Extracting CNNs in the Unknown-Architecture and Feedback-Agnostic Setting
Researchers show black-box attacks can recover a CNN's unknown architecture and its parameters.
The paper studies black-box cryptanalytic extraction of convolutional neural networks when the architecture is unknown. It shows that the spatial geometry of weight vectors recovered by existing parameter-recovery attacks reveals layer type, kernel size, stride, padding, output-channel count, and pooling configuration for both max and average pooling. Because that geometry is the same for raw-output and hard-label attacks, architecture recovery is feedback-agnostic. Layer-wise and end-to-end experiments indicate that recovering architecture and parameters together is practical.
- Known-architecture assumption is removed for max- and average-pooling CNNs.
- Recovered weight geometry reveals kernel size, stride, padding, and channels.
- Pooling type, window, and stride follow from structural consistency.
- The approach works with raw outputs or hard labels.
From the original article
1 min read at arxiv.orgThis paper studies the cryptanalytic extraction of convolutional neural networks (CNNs). Existing cryptanalytic extraction attacks on CNNs assume that the network architecture is known, and try to recover model parameters. In this paper, we prove for the first time that the architecture assumption can be removed for CNNs with both max and average pooling.
By Jiashuo Liu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.