Skip to content
Original

Cryptanalytic extraction of neural network models

Cryptanalytic Extraction of Neural Network Models

arXiv· arXiv:2003.04884· CRYPTO· Nicholas Carlini, Matthew Jagielski, Ilya Mironov·Indexed by this site · 16 days ago· Originally publishedSelected AttacksSelectedAttention41

Quick read

Based on the paper's full text (AI-generated); refer to the original

AI summaryThe researchers Nicholas Carlini, Matthew Jagielski and Ilya Mironov propose treating neural network model stealing as a cryptanalysis problem, and present a differential attack that recovers the parameters of a remote ReLU neural network to floating-point precision using only black-box queries. The attack exploits the piecewise-linear nature of ReLU networks, recovering weights layer by layer at neuron critical points using second-order directional derivatives. In experiments, the extracted models are 2^20 times more precise and require 100 times fewer queries than prior work; for example, for a 100,000-parameter network trained on the MNIST digit recognition task, 2^21.5 queries and less than one hour suffice for extraction, with a worst-case error of 2^-25, while a 4,000-parameter model requires 2^18.5 queries with an error of 2^-40.4.

Questions
Under the setting of only black-box query access and no side channels such as timing, whether the complete parameters functionally equivalent to the target neural network can be extracted from an oracle; this concerns model confidentiality, prediction APIs, and the security of secure inference.
Methods
Analogizes model extraction to cryptanalysis of block ciphers, exploiting that ReLU networks are piecewise linear functions: near neuron critical points, second-order finite differences are used to recover weights and biases layer by layer, then that layer is stripped off to attack the next layer; and designs numerically stable and query-reuse techniques for floating-point precision, hidden-layer state control, and row sign recovery.
Experiments and results
Evaluated on a variety of fully connected networks, the extraction accuracy is about 220 times higher and uses about 100 times fewer queries than prior work; for example, a 100,000-parameter network on MNIST was extracted with 2^21.5 queries in under an hour with a worst-case error of 2^-25, and another 4,000-parameter network reached a worst-case error of 2^-40.4 with 2^18.5 queries.
Limitations and future work
The attack relies on a known architecture, full-domain inputs, complete outputs, 64-bit floating-point precision, scalar outputs, and ReLU activations; row sign recovery requires exponential computation in the general case, and some networks cannot be recovered within ten attempts. The authors did not study defenses, and note that detecting the attack, adding noise, or returning only labels can break the attack; relaxing the assumptions and reducing computational and query complexity are left for future work.
Why it was selectedThe authors treat model stealing as a cryptanalysis problem; the proposed differential attack is 2^20 times more precise and uses 100 times fewer queries than prior work.

The authors treat model stealing as a cryptanalysis problem; the proposed differential attack is 2^20 times more precise and uses 100 times fewer queries than prior work.

Related events and news

0 events · 2 news mentions

News that mentions this paper

Read originalCRYPTO