Normal Alignment: Improved Cryptanalytic Sign Recovery on Hard-Label Networks
Researchers propose Normal Alignment, improving cryptanalytic sign recovery for hard-label neural networks and enabling polynomial-time full model extraction.
The paper improves on Carlini et al.'s EUROCRYPT 2025 cryptanalytic extraction of hard-label (S1) DNNs, whose Future Toggle sign-recovery method offered only marginal advantage over random guessing and triggered exponential-time enumeration on errors. Normal Alignment infers neuron signs via expected length differences between projected normals of adjacent decision facets at dual points, delivering higher voting accuracy and low-confidence errors. Combined with the SOE extension, it achieves exact polynomial-time full sign recovery: CIFAR-10 (192-64x8-10) and MNIST (64-96x3-32-10) models are fully recovered where the prior method required 2^52 or 2^82 sign guesses.
- Normal Alignment outperforms the Future Toggle sign-recovery method on hard-label DNNs
- Enables polynomial-time full sign recovery on CIFAR-10 and MNIST models
- Prior approach required exponential enumeration of 2^52 to 2^82 guesses
- Builds on Carlini et al.'s EUROCRYPT 2025 model extraction breakthrough
Full article196 words · extracted from arxiv.org · click to collapse
At EUROCRYPT 2025, Carlini et al. proposed a breakthrough in the cryptanalytic extraction on hard-label (S1) deep neural networks (DNNs), demonstrating polynomial-time signature and sign recovery. However, Carlini et al.'s sign-recovery method (which we call Future Toggle) suffers only a marginal advantage over random guessing, producing high-confidence wrong sign predictions in deeper layers. Such errors trigger expensive exponential-time enumeration. This work presents Normal Alignment, a novel statistical sign-recovery approach for S1 DNNs. Drawing on the expected length difference between projected normals of adjacent decision facets at dual points, our method infers neuron signs via normal-signature alignment. It delivers higher voting accuracy and pushes erroneous predictions to low-confidence ranks, which further enables a more efficient combined method, eSOE + Alignment, by combining Normal Alignment with the hard-label SOE extension. This combined strategy removes heavy enumeration overhead and realizes exact polynomial-time full sign recovery. Experiments demonstrate the effectiveness of our method, especially for deep layers. For example, with our method, the signs for CIFAR-10 (architecture 192-64$\times$8-10) and MNIST (architecture 64-96$\times$3-32-10) models can be fully recovered in polynomial time; in contrast, Carlini et al.'s sign-recovery method would require exponential-time enumerations involving $2^{52}$ or $2^{82}$ guesses of the signs, respectively.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.18751