NeuraCrypt is not private

TL;DR

This paper demonstrates that NeuraCrypt, a privacy-preserving data encoding method, fails to meet its claimed privacy guarantees by presenting a complete attack that exploits design flaws, thus compromising sensitive data.

Contribution

We provide the first complete attack on NeuraCrypt, disproving its privacy claims and highlighting critical vulnerabilities in its design.

Findings

NeuraCrypt's privacy claims are invalidated by our attack.

The attack achieves a 100% success rate in revealing original data.

Design flaws in NeuraCrypt enable complete privacy breaches.

Abstract

NeuraCrypt (Yara et al. arXiv 2021) is an algorithm that converts a sensitive dataset to an encoded dataset so that (1) it is still possible to train machine learning models on the encoded data, but (2) an adversary who has access only to the encoded dataset can not learn much about the original sensitive dataset. We break NeuraCrypt privacy claims, by perfectly solving the authors' public challenge, and by showing that NeuraCrypt does not satisfy the formal privacy definitions posed in the original paper. Our attack consists of a series of boosting steps that, coupled with various design flaws, turns a 1% attack advantage into a 100% complete break of the scheme.