NoMod ML-Attack: Non-Modular MLWE Cryptanalysis

• The paper demonstrates that combining reduction-based lattice preprocessing with robust linear regression allows effective non-modular recovery of MLWE secrets.
• NoMod ML-Attack treats modular wrap-around as outlier contamination, enabling statistical estimation to bypass explicit modular inversion.
• Performance benchmarks show competitive recovery of binary and sparse secrets using white-box regression and advanced lattice reduction techniques.

Searching arXiv for the specific NoMod paper and closely related ML/LWE cryptanalysis papers. Searching arXiv for "NoMod Module Learning With Errors". NoMod ML-Attack is a hybrid cryptanalytic method for recovering secrets from Module Learning With Errors (Module-LWE, or MLWE) instances without explicitly modeling modular reduction. In the method’s own framing, “NoMod” means “non-modular”: instead of learning the map induced by reduction modulo $q$, it treats wrap-arounds as statistical corruption and casts secret recovery as robust linear estimation after lattice preprocessing (Bassotto et al., 2 Oct 2025). The attack therefore occupies a specific position within machine-learning-assisted lattice cryptanalysis: it combines reduction-based sample transformation with white-box robust regression, so that the learned coefficients themselves are interpreted as the secret estimate rather than as latent features of a black-box predictor (Bassotto et al., 2 Oct 2025).

1. Definition and placement within ML-assisted cryptanalysis

NoMod is presented for MLWE over the cyclotomic ring $R_q = \mathbb{Z}_q[x]/(x^n+1)$, with the usual public relation $b_i = a_i^T s + e_i \in R_q$, or in coefficient embedding, $A s + e \equiv b \pmod q$ (Bassotto et al., 2 Oct 2025). The methodological problem it addresses is the difficulty of learning from observations obscured by modular reduction: values differing by multiples of $q$ are identified, which introduces discontinuous wrap-around behavior. NoMod’s central claim is that this obstacle can be bypassed rather than modeled directly (Bassotto et al., 2 Oct 2025).

This places NoMod within the broader class of ML attacks discussed as attacks on learning systems and optimization pipelines, but its object is cryptanalytic rather than classificatory. A useful contrast is with general ML attack taxonomies, which distinguish inference-time perturbation from training-time poisoning; NoMod instead uses machine learning as an estimator inside a search-MLWE recovery pipeline (Lin et al., 2021). A plausible implication is that NoMod is best understood not as an adversarial example method, but as a white-box statistical post-processing stage grafted onto classical lattice preprocessing.

The attack is explicitly described as hybrid and white-box (Bassotto et al., 2 Oct 2025). “Hybrid” refers to the combination of lattice reduction and statistical estimation. “White-box” refers to the fact that the regression model exposes coefficients directly, so the attack output is an interpretable candidate $\hat{\mathbf{s}}$, not merely a prediction score or a hidden-state representation (Bassotto et al., 2 Oct 2025).

2. Problem reformulation and non-modular principle

The defining conceptual move is to reinterpret modular wrap-around as outlier contamination. In the original MLWE relation, the attacker does not observe the integer quantity $\tilde b = As + e$, only its reduction modulo $q$. NoMod first applies a reduction-derived linear transform $R$, obtaining transformed samples $(RA, Rb)$, and then relies on the fact that many rows of $R_q = \mathbb{Z}_q[x]/(x^n+1)$0 can remain inside the principal interval so that modular reduction does not alter them (Bassotto et al., 2 Oct 2025).

Under that interpretation, transformed rows divide into two classes. Some behave approximately like ordinary linear equations over the integers, while others wrap and appear as large-residual corruptions. NoMod therefore casts secret recovery as robust linear regression on

$R_q = \mathbb{Z}_q[x]/(x^n+1)$1

This is the sense in which the method is “non-modular”: it does not attempt to learn or invert modular arithmetic row by row, but instead seeks a regime in which modularity is sparse enough to be handled statistically (Bassotto et al., 2 Oct 2025).

The paper’s appendix gives the statistical intuition for this approximation using rowwise means and variances of $R_q = \mathbb{Z}_q[x]/(x^n+1)$2, together with candidate lifts $R_q = \mathbb{Z}_q[x]/(x^n+1)$3 and an inlier probability expressed through an error-function term depending on $R_q = \mathbb{Z}_q[x]/(x^n+1)$4 (Bassotto et al., 2 Oct 2025). This suggests that the attack’s success depends on producing transformed rows with low spread, because lower $R_q = \mathbb{Z}_q[x]/(x^n+1)$5 implies a higher probability that the observed modular sample is already the correct integer representative.

