Pseudo-Random Number Generation using

Generative Adversarial Networks

Marcello De Bernardi1 , MHR Khouzani1 , and Pasquale Malacaria1

Queen Mary University of London, E1 4NS, UK

[email protected], {arman.khouzani,p.malacaria}@qmul.ac.uk
arXiv:1810.00378v1 [cs.LG] 30 Sep 2018

Abstract. Pseudo-random number generators (PRNG) are a funda-

mental element of many security algorithms. We introduce a novel ap-
proach to their implementation, by proposing the use of generative adver-
sarial networks (GAN) to train a neural network to behave as a PRNG.
Furthermore, we showcase a number of interesting modifications to the
standard GAN architecture. The most significant is partially concealing
the output of the GAN’s generator, and training the adversary to dis-
cover a mapping from the overt part to the concealed part. The generator
therefore learns to produce values the adversary cannot predict, rather
than to approximate an explicit reference distribution. We demonstrate
that a GAN can effectively train even a small feed-forward fully con-
nected neural network to produce pseudo-random number sequences with
good statistical properties. At best, subjected to the NIST test suite, the
trained generator passed around 99% of test instances and 98% of overall
tests, outperforming a number of standard non-cryptographic PRNGs.

Keywords: adversarial neural networks · pseudo-random number gen-

erators · neural cryptography

1 Introduction

A pseudo-random number generator (PRNG) is a deterministic algorithm with a

secret internal state Si [7, p. 2], which processes a random input seed s to produce
a large number sequence that may not tractably be distinguished by statistical
means from a truly random sequence [9, p. 170]. PRNGs are a fundamental
element of many security applications [7, p. 1] [9, p. 169], where they are often
a single point of failure, making their implementation a critical aspect of the
overall design [7, p. 2].

Aims and Motivations The aim of this research is to determine whether

a machine learning structure can learn to output sequences of numbers which
appear randomly generated, and whether such a structure could be used as
a PRNG in a security context. We confine this investigation to the statistical
characteristics of a PRNG’s output; cryptanalysis of the implementation, also
necessary in order for a PRNG to be considered secure [7,10], is beyond the
2 M. De Bernardi et al.

scope of this work. A statistically ideal PRNG is one that passes the theoretical
next bit test [9, p. 171].
The research is inspired by Abadi and Andersen’s work on neural network
learning of encryption schemes [1], conjecturing that a neural network can rep-
resent a good pseudo-random generator function, and that discovering such a
function by stochastic gradient descent is tractable. Motivation is also drawn
from the needs of security: a hypothetical neural-network-based PRNG has sev-
eral potentially desirable properties. This includes the ability to perform ad-hoc
modifications to the generator by means of further training, which could consti-
tute the basis of strategies for dealing with the kind of non-statistical attacks
described by Kelsey et al. in [7].

Related Work Few attempts have been made to produce pseudo-random num-
ber sequences with neural networks [2,3,11,5]. The most successful approaches
have been presented by Tirdad and Sadeghian [11], and by Jeong et al. [5]. The
former employed Hopfield neural networks adapted so as to prevent convergence
and encourage chaotic behavior, while the latter used an LSTM trained on a
sample of random data to obtain indices into the digits of pi. Both papers re-
ported a strong performance in statistical randomness tests. However, neither
scheme sought to train an “end-to-end” neural network PRNG, instead using
the networks as components of more complex algorithms.
We undertake the task differently, by applying a deep learning method known
as generative adversarial networks [4] to train an end-to-end neural PRNG which
outputs pseudo-random sequences directly. We present two conceptually simple
architectures, and evaluate their strength as PRNGs using the NIST test suite
[10].

Contributions This work makes a number of novel contributions to the field

by proposing several modifications to the GAN framework. In summary, we
introduce a simplification to the GAN framework that is applicable to this task,
whereby the GAN does not include a reference dataset which the generator
should learn to imitate. Furthermore, we also model the statefulness of a PRNG
using a feed-forward neural network with supplementary non-random “counter”
inputs, rather than a recurrent network.
The overall product of these modifications is a system that is simple, con-
ceptually elegant, and robust. We find that the trained generator can repeatedly
pass approximately 98% of NIST tests on default settings, showing that the
adversarial approach is highly successful at training a neural network to be-
have as a PRNG. Our results are approximately on par with those of Tirdad
and Sadeghian [11] and Jeong et al. [5], and outperform a number of standard
PRNGs [5]. Especially for a preliminary implementation, this outcome makes a
strong case for further investigation.
Pseudo-Random Number Generation using Generative Adversarial Networks 3

