PassBitNet: low-resource password guessing using 1-Bit quantized transformers

Abstract

Large language models (LLMs) demonstrate exceptional accuracy in password-guessing tasks, but their massive memory cost, high computational demands, and high duplicate rates severely limit deployment in resource-constrained scenarios. This paper introduces the 1-bit/1.58-bit quantized BitNet architecture to the password guessing domain for the first time, proposing the lightweight PassBitNet framework. PassBitNet adopts a pattern-guided autoregressive generation paradigm with three plug-and-play deduplication modules (SPP, SW-Bloom, and Shard-Dedup). Experiments demonstrate that PassBitNet-16H12-B achieves a 31.78% hit rate under $$10^{9}$$ guesses with only 3.40MB–more than double the hit rate of PassGAN while maintaining a performance within 10 percentage points below PassGPT, with merely 1/100th the memory of PassGPT. To address redundancy in autoregressive generation, three strategies were designed: Stepwise Probability Penalty (SPP), Sliding Window-Bloom Filter (SW-Bloom), and Shard-Dedup. These enable source-level duplication suppression and streaming filtering. The deduplication algorithms reduce the duplication rate to 2.01% (SPP) and 6.12% (SW-Bloom). The latter achieves a hit rate of 41.92% with only a 4.6% increase in time overhead.