Adaptive clustering breaks TraintoDefend defense in model extraction
Original title: Breaking $\mathsf{TraintoDefend}$ via Adaptive Neuron Clustering in Cryptanalytic Model Extraction
SimBreak raises signature recovery from 0% to 100% in protected networks.
The paper identifies limitations in TraintoDefend neuron weight similarity for cryptanalytic extraction defense. Adaptive neuron clustering using relative scale breaks the defense. Evaluation shows full recovery on MNIST networks.
- Bypasses TraintoDefend via adaptive clustering
- Estimates relative scale from weight coordinates
- Raises recovery from 0% to 100%
- Max relative recovery error of 2^{-22.27}
From the original article
1 min read at arxiv.orgCryptanalytic model extraction poses a fundamental threat to deep learning model confidentiality by enabling precise parameter recovery with theoretical guarantees of functional equivalence. To counter this growing threat, $\mathsf{TraintoDefend}$ (NeurIPS 2025) was proposed as the first dedicated defense against cryptanalytic extraction and remains the only defense believed to be effective to date.
By Haojie Wu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.