples and hope to recover the secret. If the original kicked out bits were correct and the model recovers the secret of the smaller dimensional problem, then we find the original secret.
Dimension reduction. Since there are many more 0s than 1s in sparse secrets, we can potentially reduce the dimension significantly. Once we remove the bits with low scores, we can simply re-run
training on the dataset with  $(\mathbf{a}', b)$  where  $\mathbf{a}'$  are the samples with the corresponding bits removed. If the indices have been identified incorrectly, then the reduction will fail. For  $n = 256, \log_2 q = 14$ , VERDE attempted 10 binary secrets with  $h = 10$  and did not recover the secret. Then we tried dimension reduction on these experiments and recovered one secret.
Hamming reduction. Kicking out  $1s$  from the secret is particularly valuable, given the theoretical analysis of the VERDE in Section 6. If nonzero bits are indeed ranked at the top by the model, a straightforward approach of kicking out the top-ranked bits and retraining on the smaller dimension and Hamming weight will likely yield improved secret recovery.
But in case some of the top-ranked bits are not equal to 1, we propose the following strategy. Suppose  $S$  is a small set of indices for bits with the highest scores. We construct the following problem: let  $\mathbf{s}'$  be  $\mathbf{s}$  with bits in  $S$  flipped, and  $\mathbf{a}'$  be  $\mathbf{a}$  with  $a_i$  negated for  $i \in S$ . Equivalently, for  $i \in S$ ,  $a_i' = -a_i$  and  $s_i' = 1 - s_i$ . Then, the corresponding
$$
b ^ {\prime} = \mathbf {a} ^ {\prime} \cdot \mathbf {s} ^ {\prime} = \sum_ {i \not \in S} a _ {i} s _ {i} + \sum_ {i \in S} a _ {i} ^ {\prime} s _ {i} ^ {\prime} = \sum_ {i \not \in S} a _ {i} s _ {i} + \sum_ {i \in S} - a _ {i} (1 - s _ {i}) = b - \sum_ {i \in S} a _ {i}.
$$
If more than half of the indices in  $S$  are 1, then  $\mathbf{s}'$  has a smaller Hamming weight, hence the instance  $(\mathbf{a}', b' = b - \sum_{i \in S} a_i)$  is likely easier. If exactly half of the indices in  $S$  are 1, then  $\mathbf{s}'$  has the same  $h$  as  $\mathbf{s}$ , but the new instance  $(\mathbf{a}', b')$  will have a different NoMod and may be recoverable.
A.6 Attacking sparse secrets in larger dimensions
For sparse secrets on even larger dimensions, we can apply our attack after using combinatorial techniques to exploit the sparsity of the secret. The approach would be to combine VERDE with the techniques from [5, 20] as follows: Randomly kick out  $k$  entries of the secret, assuming they are zero, which will be true with some probability. This reduces the LWE problem to a smaller dimension where VERDE can recover the secret. The expected cost of the attack would be VERDE's cost multiplied by  $1 / p$ , where  $p = \left(\frac{n - h}{n}\right)^k$  is the probability that the assumption that the  $k$  entries are 0 is correct.
A.7 Comparison with lattice reduction/uSVP attacks
In this section we compare VERDE with classical lattice reduction attacks in two ways. The LWE Estimator [6] gives heuristic predicted running times for the best-known lattice reduction attacks. But even the authors of the LWE Estimator claim that the estimates are often wrong and unreliable. So we compare VERDE to the Estimator results but we also compare to concrete running times in the case  $n = 256$ , achieved by implementing the uSVP lattice attacks ourselves, on the same machines where we run our ML-based attacks. Unfortunately, many attacks listed by the LWE Estimator lack practical/accessible implementations, and we lacked the time and resources to implement all of these and run comparisons. Thus, we focus our concrete comparisons on the uSVP attack, which the Estimator predicts to be the best method for larger  $n$  such as  $n = 512$ . We leave comparison of VERDE against other lattice reduction attacks as important future work for the broader lattice community, as practical attack run-times are poorly understood, especially for small sparse secrets.
Table 15. Concrete comparison of VERDE and uSVP attacks for  $n = 256$ , binary secrets, varying  $q$  and  $h$ . VERDE's total attack time is the sum of preprocessing and training time (with recovery included). Preprocessing time assumes full parallelization, and training time is the number of epochs to recovery multiplied by epoch time (1.5 hours/epoch). fail means no successful secret recovery for uSVP to compare to.
LWE parameters	VERDE attack time	uSVP attack time (hrs)
log2q	h	Preprocessing (hrs)	Training	Total (hrs)
12	8	1.5	2 epochs	4.5	fail
14	12	2.5	2-5 epochs	5.5-10	fail
16	14	8.0	2 epochs	11	fail
18	18	7.0	3 epochs	11.5	558
18	20	7.0	1-8 epochs	8.5-19	259
20	22	7.5	5 epochs	15	135-459
20	23	7.5	3-4 epochs	12-15	167-330
20	24	7.5	4 epochs	13.5	567
20	25	7.5	5 epochs	15	76 - 401
Table 15 presents our concrete comparison between VERDE and the uSVP attack on binary secrets for  $n = 256$ . To summarize the comparison, VERDE outperforms the uSVP attack in two senses: 1) VERDE fully recovers sparse binary and ternary secrets for  $n$  and  $q$  in some cases where the uSVP attack does not succeed in several weeks or months using fpdll BKZ 2.0 [19] with the required block size; and 2) in cases where we improve the uSVP implementation enough (see below) to run with the required large block size, we find that in all cases, VERDE recovers the secrets much faster.
Summarizing classical lattice reduction attacks. Table 16 gives the estimated heuristic cost and specifies the block size for attacking sparse binary and ternary secrets for  $n = 256, 350, 512$  and various  $q$  with the best known classical lattice reduction attack.
