End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery
Researchers show end-to-end hard-label extraction of small ReLU MLPs, exceeding 98% label agreement on MNIST.
The paper presents a sign-recovery algorithm for hard-label cryptanalytic extraction of ReLU multilayer perceptrons that needs no dedicated sign-recovery queries. It improves on the costly sign-recovery step in the Eurocrypt 2025 attack by Carlini et al. Combined with the other extraction steps, it recovers models trained on MNIST and Fashion-MNIST with width 16 and 4 or 6 hidden layers, reaching over 98% label agreement.
- New sign recovery needs no dedicated queries and beats prior accuracy.
- All hard-label extraction steps now run in a black-box setting.
- Tested on MNIST and Fashion-MNIST ReLU MLPs, width 16, 4 or 6 layers.
- Extracted models agree with victim labels more than 98 percent of the time.
From the original article
1 min read at arxiv.orgThe importance of deep neural networks (DNNs) is widely recognized, and the parameters obtained through training are regarded as valuable assets. Recently, attacks that extract these parameters using only oracle queries to a DNN have been actively studied at IACR conferences.
By Akira Ito · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.