3. Lattice preprocessing and sample amplification

The preprocessing stage begins by embedding MLWE into a structured LWE instance $R_q = \mathbb{Z}_q[x]/(x^n+1)$6, with $R_q = \mathbb{Z}_q[x]/(x^n+1)$7 in block-negacyclic form (Bassotto et al., 2 Oct 2025). NoMod then constructs an error-penalized dual embedding

$R_q = \mathbb{Z}_q[x]/(x^n+1)$8

where $R_q = \mathbb{Z}_q[x]/(x^n+1)$9 controls the reduction–noise trade-off (Bassotto et al., 2 Oct 2025). The reported settings are $b_i = a_i^T s + e_i \in R_q$0 for CBD errors and $b_i = a_i^T s + e_i \in R_q$1 for Gaussian errors with $b_i = a_i^T s + e_i \in R_q$2 (Bassotto et al., 2 Oct 2025).

Reduction is performed with four iterations of $b_i = a_i^T s + e_i \in R_q$3 at $b_i = a_i^T s + e_i \in R_q$4, followed by BKZ 2.0 with $b_i = a_i^T s + e_i \in R_q$5 and a progressive block-size schedule from 20 to 40, with polish between tours and block-size increases after stalled progress (Bassotto et al., 2 Oct 2025). The purpose is not merely to output one reduced basis, but to generate many short valid relations whose transformed coefficients make wrap-around less likely.

Two MLWE-specific refinements are central. First, NoMod uses polynomial-row subsamples and offsets to resample structured coefficient blocks before reduction. Second, it applies negative-circulant expansion: if a reduced vector is decomposed into $b_i = a_i^T s + e_i \in R_q$6-coefficient blocks, then synchronized rotations of those blocks generate up to $b_i = a_i^T s + e_i \in R_q$7 new vectors while preserving Euclidean norm and compatibility with the MLWE structure (Bassotto et al., 2 Oct 2025). The paper states that this amplifies the number of usable short vectors by roughly a factor $b_i = a_i^T s + e_i \in R_q$8 (Bassotto et al., 2 Oct 2025).

A further engineering device is reduced-vector saving. Instead of discarding intermediate short vectors and keeping only the current basis, NoMod stores the best unique vectors in a bounded priority queue, ranking them by the resulting approximate $b_i = a_i^T s + e_i \in R_q$9 (Bassotto et al., 2 Oct 2025). This is significant because the regression stage only needs many short transformed rows, not a single terminal reduced basis. A plausible implication is that NoMod’s preprocessing is optimized for downstream statistical estimation rather than for a traditional shortest-vector endpoint.

4. Robust regression and secret extraction

The estimation stage uses robust linear regression on transformed samples $A s + e \equiv b \pmod q$0, with the regression coefficients interpreted directly as the secret estimate $A s + e \equiv b \pmod q$1 (Bassotto et al., 2 Oct 2025). The method’s stated robust criterion is Tukey’s Biweight loss. The appendix gives the loss in bounded-influence form, saturating beyond threshold $A s + e \equiv b \pmod q$2, so that large residuals exert limited influence (Bassotto et al., 2 Oct 2025). This is precisely the behavior needed if wrapped samples are to be treated as outliers rather than explicitly unwrapped.

The paper does not specify a detailed optimizer for the robust regression stage; it states the loss family and the role it plays, but does not provide a step-by-step fitting algorithm such as IRLS or gradient-descent hyperparameters (Bassotto et al., 2 Oct 2025). What is explicit is the postprocessing sequence: extract $A s + e \equiv b \pmod q$3, normalize it with respect to the expected secret distribution, round and clip to the known support, and then verify on the original residuals

$A s + e \equiv b \pmod q$4

If the residuals match the original error law, the candidate is accepted; otherwise, training continues on additional subsets (Bassotto et al., 2 Oct 2025).

This same framework is used for binary secrets, sparse ternary or sparse secrets, and sparse binomial/CBD-type secrets, with the difference appearing in the normalization and clipping stage rather than in a fundamentally different estimator (Bassotto et al., 2 Oct 2025). The paper also provides a sample-count heuristic,

$A s + e \equiv b \pmod q$5

as a guide to how many samples per matrix should be used under a given reduction quality $A s + e \equiv b \pmod q$6 (Bassotto et al., 2 Oct 2025).

