Extracting CNNs in the Unknown-Architecture and Feedback-Agnostic Setting
Researchers show black-box attacks can recover a CNN's unknown architecture and its parameters.
The paper studies black-box cryptanalytic extraction of convolutional neural networks when the architecture is unknown. It shows that the spatial geometry of weight vectors recovered by existing parameter-recovery attacks reveals layer type, kernel size, stride, padding, output-channel count, and pooling configuration for both max and average pooling. Because that geometry is the same for raw-output and hard-label attacks, architecture recovery is feedback-agnostic. Layer-wise and end-to-end experiments indicate that recovering architecture and parameters together is practical.
- Known-architecture assumption is removed for max- and average-pooling CNNs.
- Recovered weight geometry reveals kernel size, stride, padding, and channels.
- Pooling type, window, and stride follow from structural consistency.
- The approach works with raw outputs or hard labels.
Full article222 words · extracted from arxiv.org · click to collapse
This paper studies the cryptanalytic extraction of convolutional neural networks (CNNs). Existing cryptanalytic extraction attacks on CNNs assume that the network architecture is known, and try to recover model parameters.In this paper, we prove for the first time that the architecture assumption can be removed for CNNs with both max and average pooling. Our core finding is that the spatial geometry of the weight vectors recovered by existing parameter-recovery attacks naturally leaks the architecture. We formalize this geometry and establish its correspondence with the architectural knowledge of a convolutional layer: (1) The sparsity consistency with the convolution receptive field reveals the layer type, the kernel size, and the stride; (2) The numerical consistency with the kernel parameters reveals the padding mode and the output-channel number; (3) The structural consistency with the pooling operation reveals the pooling type, the window size, and the stride. Although the recovered vectors are obtained using different methods in the raw-output and hard label settings, their spatial geometry remains the same. Therefore, our architecture recovery is feedback-agnostic: combined with a parameter-recovery attack, it yields a complete cryptanalytic extraction framework that recovers both the architecture and the parameters in the black-box setting. Extensive experiments, including both layer-wise and end-to-end ones, on a wide range of CNNs demonstrate that simultaneously recovering the network architecture and the model parameters is practical.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.27427