Practical seed recovery for the PCG pseudo-random number generator (tosc.iacr.org)

Researchers published a practical seed-recovery attack against the popular Permuted Congruential Generator (PCG), a fast non-cryptographic PRNG used by default in NumPy. The attack reconstructs PCG’s hidden parameters and successive internal states from 512 bytes of output, enabling prediction of future outputs and full seed recovery; the authors implemented the reconstruction and report worst-case runtimes around 20,000 CPU hours. Although PCG was never marketed as cryptographically secure, its designer claimed output prediction would be “challenging”—this paper shows it is feasible in practice. Technically, the break combines symmetric crypto-style guess-and-determine heuristics with lattice-based tools: the expensive core solves roughly 2^52 instances of the Closest Vector Problem (CVP) on very small Euclidean lattices arising from the truncated congruential structure of PCG. The attack exploits output truncation and the permutation layer to translate leaked bits into lattice problems that yield the missing state bits. For the AI/ML community this matters because NumPy’s RNG is widely used in model initialization, data shuffling, randomized algorithms and experimentation pipelines; in adversarial scenarios an attacker could reproduce or manipulate randomness (e.g., for poisoning, repeatable attacks, or leaking information). The paper reinforces that non-cryptographic generators should not be used where adversaries can observe outputs or influence runs, and suggests choosing cryptographically secure RNGs for threat-sensitive contexts.