Abstract:

Password-based authentication remains a critical link in the security of large-scale complex software systems. Large language models (LLMs) fine-tuned for password guessing can substantially outperform classical methods, but existing approaches require at least 24GB of GPU memory, limiting practical adoption in routine security auditing of such systems. We replicate the trawling-guessing component of PassLLM using Gemma-2B, a quarter-scale model, fine-tuned with Low-Rank Adaptation under a 16GB budget on freely available cloud compute. We evaluate against PCFG, Markov, and PassGPT using Monte Carlo estimation with 95\% confidence intervals in both in-site and cross-site settings, and qualitatively analyse the model’s highest-probability guesses.

Our model outperforms both classical baselines across all guess budgets in-site (35.80% vs. 24.60% at $10^8$) and approaches PassGPT, a specialised password model. Qualitatively, only 10\% of the top-50 guesses are verbatim training copies; the rest are generalised structural templates, indicating genuine pattern learning. These results show that LLM-based password guessing capability is not strictly tied to model scale and can be recovered through parameter-efficient fine-tuning of a small, general-purpose model on accessible hardware. This finding lowers the barrier topractical password security auditing in complex systems, enabling broader empirical assessment without specialised compute resources.