2 Design and Implementation

Let B be the set of all unsigned integers representable with 16 bits. For conve-
nience we constrain the inputs and outputs of our networks to this range. We
then view a pseudo-random number generator as any system implementing a
function
prng(s) : B → Bn (1)
where s is a random seed, n is very large, and the outputs of prng fulfill some
criteria for randomness. For individual outputs, we can also characterize a PRNG
as a function
prng O (s, Si ) : X → B (2)
where Si is the current internal state of the generator, and X is the set of all
tuples (s, Si ).
A generator neural network should represent a function G(s) which approxi-
mates prng(s). To simplify the design and training, we use a feed-forward (state-
less) neural network, and model the PRNG’s internal state Si as an additional
t-dimensional input ot instead (figure 1). Thus the neural network actually rep-
resents a function
GO (s, ot ) : Bt+1 → Bn (3)
which approximates prng O (s, Si ), where n is the network’s output dimensional-
ity. We can view ot as an “offset” into the full output sequence for s: for any fixed
specific s, the complete pseudo-random sequence G(s) is given by concatenating
the generator’s output sequences ∀ot GO (s, ot ). It follows that we have

|G(s)| ∈ Θ(nt ) (4)

for the length of the full sequence G(s).

Fig. 1. Conceptual view of a PRNG (left) and our neural implementation (right).

Adversarial Framework A PRNG should minimize the probability of an ad-

versary correctly guessing future outputs from past ones. This is analogous to a
GAN, where the generator minimizes the probability of the discriminator accu-
rately mapping its outputs to a class label [4]. Thus we consider the generation
of pseudo-random numbers as an adversarial task and formulate it using a GAN.
We consider two distinct high-level architectures, termed the discriminative and
the predictive architectures (figure 2).
4 M. De Bernardi et al.

In the standard discriminative approach, the discriminator’s inputs are num-

ber sequences drawn either from the generator or from a common source of
randomness, and labeled accordingly. In order to minimize the probability of
correct classification, the generator learns to mimic the distribution of the ran-
dom sequences.
In the predictive approach, loosely based on the theoretical next bit test,
each sequence of length n produced by the generator is split; the first n − 1
values are the input to the predictor, and the nth value is the corresponding
label. The predictor maximizes the probability of correctly predicting the nth
value from the other values, while the generator minimizes it. Thus the pseudo-
randomness of the generator’s output is formulated as unpredictability by an
improving opponent.

Fig. 2. The discriminative approach (left) requires an external source of randomness

which it attempts to imitate, while the predictive approach (right) has no external
inputs.

Generative Model The generator is a fully connected feed-forward (FCFF)

neural network representing the function

GO (s, o1 ) : B2 → B8 . (5)

Its input is a vector consisting of a seed s and a non-random scalar o1 representing

the PRNG state. It is implemented as four hidden FCFF layers of 30 units, and
an output FCFF layer of 8 units (figure 3). The input layer and the hidden
layers use the leaky ReLU activation function. The output layer applies mod as
an activation function, mapping values into a desired range while avoiding some
of the pitfalls of sigmoid and tanh [6, Neural Networks Part 1: Setting up the
Architecture].

Discriminative Model The discriminator (figure 4) is convolutional neural

network implementing the function

D(r) : B8 → [0, 1] (6)

where r is a vector of length 8, either produced by the generator or drawn from a

standard source of pseudo-randomness and associated with corresponding class
Pseudo-Random Number Generation using Generative Adversarial Networks 5

Fig. 3. Architecture of the generator: FCFF layers with leaky ReLU and mod activa-
tions

Fig. 4. Convolutional discriminator architecture. The output of the generator is con-

volved multiple times in order to extract higher-level features from the sequence; this
is followed by pooling to reduce the output size, and FCFF layers to produce the final
classification output.

labels. The discriminator outputs a scalar p(true) in the range [0, 1] representing
the probability that the sequence belongs to either class.
The discriminator consists of four stacked convolutional layers, each with 4
filters, kernel size 2, and stride 1, followed by a max pooling layer and two FCFF
layers with 4 and 1 units, respectively. The stack of convolutional layers allow
the network to discover complex patterns in the input.

Predictive Model The predictor is a convolutional neural network implement-

ing the function

P (rsplit ) : B7 → B (7)

where rsplit is the generator’s output vector with the last element removed.
The last element is used as the corresponding label for the predictor’s input.
Apart from the input size and meaning of the output, the discriminator and the
predictor share the same architecture.

Loss Functions and Optimizer We use standard loss functions. In the dis-
criminative case, the generator and discriminator both have least squares loss. In
the predictive case, the generator and the predictor both have absolute difference
loss. We use the popular Adam stochastic gradient descent optimizer [8].
6 M. De Bernardi et al.

