End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery

Akira Ito; Takayuki Miura; Yosuke Todo

cs.CRSep 18, 2026

End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery

Authors: Akira Ito, Takayuki Miura, Yosuke Todo

Organizations: Tohoku University 2–1–1 Katahira, Aoba-ku, Sendai-shi, 980-8577, Japan · NTT Social Informatics Laboratories, 3–9–11 Midori-cho, Musashino-shi, Tokyo, 180-8585, Japan

Abstract

The importance of deep neural networks (DNNs) is widely recognized, and the parameters obtained through training are regarded as valuable assets. Recently, attacks that extract these parameters using only oracle queries to a DNN have been actively studied at IACR conferences. The hard-label setting is the most challenging setting for model extraction, where an adversary can observe only the final output label, such as "dog" or "cat." At Eurocrypt 2025, Carlini et al. proposed polynomial-time hard-label extraction of ReLU-based MLPs. However, one step of this attack process, i.e., sign recovery, requires a large number of queries and substantial computation. Implementing this step in a black-box setting remains difficult. Consequently, a fully black-box end-to-end demonstration on trained deep ReLU MLPs has remained a challenge. In this paper, we propose a new sign-recovery algorithm based on a completely different principle from the existing method. Our method requires no dedicated queries for sign recovery. In our experiments, it achieves higher sign-recovery accuracy than the existing method. Consequently, it enables efficient sign recovery even for trained models. With our sign-recovery algorithm, all steps of hard-label model extraction can be implemented in a black-box setting. By combining these implementations, we demonstrate end-to-end model extraction from models trained on MNIST and Fashion-MNIST, with width 16 and 4 or 6 hidden layers, achieving over 98% label agreement.

Figures & tables

Figure 1: ReLU-based MLP and model extraction.

Figure 2: Overview of the new sign-recovery method.

Symbol	Description
$f:\mathbb{R}^{d_{0}}\to\mathbb{R}^{d_{L}}$	ReLU network with $L$ layers
$\sigma:\mathbb{R}^{d_{}}\to\mathbb{R}^{d_{}}$	ReLU function applied component-wise
$\mathbf{W}^{(\ell)}\in\mathbb{R}^{d_{\ell}\times d_{\ell-1}}$	weight matrix in the $\ell$ th layer
$\bm{b}^{(\ell)}\in\mathbb{R}^{d_{\ell}}$	bias vector in the $\ell$ th layer
$\bm{h}^{(\ell)}(\bm{x})\in\mathbb{R}^{d_{\ell}}$	output vector for input $\bm{x}$ after the $\ell$ th layer
${\bf\Gamma}_{\bm{x}}^{(\ell)}\in\mathbb{R}^{d_{\ell}\times d_{0}}$	forward local linear matrix up to the $\ell$ th layer for input $\bm{x}$

Table 1: Notation

Figure 3: Illustration of a two-dimensional input space.

Figure 4: Existing sign-recovery method. Compare the distance between

\Delta

and

\Delta^{\prime}

Figure 5: Schematic three-dimensional visualization of the (weighted) cosine methods, obtained by taking the target-signature direction as the $z$ -axis.

Panel of Figure 6 — Figure 6: Direct cosine distributions for random and MNIST-trained models.

Panel of Figure 7 — Figure 7: $\Gamma$ -weighted cosine distributions for random and MNIST-trained models.

Panel of Figure 8 — Figure 8: Signature-weighted cosine distributions for random and MNIST-trained models.

		Signature-weighted cosine		Boundary-walking
Layer	Evaluated	Correct (HC)	Wrong (HC)	Correct (HC)	Wrong (HC)
2	128	127 (119)	1 (0)	105 (0)	23 (0)
3	128	128 (110)	0 (0)	85 (0)	43 (0)
4	128	128 (120)	0 (0)	80 (0)	48 (0)
5	126	123 (107)	3 (0)	67 (0)	59 (0)

Table 2: Sign-recovery results for an MNIST-trained

784

128^{(5)}

10

model from 50 intersection spaces per evaluated neuron. Numbers labeled by HC denote high-confidence results, where

|t|\geq 3

for the signature-weighted cosine method and

CL\geq 99.7\%

for the boundary-walking method. Here, HC under Wrong denotes a high-confidence error, namely, a case in which the incorrect sign direction is selected with high confidence.

Panel of Figure 9 — Figure 9: Groups passing the consistency check by layer, using 20,000 intersection spaces per trained model with six hidden layers of width 16.

Model	Metric	Int. space collection	L1	L2	L3	L4	L5	L6	L7	Entire model
MNIST 784- $16^{(4)}$ -10	Active neurons	–	16	16	16	16	10	–	–	74
	Recovered neurons	–	16	16	16	16	10	–	–	74
	Signature time	–	2.95s	4.20s	9.02s	5.15s	3.20s	–	–	25s
	Sign time	–	0.23s	44s	29s	31s	0.23ms	–	–	1m44s
	Total queries	$2^{32.31}$	$2^{17.10}$	$2^{17.10}$	$2^{18.42}$	$2^{17.69}$	$0$	–	–	$2^{32.31}$
MNIST 784- $16^{(6)}$ -10	Active neurons	–	16	16	15	15	15	16	10	103

Table 3: Neuron recovery, queries, and running times for MNIST- and FMNIST-trained models with four or six hidden layers of width 16 (Int.: intersection).

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 10: Overview of how to collect intersection points and intersection spaces.

