CNN architectures and weights fully recovered from black-box access
Extracting CNNs in the Unknown-Architecture and Feedback-Agnostic Setting
Cryptography and Security
Summary
Extracting machine learning models like CNNs usually assumes you know the model’s design beforehand. This paper shows how to figure out both the design and the details of a CNN just by looking at its outputs, even when you don’t know anything about it ahead of time. The authors found that the shape and arrangement of the model’s parameters reveal information about the layers and settings used inside. This method works whether you get detailed outputs or just final answers, making it possible to reconstruct the whole CNN from scratch.
What this means in practice
- •For security teams: Assess the risk of exposing internal CNN designs and parameters by extracting models from black-box access.
- •For machine learning engineers: Recover lost CNN architectures and weights when only black-box access to the model is available, aiding model duplication and debugging.
Authors
Jiashuo Liu, Ruijie Ma, Manman Li, Yi Chen, Shaozhen Chen
Abstract
This paper studies the cryptanalytic extraction of convolutional neural networks (CNNs). Existing cryptanalytic extraction attacks on CNNs assume that the network architecture is known, and try to recover model parameters.In this paper, we prove for the first time that the architecture assumption can be removed for CNNs with both max and average pooling. Our core finding is that the spatial geometry of the weight vectors recovered by existing parameter-recovery attacks naturally leaks the architecture. We formalize this geometry and establish its correspondence with the architectural knowledge of a convolutional layer: (1) The sparsity consistency with the convolution receptive field reveals the layer type, the kernel size, and the stride; (2) The numerical consistency with the kernel parameters reveals the padding mode and the output-channel number; (3) The structural consistency with the pooling operation reveals the pooling type, the window size, and the stride. Although the recovered vectors are obtained using different methods in the raw-output and hard label settings, their spatial geometry remains the same. Therefore, our architecture recovery is feedback-agnostic: combined with a parameter-recovery attack, it yields a complete cryptanalytic extraction framework that recovers both the architecture and the parameters in the black-box setting. Extensive experiments, including both layer-wise and end-to-end ones, on a wide range of CNNs demonstrate that simultaneously recovering the network architecture and the model parameters is practical.