Predictably Guessable

1. Introduction

A companion study tested whether telling a respondent to "pick a color nobody else would say" actually produces less predictable answers than a plain, unconstrained ask. It does not: the instruction relocates the point of convergence rather than removing it. That raises an obvious follow-up with real stakes attached. "Name a color" has no wrong answer; "choose a secure PIN" does, and getting it wrong is exactly the failure mode that lets an attacker empty a stolen wallet. If the same relocate-rather-than-flatten pattern holds for a task with an objectively correct answer, that's no longer just a curiosity about cognition — it's a direct test of whether "just ask for something secure" is a workable control, or the false comfort NIST's blocklist mandate exists to correct.

Bonneau, Preibusch, and Anderson (2012) gave the first published estimate of how guessable a human-chosen banking PIN really is, and an independent analysis of 3.4 million leaked PINs (DataGenetics, 2012) put a stark number on it: roughly one in ten was "1234." This paper asks the same question one layer removed — does a language model, role-playing the same choice, reproduce the human failure, and does an explicit security instruction help? A very recent, directly relevant data point arrived while this study was in progress: Irregular's analysis of frontier models generating passwords (Kálmán, 2026) found Claude Opus 4.6, asked to "generate a password" fifty times, returned only thirty unique strings — one exact 16-character password eighteen times. Whatever is happening with PINs here is not an isolated quirk of one small model.

2. Literature Review

2.1 How guessable are real human PINs?

Bonneau, Preibusch, and Anderson's (2012) A birthday present every eleven wallets? combined regression analysis of 4-digit sequences chosen outside banking with a survey of over 1,100 banking customers. Its title refers to the headline result: guessing a stolen wallet's PIN from the victim's birthdate — which the wallet typically also contains — succeeds often enough that a thief nets a working card once every eleven to eighteen stolen wallets, depending on whether the bank blocks a short list of weak PINs.

A widely cited independent analysis (DataGenetics, 2012) of 3.4 million leaked 4-digit codes found "1234" alone at roughly 11%, "1111" at 6%, and "0000" at 2% — three guesses opening roughly one PIN in five — with a strong secondary concentration on PINs starting "19–", consistent with widespread birth-year use.

2.2 The policy response: blocklisting, not willpower

NIST Special Publication 800-63B directly encodes this lesson: verifiers SHALL compare a new memorized secret against a blocklist of commonly used, expected, or compromised values — rather than relying on complexity rules or user judgment. It's a practical acknowledgment that asking someone to "just pick something secure" isn't sufficient on its own; it has to be checked, not trusted.

2.3 Why "looking random" isn't the same as being random

Wagenaar's (1972) review of human random-sequence generation applies directly here: people asked to produce something "random" don't sample uniformly — they produce a sequence matching their mental model of what randomness looks like (no obvious repeats, no runs, no visible pattern). A PIN like "8192" has no repeated or sequential digits and doesn't resemble a date — it looks like a good, unguessable choice by exactly those surface heuristics, whether or not it's actually rare among the outputs of whatever process produced it.

2.4 The companion study: relocation, not reduction

Using the same platform and model, the companion color study found that an adversarial "pick one nobody else would say" instruction didn't reduce predictability relative to baseline (0.316 vs. 0.306) — it relocated convergence from one common default ("blue," 27.1%) to another ("caput mortuum," 24.4%), read through Schelling's (1960) focal-point framework: avoiding "the obvious answer" requires first identifying it, which routes through the same shared salience that made it obvious. This study asks whether that same pattern holds when the adversarial instruction has an objectively correct target (actual unguessability) instead of an arbitrary social one.

2.5 LLMs generating credentials: a very direct precedent

While this study was underway, Irregular published an analysis (Kálmán, 2026) testing password generation across Claude Opus 4.6, GPT-5.2, Gemini 3, and Nano Banana Pro: fifty independent prompts to Claude Opus 4.6 returned only thirty unique passwords, one exact string appearing eighteen times. Estimated entropy collapsed from ~98 bits to ~27. The pattern held across every tested model and even coding agents that preferred model-generated passwords over calling a real cryptographic RNG.

3. Research Questions and Hypotheses

• RQ1Does an unconstrained "first PIN that comes to mind" prompt reproduce the qualitative shape of real human PIN choice?
• RQ2Does an explicit "resistant to guessing" instruction reduce concentration relative to baseline, or relocate it — and by what mechanism?
• RQ3How does the model's concentration magnitude compare to the published human benchmark?

Working hypothesis: the adversarial instruction would not reduce predictability, consistent with the companion study's relocate-not-reduce pattern — but where it relocated to would differ, since "hard to guess" selects for the representativeness heuristic (favor whatever looks unpatterned) rather than for social uniqueness.