$r_{\mathbf{\Gamma}}$	Random		MNIST		Prediction
	2nd layer	4th layer	2nd layer	4th layer
50	0.6786	0.6602	0.6714	0.6699	0.6579
55	0.7629	0.7648	0.7500	0.7713	0.7746
60	0.9057	0.9049	0.9027	0.9012	0.9091
65	1.0550	1.0758	1.0501	1.0879	1.0656
70	1.2378	1.3441	1.2487	–	1.2500

Appendix

Table 4: Measured values of

\tilde{\bm{w}}_{t}^{\top}\tilde{\mathbf{C}}^{-1}\tilde{\bm{w}}_{t}

and the reference-model prediction.

Model Extraction Attacks

Model extraction attacks infer a machine-learning model’s behavior, architecture, parameters, or hidden assets from queries and system leakage.

See all 48 papers

Feb 23, 2026

CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

Machine Learning as a Service (MLaaS) has emerged as a widely adopted paradigm for providing access to deep neural network (DNN) models, enabling users to conveniently leverage these models through standardized APIs. However, such services are highly vulnerable to Model Extraction Attacks (MEAs), where an adversary repeatedly queries a target model to collect input-output pairs and uses them to train a surrogate model that closely replicates its functionality. While numerous defense strategies have been proposed, verifying the ownership of a suspicious model with strict theoretical guarantees remains a challenging task. To address this gap, we introduce CREDIT, a certified ownership verification against MEAs. Specifically, we employ mutual information to quantify the similarity between DNN models, propose a practical verification threshold, and provide rigorous theoretical guarantees for ownership verification based on this threshold. We extensively evaluate our approach on several mainstream datasets across different domains and tasks, achieving state-of-the-art performance. Our implementation is publicly available at: https://github.com/LabRAI/CREDIT.

Bolin Shen, Zhan Cheng, Neil Zhenqiang Gong +2

Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States · Department of Computer Science, Duke University, Durham, North Carolina, United States +1

Model Extraction Attacks Black-Box Model Auditing

Ask PDF

Apr 6, 2023

InferNet: Exploiting Aggregate GPU Profiles as Side-Channel for DNN Architecture Inference

Deep Neural Networks (DNNs) have become ubiquitous for their ability to solve problems across various domains, including computer vision, natural language processing, and speech recognition. However, as their adoption grows, they face a range of security threats, such as model stealing, architecture extraction, and manipulation, which can compromise their integrity, privacy, and functionality. Past works have relied on complex, fine-grained, and time-series analysis to launch DNN model extraction attacks. These approaches require extensive amounts of data, which are often challenging to acquire and analyze effectively. This paper introduces InferNet, an attack method that leverages simple, non-intrusive, and coarse-grained system-level information to identify the underlying DNN architecture of a victim's application. By analyzing GPU kernel calls, memory events, and system-level metrics, InferNet fingerprints the DNN and infers its architecture with very high accuracy. It can predict the architecture family (e.g., Inception vs. BERT), as well as the architecture variant (e.g., InceptionV1 vs. InceptionV3). The evaluation results demonstrate the effectiveness of InferNet across AI/ML frameworks (TensorFlow, PyTorch), different DNN types (vision, LLMs), and hardware platforms (NVIDIA Tesla T4, NVIDIA Quadro RTX 8000). The results show that InferNet achieves 100% model extraction accuracy using only a partial GPU profile under various attack settings.

Raja Hasnain Anwar, Jonah O'Brien Weiss, Tiago Alves +1

University of Massachusetts Amherst, USA · Rio de Janeiro State University, Brazil

Model Extraction Attacks

Ask PDF

Apr 20, 2026

TrEEStealer: Stealing Decision Trees via Enclave Side Channels

Today, machine learning is widely applied in sensitive, security-related, and financially lucrative applications. Model extraction attacks undermine current business models where a model owner sells model access, e.g., via MLaaS APIs. Additionally, stolen models can enable powerful white-box attacks, facilitating privacy attacks on sensitive training data, and model evasion. In this paper, we focus on Decision Trees (DT), which are widely deployed in practice. Existing black-box extraction attacks for DTs are either query-intensive, make strong assumptions about the DT structure, or rely on rich API information. To limit attacks to the black-box setting, CPU vendors introduced Trusted Execution Environments (TEE) that use hardware-mechanisms to isolate workloads from external parties, e.g., MLaaS providers. We introduce TrEEStealer, a high-fidelity extraction attack for stealing TEE-protected DTs. TrEEStealer exploits TEE-specific side-channels to steal DTs efficiently and without strong assumptions about the API output or DT structure. The extraction efficacy stems from a novel algorithm that maximizes the information derived from each query by coupling Control-Flow Information (CFI) with passive information tracking. We use two primitives to acquire CFI: for AMD SEV, we follow previous work using the SEV-Step framework and performance counters. For Intel SGX, we reproduce prior findings on current Xeon 6 CPUs and construct a new primitive to efficiently extract the branch history of inference runs through the Branch-History-Register. We found corresponding vulnerabilities in three popular libraries: OpenCV, mlpack, and emlearn. We show that TrEEStealer achieves superior efficiency and extraction fidelity compared to prior attacks. Our work establishes a new state-of-the-art for DT extraction and confirms that TEEs fail to protect against control-flow leakage.

Jonas Sander, Anja Rabich, Nick Mahling +5

University of Luebeck, Luebeck, Germany · Durham University, Durham, United Kingdom

Model Extraction Attacks Decision Tree Learning

Ask PDF

Abstract

Model Extraction Attacks

Explore similar work

CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

InferNet: Exploiting Aggregate GPU Profiles as Side-Channel for DNN Architecture Inference

TrEEStealer: Stealing Decision Trees via Enclave Side Channels