How does Kerckhoffs's principle apply to Adversarial Neural Cryptography? Martın Abadi and David G. Andersen recently published a paper on arxiv titled: "LEARNING TO PROTECT COMMUNICATIONS WITH ADVERSARIAL NEURAL CRYPTOGRAPHY" (https://arxiv.org/pdf/1610.06918v1.pdf).

I was wondering why Eve neural network $E$ does not get as input the learned parameters $\theta_A$ and $\theta_B$?

If really $K$ is supposed to be the only value that comprises the symmetric key, then in order to adhere to Kerckhoff's principle, one should view the training output (namely, the final values for $\theta_A$ and $\theta_B$) as public information. So, upon "alternating" the training phase to $E$, I supposed $E$ should receive as input $\theta_A$ and $\theta_B$ as well as $C$.

An alternative view would be that the training phase is regarded as a key generation algorithm. In such a view, the only challenge remaining is to really make training very efficient. But I do not think that this view was the intention of the authors because they explicitly contrasted their work to prior work that aims at generating cryptographic keys.

So my initial question still holds. Why is Kerckhoffs's principle (https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle) apparently totally overlooked in this notion of neural cryptography? What am I getting wrong?
If I'm interpreting section 2.2 correctly, the "optimal Eve" $O_E(\theta_A) = argmin_{\theta_E}(L_E(\theta_A, \theta_E))$ is actually allowed to see Alice's parameters $\theta_A$.  The training of Alice and Bob is, in plainer (and rougher!) terms, trying to solve this question: what are the best choices of $\theta_A$ and $\theta_B$ such that if:


We reveal $\theta_A$ and $C = A(\theta_A, P, K)$ to Eve but neither $P$ nor $K$;
We reveal $\theta_B$, $C$ and $K$ to Bob, but not $P$;


...then Eve's ability to infer information about $P$ is minimized but Bob's is maximized?

So I don't think there's a Kerkhoff's principle problem here.  My concern, actually, isn't that Eve knows too little about Alice and Bob, but rather whether Alice and Bob might know too much about their adversary Eve.  If we unwind the definition of the "optimal Alice and Bob" $(O_A, O_B) = argmin_{(\theta_A, \theta_B)}(L_{AB}(\theta_A, \theta_B))$ we find that it refers, indirectly through the definition of $L_{AB}$, to the definition of the "optimal Eve" $O_E(\theta_A)$.  If we chase this down in turn, we find that this definition indirectly refers to the function $E(\theta_E, C)$—the function that, given a choice of parameters $\theta_E$ for Eve, produces her guess $P_{Eve}$ of the plaintext that corresponds to the ciphertext $C$.

So Alice and Bob are allowed to know what function $E$ is.  I think cryptographers would want $E$ to be a universal Turing machine and allow $\theta_E$ to be any polynomial-time program, but it sure sounds like the paper's Eve only considers a subset of that, and that Alice and Bob know which subset that is.  So, in simpler language, I fear that Alice and Bob may know too much about "how Eve thinks" (the membership of the narrow set of functions that Eve can compute).