  Learning with Errors (LWE) is a hard math problem underpinning many proposed
post-quantum cryptographic (PQC) systems. The only PQC Key Exchange Mechanism
(KEM) standardized by NIST is based on module~LWE, and current publicly
available PQ Homomorphic Encryption (HE) libraries are based on ring LWE. The
security of LWE-based PQ cryptosystems is critical, but certain implementation
choices could weaken them. One such choice is sparse binary secrets, desirable
for PQ HE schemes for efficiency reasons. Prior work, SALSA, demonstrated a
machine learning-based attack on LWE with sparse binary secrets in small
dimensions ($n \le 128$) and low Hamming weights ($h \le 4$). However, this
attack assumes access to millions of eavesdropped LWE samples and fails at
higher Hamming weights or dimensions.
  We present PICANTE, an enhanced machine learning attack on LWE with sparse
binary secrets, which recovers secrets in much larger dimensions (up to
$n=350$) and with larger Hamming weights (roughly $n/10$, and up to $h=60$ for
$n=350$). We achieve this dramatic improvement via a novel preprocessing step,
which allows us to generate training data from a linear number of eavesdropped
LWE samples ($4n$) and changes the distribution of the data to improve
transformer training. We also improve the secret recovery methods of SALSA and
introduce a novel cross-attention recovery mechanism allowing us to read off
the secret directly from the trained models. While PICANTE does not threaten
NIST's proposed LWE standards, it demonstrates significant improvement over
SALSA and could scale further, highlighting the need for future investigation
into machine learning attacks on LWE with sparse binary secrets.