5. Reported performance and benchmark results

The headline empirical claims are threefold: full recovery of binary secrets for dimension $A s + e \equiv b \pmod q$7, recovery of sparse binomial secrets for $A s + e \equiv b \pmod q$8, and successful recovery of sparse secrets in CRYSTALS-Kyber settings with parameters $A s + e \equiv b \pmod q$9 and $q$0 (Bassotto et al., 2 Oct 2025). These results are reported on 16 AMD EPYC 7702P CPUs with progressive BKZ-based preprocessing (Bassotto et al., 2 Oct 2025).

The paper also compares NoMod to prior ML-assisted attacks such as SALSA, PICANTE, and VERDE (Bassotto et al., 2 Oct 2025). In the binary-secret comparison against PICANTE, NoMod reports full dense recovery at $q$1 with $q$2 in 17.5 hours, whereas the cited PICANTE baseline is reported at $q$3 with approximately 307 hours; at $q$4, NoMod reports $q$5 in 40.3 hours versus PICANTE’s $q$6 (Bassotto et al., 2 Oct 2025). Against SALSA-style benchmarks, the paper reports substantially larger recoverable Hamming weights at the tested settings (Bassotto et al., 2 Oct 2025).

For MLWE and Kyber-like regimes, the recovery claims are more limited. The paper reports sparse recovery rather than full dense-secret recovery in those settings, with examples including $q$7 at $q$8, $q$9 at $\hat{\mathbf{s}}$0, and $\hat{\mathbf{s}}$1 at $\hat{\mathbf{s}}$2 in the main MLWE table (Bassotto et al., 2 Oct 2025). It also states that NoMod can outperform classical uSVP in some tested regimes and can outperform a meet-in-the-middle baseline at $\hat{\mathbf{s}}$3, while not matching the strongest modern attacks such as FRESCA or Cool-and-Cruel on larger standardized benchmarks (Bassotto et al., 2 Oct 2025).

This supports a nuanced reading. NoMod is not presented as a blanket break of standardized Kyber deployments. Rather, it is presented as evidence that robust-regression-based, non-modular ML cryptanalysis can be competitive and, in some synthetic or reduced regimes, significantly stronger than prior transformer-based pipelines (Bassotto et al., 2 Oct 2025).

6. Interpretation, limitations, and relation to adjacent meanings of “NoMod”

NoMod’s significance lies in widening the design space of ML-assisted cryptanalysis. Prior lines such as SALSA, PICANTE, and VERDE use transformers or modularity-aware learning pipelines to internalize the structure of reduction modulo $\hat{\mathbf{s}}$4. NoMod instead shows that one can combine lattice reduction with white-box robust regression and avoid modeling modularity explicitly (Bassotto et al., 2 Oct 2025). This suggests that the key difficulty may sometimes be reduced from “learn the modular law” to “increase the inlier fraction enough for robust estimation.”

The method nonetheless has clear limits. Its success depends strongly on modulus, dimension, secret distribution, and achievable reduction quality; it still requires substantial preprocessing; and its strongest MLWE results are sparse-secret recoveries in Kyber-like settings rather than full dense recovery of standardized parameters (Bassotto et al., 2 Oct 2025). The paper also notes that some benchmark runs did not reach the maximum BKZ block size because of time constraints, and that stronger attacks remain ahead in some real-world settings (Bassotto et al., 2 Oct 2025).

A possible source of confusion is the phrase “NoMod ML-Attack” itself. In other ML-security contexts, “NoMod” can plausibly be read as “no-model-modification” or “no-modality-specific” attack. In this topic, however, the term refers specifically to a non-modular attack on Module Learning With Errors, and the “ML” in the title denotes Module Learning rather than machine learning as the defended target (Bassotto et al., 2 Oct 2025). The method does use machine learning, but only as part of the attack pipeline.

In that precise sense, NoMod is a cryptanalytic technique at the intersection of lattice reduction and robust statistics. Its encyclopedic importance derives less from immediate practical breaks of deployed post-quantum cryptosystems than from the methodological claim it substantiates: modular reduction in MLWE need not always be learned directly if lattice preprocessing can turn most of the problem into robust linear estimation (Bassotto et al., 2 Oct 2025).