Neural cryptography is a small research area in which neural networks either agree on a shared key or learn to scramble messages, and neither version has produced an encryption method that anyone relies on. Two networks that adjust their weights until they match (2002) were broken by a published attack the same year, and networks trained against an eavesdropper network (2016) learned a working cipher in only about half of the training runs reported by their authors. Encryption in actual use still comes from standardized algorithms such as the ones NIST finalized in August 2024.
Key takeaways
- The 2002 "synchronization" idea by Kanter, Kinzel, and Kanter let two networks reach identical weights and use them as a key; Klimov, Mityagin, and Shamir published attacks on it within the year.
- In the 2016 Google Brain experiment, training succeeded in 10 of 20 runs at 16-bit messages under the authors' own success test.
- A 2018 follow-up found that a learned scheme became an unbreakable one-time pad only when the training adversary was strong enough, and its authors did not recommend using neural networks in real systems.
- None of the sources reviewed documents a standards body adopting a neural cipher, while NIST's post-quantum standards came from a multi-year public competition.
Two networks that agree on a key
The first well-known proposal came from physicists. In a paper submitted to arXiv on February 7, 2002, and printed in Europhysics Letters that year, the physicists Kanter, Kinzel, and Kanter described two artificial networks that learn from each other's outputs. Each side receives the same random inputs, announces only its output, and updates its weights when the two outputs agree. After enough rounds the weights on both sides become identical, and that shared state serves as a secret key. The authors argued that an eavesdropper who sees every transmitted bit has a much harder time tracking the weights than the two partners have in synchronizing them, and that the cost of building the channel grows only linearly with network size.
The idea did not survive scrutiny from cryptographers. Alexander Klimov, Anton Mityagin, and Adi Shamir presented "Analysis of Neural Cryptography" at ASIACRYPT 2002, explaining why the partners converge and then showing that the key exchange can be broken in three different ways. Later work tried variants, among them a binary version called the permutation parity machine, and a 2012 paper in Physical Review E by Luís Seoane and Andreas Ruttor reported a probabilistic attack on that variant too.
Alice, Bob, and Eve learn together
A different line began on October 21, 2016, when Martín Abadi and David Andersen of Google Brain posted "Learning to Protect Communications with Adversarial Neural Cryptography." The setup has three networks. Alice takes a plaintext and a key and produces a ciphertext. Bob receives the ciphertext and the same key. Eve sees only the ciphertext. Alice and Bob are rewarded when Bob reconstructs the message and Eve fails, and Eve is trained alongside them to read it anyway.
The paper reports its numbers openly. With 16-bit plaintexts and keys, a perfect result means Bob gets every bit right while Eve gets half of them wrong, the same as guessing. Six of 20 initial runs failed outright. For the other 14, the authors retrained Eve five times and measured her error between 4.67 and 6.97 wrong bits out of 16, with a mean of 6.1. Counting a run as a success when Bob's error stayed at or under 0.05 bits and Eve missed at least six bits on average, training succeeded in 10 of 20 cases. The learned method was not a plain XOR: flipping one key bit changed three to six of the 16 ciphertext values. An attempt to learn public-key behavior mostly failed, and the one run that held up broke once training continued.
What a 2018 follow-up added
Murilo Coutinho and colleagues published "Learning Perfectly Secure Cryptography to Protect Communications with Adversarial Neural Cryptography" in the journal Sensors on April 24, 2018. They found that the original setup tends to settle on weak, Vigenère-like ciphers. When Eve was given a chosen-plaintext game, in which she must tell which of two messages she picked was encrypted, the networks learned the one-time pad in nearly all successful runs. The paper still says that this change alone does not guarantee security, that the adversary has to be strong enough to force a good solution, and that the experiments used keys of only four, eight, and 16 bits. Its authors do not recommend neural networks for real systems.
The record at a glance
| Work | Year | Idea | What happened |
|---|---|---|---|
| Kanter, Kinzel, Kanter | 2002 | Networks synchronize weights into a key | Attacked by Klimov, Mityagin, and Shamir the same year |
| Seoane and Ruttor | 2012 | Attack on the permutation parity variant | Probabilistic attack reported |
| Abadi and Andersen | 2016 | Alice, Bob, and Eve trained together | Worked in 10 of 20 runs at 16 bits; not a proof of security |
| Coutinho and colleagues | 2018 | Stronger chosen-plaintext adversary | Learned a one-time pad with keys up to 16 bits |
Why a learned cipher is not yet a cipher you can use
Standard encryption earns trust through years of open attack. NIST describes its post-quantum standards, FIPS 203, 204, and 205, as the product of a multi-year international competition with industry, academia, and governments. A neural scheme is judged only against the particular Eve that was trained, and a stronger attacker may do better. Training can also be unstable, as the 2016 failure rate shows. For readers who want the broader picture of how AI and encryption meet in practice, the NIST project page is the primary reference for what is approved.
Questions for a claim of "neural network encryption"
- Which published scheme is it, and has a cryptographer outside the vendor or lab attacked it?
- Was security tested against a fixed eavesdropper network or against a proof or a competition?
- What key length was tested? The research above used 16 bits or fewer, while practical systems use far longer keys.
- Does the product replace an approved algorithm, or does it use AI to monitor traffic around one?
This article is general information about research, not security or legal advice. Anyone protecting real data should rely on algorithms approved by bodies such as NIST or the the Government of Canada's cyber security authority.
FAQ
Is neural cryptography used anywhere in practice?
None of the sources reviewed for this page documents a deployment. The papers are research demonstrations, and the 2018 authors say they do not recommend neural networks for real systems.
Did the 2016 Google experiment show that AI can invent unbreakable encryption?
No. It showed that networks can learn to hide data from another network under a specific test. The authors reported failures, a modest success rate, and no proof of security.
Can a neural network break standard encryption?
The Abadi and Andersen paper itself calls it improbable that neural networks would become strong at cryptanalysis, and suggests they may be more useful for metadata and traffic analysis.
Is neural cryptography safe against quantum computers?
That has not been established. The synchronization scheme does not rely on number-theoretic problems, but it was attacked classically in 2002, so the question never reached a practical stage.
Related reading
- a worked example of how a small network computes
- the step-by-step arithmetic inside a network
- open research lines for neural networks
- how a private AI network is meant to work
More in AI Basics.
Last verified: October 2026
Sources
- Learning to Protect Communications with Adversarial Neural Cryptography, Abadi M, Andersen D, arXiv:1610.06918, 2016
- Post-Quantum Cryptography project, National Institute of Standards and Technology, accessed October 2026
- Secure exchange of information by synchronization of neural networks, Kanter, Kinzel, and Kanter, Europhysics Letters 57, 2002
- Analysis of Neural Cryptography, Klimov A, Mityagin A, Shamir A, ASIACRYPT 2002, LNCS 2501
- Successful attack on permutation-parity-machine-based neural cryptography, Seoane L, Ruttor A, Physical Review E 85, 2012
- Learning Perfectly Secure Cryptography to Protect Communications with Adversarial Neural Cryptography, Coutinho M et al., Sensors 18(5), 2018