4. Method

The same platform and design from the companion study was reused unmodified: independent, stateless calls to Meta Llama 3.2 11B Vision-Instruct via NVIDIA NIM (temperature 1.0), a random persona × mood per simulated respondent (420 combinations), five parallel rate-limited API credentials. Baseline prompt: "Imagine you're setting up a new 4-digit PIN for a bank card. What's the first PIN that comes to mind?" Adversarial: "Pick a 4-digit PIN you're confident would be very hard for someone else to guess."

Unlike color naming, a 4-digit PIN has exactly 10,000 possible values — a mathematical fact, not an estimate — which supports a cleaner significance test than the fuzzier color-name answer space allowed.

A format-compliance problem, and what it revealed

A 20-respondent pilot found roughly half of baseline responses weren't 4-digit numbers at all — the model free-associated a themed word ("cheese," "surf," "stoked") instead. Adding an explicit format constraint ("exactly 4 digits … digits only, no words, no letters") fixed it: the next 40 calls came back 40/40 valid, and the full 1,000-call run reached 96.0% valid in baseline, 99.2% in adversarial. A related extraction issue also surfaced: some responses embedded the PIN with no separator at all ("2120RUN"), which a word-boundary regex can't catch since a digit directly followed by a letter isn't a boundary. Fixed by extracting the first maximal digit-run of length exactly four.

Statistics

Entropy and the predictability index were computed as in the companion study. The chi-square test used there is not reliable here: with 353 and 246 unique answers from only 480/496 responses, average expected count per cell is under 2 — well below the reliability threshold — and it returns a misleadingly non-significant result for baseline (nominal p = .97) despite extreme underlying concentration. Significance is instead assessed with a Poisson-tail test: under the null that all 10,000 PINs are equally likely, expected count per PIN across n draws is n/10,000, and the log-probability of k+ hits is computed directly in log-space.

5. Results

5.1 Baseline condition

480/500 responses (96.0%) were valid, spanning 353 unique values. "1234" alone: 15 hits (3.0%) — Poisson-tail P ≈ 10⁻³². Four of the next four most common answers are year-like (1984, 2020, 1985, 1987), echoing Bonneau et al.'s real finding on birth years.

5.2 Adversarial condition

496/500 (99.2%) valid, spanning only 246 unique values — fewer than baseline, despite the instruction to be unpredictable. Top answer "8192": 22 hits (4.4%, P ≈ 10⁻⁵⁰). The next four — 8421, 8213, 8542, 8312 — all fall in the 8000s, with no connection to dates or repeated digits. 8192 is a recognizable computing constant (2¹³), consistent with the model reaching for something that reads as technically arbitrary.

"1234" was not eliminated by the adversarial instruction — it appeared once even under an explicit request for something "very hard to guess." "1987" also persisted (7 occurrences): the year-pattern attractor survived, in reduced form, alongside the new 8000s cluster.

5.3 Comparison between conditions

Contrary to the companion color study, where adversarial was only marginally more concentrated, here it's more than twice as concentrated by the predictability index, despite spanning fewer unique values. Being told to avoid the obvious didn't just fail to help — it made the output measurably worse.

5.4 Comparison to the published human benchmark

The model's output reproduces the rank order of the three best-documented human preferences (1234 > 1111 > 0000) but at roughly a third to a fifth of the reported human magnitude, and never produced "0000" at all across 500 draws. Because every direct comparison falls below the human benchmark, this study's numbers likely understate, not overstate, the real-world severity of the phenomenon.

6. Discussion

RQ1: yes, with a qualification — the model's unconstrained choices echo the real human pattern qualitatively (same top value, same year-like secondary cluster) but fall well short of it quantitatively. RQ2's answer is more concerning than the color study's: the adversarial instruction didn't just fail to reduce predictability, it increased it. RQ3's answer — consistent understatement of severity — is the most policy-relevant finding here: a system judging its own credential generation "safe" because a model's failure rate looks smaller than the documented human one would be measuring the wrong thing.

The mechanism is the same representativeness logic Wagenaar (1972) documented in humans, applied to a model instead: asked for something "hard to guess," the system doesn't sample a genuinely rare value from its own distribution — it produces whatever looks unpatterned by surface heuristics, and "8192" satisfies that description without being remotely rare in the model's actual output, as the Poisson-tail values demonstrate. This directly reinforces the premise behind NIST's blocklist requirement: unguessability can't be delegated to an instruction, given to a person or a model, without independent verification against a known-weak-value list.

7. Limitations

8. Conclusion and Future Directions

Both conditions produced PIN distributions overwhelmingly inconsistent with chance, and — the more consequential finding — explicitly instructing for a hard-to-guess PIN made output more predictable, not less, clustering on a different but equally systematic "looks-random" set. The model's baseline echoes real human PIN patterns while consistently understating their severity, meaning these numbers are best read as a conservative lower bound.

Three directions follow: (1) extend to full alphanumeric passwords, comparing against Kálmán's (2026) frontier-model results; (2) run the identical design with real human participants against the same exact 10,000-value baseline; (3) test whether showing a respondent the actual published concentration statistics before asking for a "secure" PIN changes behavior, or just becomes another shared anchor to converge on.