3 Experiments
We measure the extent to which training the GANs improves the randomness
properties of the generators by analyzing large quantities of outputs, produced
for a single seed, using the NIST statistical test suite both before and after train-
ing.

– Independent variable: whether the GAN has been trained or not.

– Dependent variable: the result of the NIST tests.
– Controlled variables: the random seed, the non-random generator inputs,
the architecture of the networks, and all training parameters such as num-
ber of epochs, learning rate, and mini-batch size, are fixed throughout the
experiment.

Experimental Procedure We initialize the predefined evaluation dataset

Data first. It consists of input vectors vi ∈ B2 of the form [s, o1i ], such that
the random seed s in vi is fixed to the same arbitrary value for all i and all ex-
periments. The offset o1i in vi starts at 0 for v0 and increments sequentially for
the following vectors. For example, assuming arbitrarily that s = 10, we would
have  
Data = [10, 0], [10, 1], [10, 2], ... (8)
We use the untrained generator to generate floating-point output vectors
for all vectors in Data. These values are rounded to the nearest integer. If the
outputs are uniformly distributed over a range [a, b] where a, b ∈ R+ , then they
will also be uniformly distributed over the range [a, b] where a, b ∈ Z+ . The
integers produced are stored in an ASCII text file in binary format.
We then train the networks, with the generator and the adversary performing
gradient updates in turn as is standard with GANs. The trained generator is used
to produce another text file of output integers. The NIST test suite is executed
on the files, enabling the evaluation of the generator’s performance before and
after training. For both the discriminative and predictive approaches, we carry
out the procedure 10 times.

Training parameters In each experiment we train the GAN for 200,000 epochs
over mini-batches of 2,048 samples, with the generator performing one gradient
update per mini-batch and the adversary performing three. We set the learning
rate of the networks to 0.02. The generator outputs floating-point numbers con-
strained to the range [0, 216 − 1], which are rounded to the nearest 16-bit integer
for evaluation. The evaluation dataset consists of 400 mini-batches of 2,048 in-
put vectors each, for a total of 819,200 input samples. The generator outputs 8
floating-point numbers for each input, each yielding 16 bits for the full output
sequence. In total, each evaluation output thus consists of 104,857,600 bits, pro-
duced from a single random seed. Larger outputs were not produced due to disk
quotas on the cluster used to run the models.
Pseudo-Random Number Generation using Generative Adversarial Networks 7

NIST testing procedure The NIST test suite is applied with default set-
tings. The test suite consists of 188 distinct tests, each repeated 10 times, with
1,000,000 input bits consumed for each repetition. Each repetition will be re-
ferred to as a test instance. For every test, NIST reports the number of individual
instances that passed, the p-value of all individual instances, as well as a p-value
for the distribution of the instance p-values. A test instance fails if its p-value
is below a critical value (α = 0.01). An overall test fails if either the number of
passed instances is below a threshold, or the p-value for the distribution of test
instance p-values is below a critical value.

Results Table 1 shows the average performance across experiments, before and
after training, for both GAN approaches. Table 2 shows the average improvement
across all experiments for both approaches. Figures 5 and 6 display the loss
functions during the a discriminative training run and a predictive training run.

Table 1. NIST test suite results for the generators, before and after training. Di and Pi
refer to discriminative and predictive experiments, respectively. T is the overall number
of distinct tests carried out by NIST STS, and TI is the number of total test instances.
FI and FI% are the number of failed test instances and the percentage of failed test
instances. Fp is the number of distinct tests failed due to an abnormal distribution of
the test instance p-values. FT and F% refer to the absolute number and percentage of
distinct tests failed.

i T hTI i hFI i hFI% i/% hFp i hFT i hF% i/%

Dbef ore 188 1800 1796 99.8 188 188 100.0
Daf ter 188 1800 61 3.5 4.3 6.9 3.9
Pbef ore 188 1800 1798 99.9 188 188 100.0
Paf ter 188 1830 56 3.0 2.7 4.5 2.5

Table 2. Performance change from before training to after training for the discrimi-
native and predictive approaches across all tests.

i h∆FI% i/% h∆Fp i h∆FT i h∆F% i/%

D -96.2 -183.7 -180.1 -96.1
P -96.7 -185.3 -183.6 -97.5
8 M. De Bernardi et al.

Training Loss, Discriminative Experiment 9

Fig. 5. Training loss of the discriminative model. The discriminator has a tendency
to gradually improve its performance while the generator plateaus. Occasionally the
learning destabilizes and the discriminator’s loss increases by a large factor.

