End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery
Akira Ito, Takayuki Miura, Yosuke Todo
cs.CR · cs.LG
Quick verdict
Query-free cosine sign recovery enables first black-box end-to-end hard-label extraction of trained deep ReLU MLPs; solid, but only width-16 MNIST models.
Summary
The paper tackles hard-label cryptanalytic model extraction of ReLU MLPs, where the attacker sees only predicted labels. It identifies the boundary-walking sign-recovery step of Carlini et al.'s Eurocrypt 2025 attack — requiring 10²–10³ intersection points per neuron and error-prone boundary traversal — as the obstacle to a fully black-box implementation. The authors propose a cosine method that reuses the intersection spaces already gathered for signature recovery: it compares cosine similarities between the pulled-back target signature and the two adjacent decision-boundary normals, with direct, Γ-weighted, and signature-weighted variants that successively correct local-linear-map anisotropy and trained-weight bias; a variance analysis predicts roughly 50 spaces suffice. On an MNIST-trained 784-128(5)-10 network, it recovers 506 of 510 signs in layers 2–5 with 50 spaces per neuron, where boundary walking produces no high-confidence results. The paper additionally filters spurious signatures arising from later-layer groups and shared decision-boundary normals, and recovers unreachable weights via active search plus cross-layer extraction. Combining these, it demonstrates the first fully black-box end-to-end hard-label extraction of trained deep ReLU MLPs — width 16, 4 or 6 hidden layers, MNIST/FMNIST — recovering all non-dead neurons, with ~232k–237k total queries and 98.48–100% label agreement on 100,000 Gaussian inputs. Limitations: end-to-end scale is only width 16, the baseline is compared solely at its insufficient 50-space budget, the variance model rests on strong approximations, and no code is released.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
5 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- The cosine method recovers each neuron's sign from intersection spaces already collected for signature recovery, requiring no dedicated queries, by exploiting the variance asymmetry between on-side and off-side decision-boundary cosines.
- Approximately 50 intersection spaces per neuron suffice for sign recovery under the stated statistical model, empirically yielding 506/510 correct signs on an MNIST-trained 784-128(5)-10 network where boundary walking produces no high-confidence signs at the same budget.
- With supporting techniques (spurious-group filtering, normal-span sign correction, active search plus cross-layer extraction), all steps of hard-label extraction become implementable black-box, enabling the first end-to-end extraction of trained deep ReLU MLPs (width 16, 4 or 6 hidden layers, MNIST/FMNIST) recovering all non-dead neurons.
- Extracted width-16 models agree with the victim on 98.477–100.000% of 100,000 Gaussian inputs at ~232k–237k total queries, dominated by intersection-space collection.
- The recent black-box end-to-end demo in the updated ePrint of Carlini et al. targets an artificial orthogonal-weight model and does not establish feasibility on trained networks (Appendix A).
Strengths
Sign recovery with zero dedicated queries
Sections 3.1–3.4 and Algorithm 1 reuse intersection spaces already required for signature recovery, eliminating the boundary-walking method's 10²–10³ samples per neuron and its noise-sensitive toggle detection entirely — a clean removal of the main bottleneck the paper identifies.
Theory with testable predictions and honest validation
Models 1–2 derive variance ratios, Appendix D predicts the whitened target magnitude via a Wishart identity, and Table 4 shows measured w̃t^T Ĉ⁻¹ w̃t values (e.g., 0.6786 random vs 0.6579 predicted at rΓ=50) tracking the reference model within ~2–3% across rΓ=50–75.
Decisive controlled comparison on a width-128 trained model
Genuine end-to-end milestone with full cost accounting
Fair treatment of the competing state of the art
Weaknesses
Scale gap between controlled and end-to-end experiments
Baseline evaluated only at a starved budget
Variance model rests on approximations the authors show failing
Functional fidelity measured only on Gaussian inputs; no code
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper (Ito, Miura, Todo; Tohoku University and NTT; arXiv 2609.21941) targets cryptanalytic model extraction of ReLU MLPs in the hard-label setting, where the adversary sees only argmax labels. It builds directly on Carlini et al.'s Eurocrypt 2025 polynomial-time attack, whose sign-recovery step — 'boundary walking' — the authors argue is impractical black-box: it aggregates 10²–10³ intersection points per neuron (measured white-box, Section 2.5) and requires noise-sensitive boundary traversal with past/future toggle detection (Sections 1, 3.1). Two claims structure the work: (1) a cosine-based sign-recovery family requiring zero dedicated queries, and (2) the first fully black-box end-to-end hard-label extraction of *trained* deep ReLU MLPs. The paper also dissects the recent ePrint update by Carlini et al. [1] (Appendix A), showing its black-box demo rests on an artificial orthogonal-weight model with calibrated activation rates — a fair and useful clarification of the state of the art.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is hard-label model extraction of neural networks?
It is an attack in which an adversary recovers a neural network's internal parameters by only querying the model and observing the final predicted class label (e.g., 'cat' or 'dog'), without access to the underlying confidence scores (logits). This is the hardest extraction setting because labels reveal far less information than scores. This paper performs such an attack on trained ReLU multilayer perceptrons.
What does the paper's new 'cosine method' for sign recovery do?
After recovering each neuron's weight direction (up to a ±1 sign ambiguity), the attacker must decide the sign, i.e., which side of the neuron's activation boundary is 'on'. Instead of the prior boundary-walking method — which needed hundreds to thousands of extra probes per neuron — the cosine method compares cosine similarities between the recovered signature and the two decision-boundary normals at already-collected intersection points: the 'on'-side normal statistically has higher cosine variance. This uses zero additional queries.
How accurate are the extracted models in this paper?
For fully connected ReLU networks of width 16 with 4 or 6 hidden layers trained on MNIST and Fashion-MNIST, the extracted models matched the victim's predictions on 98.477–100.000% of 100,000 Gaussian-random inputs, and every neuron except dead or almost-dead ones was recovered. In the isolated sign-recovery study on a wider 784-128(5)-10 model, 506 of 510 signs were recovered correctly using 50 samples per neuron.
Did the authors release code for this attack?
The paper describes its algorithms in unusual detail, including pseudocode for signature recovery and appendices covering collection, search, and correction procedures, but it does not mention any public code or trained-model release, so full reproduction currently requires reimplementation.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1–10 could not be inspected (caption text only); the empirical distribution fits in Figs. 6–8, which are central evidence for the statistical models, are taken on trust from captions and surrounding prose.
- Table 3 query totals (e.g., 232.31) carry no explicit unit in the extracted text; they are read as thousands based on the 20k–400k intersection-space collection context.
- The abstract is truncated mid-sentence in the provided text; the final '>98% agreement' claim is reconstructed from Section 4.3.
- Mathematical notation is degraded by text extraction (pseudoinverses, hats, superscripts); judgments on the derivations rely on reconstructible content.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.