Table 16. Estimated cost of best classical attack (LWE Estimator). For VERDE's highest  $h$ , we run the LWE Estimator and report the estimated cost and block size  $\beta$  for the best predicted attack.
n	log2q	binary secret	ternary secret
h	best attack	rop	β	h	best attack	rop
256	12	8	dual_mitm hybrids	243.0	40	9	dual_mitm hybrids	243.8
14	12	dual Hybrid	247.2	40	13	dual Hybrid	247.7
16	14	dual Hybrid	246.8	40	16	dual Hybrid	247.4
18	23	bdd Hybrid	247.1	45	23	dual Hybrid	247.4
20	36	bdd	244.0	45	33	bdd	244.2
350	21	12	dual_mitm hybrids, bdd_mitm hybrids	246.4	40	13	dual_mitm hybrids	246.9
27	36	bdd	244.9	47	38	bdd, bdd Hybrid	244.1
512	41	63	usvp/bdd	242.9	40	60	usvp/bdd	242.9
Table 17. Estimated cost and block sizes of uSVP.  $n = 256$ ,  $\log_2 q = 16, 18, 20$ , for binary, ternary, and Gaussian secrets with  $h$  nonzero entries.
log2q	binary	ternary	Gaussian
h	rop	β	h	rop	β	h	rop	β
16	12	254.7	86	12	254.9	87	6	269.3	138
18	18	249.5	67	19	249.8	68	7	259.5	102
20	25	245.4	52	24	245.4	52	7	253.5	80
Table 17 gives the same information for the uSVP classical lattice reduction attack, focusing on  $n = 256$  for some of the larger  $q$  and  $h$  where VERDE succeeds.
uSVP attack performance, binary secrets. For  $n = 256$  and  $\log_2 q = 20$ , we run the concrete uSVP attack using fpllBKZ 2.0 with Kannan's embedding and parameters ([37], [16]). With block size 50 and 55, secrets are not recovered in 25 days, and block size 60 or larger cannot finish the first BKZ loop in 3 days. We propose two improvements to get these attacks to run faster and better: 1) we rearrange the rows of the uSVP matrix as in VERDE; 2) we use the adaptive float type upgrade as in VERDE. In addition, after each BKZ loop, we also run the secret validation obtained from the shortest vector found so far, and terminate if we get a secret match.
With rearranging the rows but without the adaptive float type upgrade, we have to use higher precision because otherwise the attack fails due to low precision after running for 23 hours. The attacks run quite slowly with high precision and did not recover secrets after 25 days, except in one case where a binary secret with  $h = 22$  was recovered with block size 55 in 414 hours, roughly 17 days.
With rearranging the rows and the adaptive float type upgrade, we ran  $n = 256$  and  $\log_2 q = 20$  with block size 50 - 55 for binary/ternary secrets, and  $n = 256$  and  $\log_2 q = 18$  with block size 65 for binary/ternary secrets. See Table 18 for running times and  $h$ . For example, for  $\log_2 q = 20$ , a ternary secret with  $h = 25$  was recovered in 280 hours, roughly 12 days, and for  $\log_2 q = 18$ , a binary secret with  $h = 20$  was found in  $\approx 11$  days. When the block size used is lower than predicted by the estimator (50 instead of 52 for  $\log_2 q = 20$  and 65 instead of 67 for  $\log_2 q = 18$ , see Table 17, 18), the uSVP attack succeeds in recovering only a few secrets out of many which were tried.
Table 18. uSVP concrete attack time,  $n = {256}$  . Upper:  ${\log }_{2}q = {20}$  ,lower:  ${\log }_{2}q = {18}$  . For each  $h$  ,block size and secret distribution, we run 5 experiments on different secrets and show the secret recovery time (in hours). ' - ' means no success in 25 days.
$\mathbf{n} = 256, \log_2 \mathbf{q} = 20$
blocksize	secret	h=22	h=23	h=24	h=25
50	binary	-	-	-	451,531
ternary	261,367	-	-	-
55	binary	135,161,459	167,323,330	567	76,280,401
ternary	43,241,432	234,296	226,257,337	280
$\mathbf{n} = 256, \log_2 \mathbf{q} = 18$
blocksize	secret	h=11	h=12	h=17	h=18	h=19	h=20
65	binary	32	-	-	558	-	259
ternary	324, 553	109	594	-	-	-
The concrete experiments allow us to validate to some extent the predictions of the Estimator in many cases, giving confidence in the comparison with VERDE. Running the uSVP attack with block size 70 or larger didn't finish the first BKZ loop in 3 days, so we expect longer attack time for Gaussian secrets and for binary and ternary secrets with lower  $q$ .
Gaussian secrets. VERDE achieves partial Gaussian secret recovery for small  $h$ , reducing the secret recovery to a lattice problem in tiny dimension ( $h$ ). Because the preprocessing time and per epoch time does not vary with secret distribution, VERDE's attack time on Gaussian secrets is comparable to on binary secrets (see Table 15, 19). We note that preprocessing takes longer for  $n = 350$  and  $\log_2 q = 27$  due to precision issues. This is an important observation because lattice problems are supposed to be harder for smaller  $q$ . In contrast, with classical attacks, the Estimator predicts significantly larger block sizes required, and longer running times (Table 20), than for binary secrets. VERDE compares favorably to classical attacks on Gaussian secrets, especially on small  $q$  (where the problem is harder), e.g., VERDE recovers Gaussian secrets with  $h = 5 - 6$  in  $4.5 - 15$  hours for  $n = 256$ ,  $\log_2 q = 12$ , where the cost of best classical attacks is predicted to be  $2^{91}$  rop.