Sign recovery improves black box extraction of deep neural networks
End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery
Cryptography and SecurityMachine Learning
Summary
Deep neural networks have valuable secret settings called parameters. Some people want to figure out these settings by only seeing the final answer the network gives, like the label "cat" or "dog," without knowing anything else. This is very hard when only the final label is visible. The authors created a new way to recover hidden details, especially the direction of certain parts in the network, without extra special queries. This method works better and faster than old ones, allowing full extraction of how some trained networks make decisions, tested on handwritten and fashion image data.
What this means in practice
- •For security teams: Detect vulnerabilities in deployed neural networks accessible only by output labels to protect against secret extraction.
- •For machine learning engineers: Verify and audit models by fully extracting and analyzing trained deep ReLU networks using only label outputs.
Authors
Akira Ito, Takayuki Miura, Yosuke Todo
Abstract
The importance of deep neural networks (DNNs) is widely recognized, and the parameters obtained through training are regarded as valuable assets. Recently, attacks that extract these parameters using only oracle queries to a DNN have been actively studied at IACR conferences. The hard-label setting is the most challenging setting for model extraction, where an adversary can observe only the final output label, such as "dog" or "cat." At Eurocrypt 2025, Carlini et al. proposed polynomial-time hard-label extraction of ReLU-based MLPs. However, one step of this attack process, i.e., sign recovery, requires a large number of queries and substantial computation. Implementing this step in a black-box setting remains difficult. Consequently, a fully black-box end-to-end demonstration on trained deep ReLU MLPs has remained a challenge. In this paper, we propose a new sign-recovery algorithm based on a completely different principle from the existing method. Our method requires no dedicated queries for sign recovery. In our experiments, it achieves higher sign-recovery accuracy than the existing method. Consequently, it enables efficient sign recovery even for trained models. With our sign-recovery algorithm, all steps of hard-label model extraction can be implemented in a black-box setting. By combining these implementations, we demonstrate end-to-end model extraction from models trained on MNIST and Fashion-MNIST, with width 16 and 4 or 6 hidden layers, achieving over 98% label agreement.