Training Loss, Predictive Experiment 9

Fig. 6. A plot of the training loss during training of the predictive model. The predictor
and generator converge in the initial phase of training.
Pseudo-Random Number Generation using Generative Adversarial Networks 9

Evaluation Prior to training, the generators pass no statistical tests. After

training the performance of the generators is consistently very strong for both
approaches. The evaluated number sequences achieved a failure rate well below
5% in the majority of experiments, with an absolute change in failure percentage
as a result of training greater than 95% in most cases. This on par with the results
obtained by Tirdad and Sadeghian, whose best pass rate was around 98% [11].
According to the data collected by Jeong et al., this also outperforms a number
of standard non-cryptographic PRNGs. The difference in entropy of the output
before training and after training is visualized in figure 7.
The training loss plots are unusual. In the discriminative case (figure 5) we ob-
serve long periods of steady convergence, with short bursts of instability caused
perhaps by the generator discovering a noticeably different pseudo-random func-
tion. The predictive case (figure 6) is characterized by very fast convergence
during the first epochs, followed by long-term stability. An explanation could be
a state of balanced learning, where both networks are improving together at a
similar pace, maintaining their relative performance.
The predictive approach shows better results, with the generators producing
approximately 60% of the number of failures produced by the discriminatively
trained generator. Moreover, we observed that training steps for the predictive
GAN executed in about half the time.

Output Sample, Before and After Predictive Training

Fig. 7. Visualization of the generator output as produced in the 9th predictive training
instance, before (left half) and after (right half) training. The 200x200 grid shows the
first 40,000 bits in the generator’s sample output. Obvious patterns are visible before
training, but not after.
10 M. De Bernardi et al.

4 Conclusion and Further Investigation

The aim of this investigation was to determine whether a deep neural network can
be trained to generate pseudo-random sequences, motivated by the observation
that GANs resemble the roles of a PRNG and an adversary in a security context.
We explore a novel approach, presenting two GAN models designed for this task.
The design includes several innovative modifications applicable to this task.
In particular, the predictive model waives the need for a reference distribution
by making the desired distribution implicit in the adversarial game. Moreover,
we forgo the use of recurrent architectures in favor of a feed-forward architecture
with non-random “counter” inputs.
We show that the adversarial approach is highly successful at training the
generator. Training improved its performance significantly, resulting at best in
passing around 99% of test instances and 98% of unique tests. To our knowledge,
this is the first example of a neural net learning a PRNG function end-to-end.
We encourage further work to take a systematic approach to model selection
and hyper-parameter optimization, and to investigate the learning process.

References
1. Abadi, M., Andersen, D.G.: Learning to protect communications with adversarial
neural cryptography. arXiv preprint arXiv:1610.06918 (2016)
2. Desai, V., Deshmukh, V., Rao, D.: Pseudo random number generator using el-
man neural network. In: Recent Advances in Intelligent Computational Systems
(RAICS), 2011 IEEE. pp. 251–254. IEEE (2011)
3. Desai, V., Patil, R.T., Deshmukh, V., Rao, D.: Pseudo random number generator
using time delay neural network. World 2(10), 165–169 (2012)
4. Goodfellow, I., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair,
S., Courville, A., Bengio, Y.: Generative adversarial nets. In: Advances in neural
information processing systems. pp. 2672–2680 (2014)
5. Jeong, Y.S., Oh, K., Cho, C.K., Choi, H.J.: Pseudo random number generation us-
ing lstms and irrational numbers. In: Big Data and Smart Computing (BigComp),
2018 IEEE International Conference on. pp. 541–544. IEEE (2018)
6. Karpathy, A.: Lecture notes for cs231n convolutional neural networks for visual
recognition (2017)
7. Kelsey, J., Schneier, B., Wagner, D., Hall, C.: Cryptanalytic attacks on pseudo-
random number generators. In: Fast Software Encryption. pp. 168–188. Springer
(1998)
8. Kingma, D.P., Ba, J.: Adam: A method for stochastic optimization. arXiv preprint
arXiv:1412.6980 (2014)
9. Menezes, A.J., Van Oorschot, P.C., Vanstone, S.A.: Handbook of applied cryptog-
raphy. CRC press (1996)
10. Rukhin, A., Soto, J., Nechvatal, J., Smid, M., Barker, E.: A statistical test suite
for random and pseudorandom number generators for cryptographic applications.
Tech. rep., Booz-Allen and Hamilton Inc Mclean Va (2001)
11. Tirdad, K., Sadeghian, A.: Hopfield neural networks as pseudo random number gen-
erators. In: Fuzzy Information Processing Society (NAFIPS), 2010 Annual Meeting
of the North American. pp. 1–6. IEEE (2010)