End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery

Akira Ito; Takayuki Miura; Yosuke Todo

cs.CRSep 18, 2026

End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery

Authors: Akira Ito, Takayuki Miura, Yosuke Todo

Organizations: Tohoku University 2–1–1 Katahira, Aoba-ku, Sendai-shi, 980-8577, Japan · NTT Social Informatics Laboratories, 3–9–11 Midori-cho, Musashino-shi, Tokyo, 180-8585, Japan

Abstract

The importance of deep neural networks (DNNs) is widely recognized, and the parameters obtained through training are regarded as valuable assets. Recently, attacks that extract these parameters using only oracle queries to a DNN have been actively studied at IACR conferences. The hard-label setting is the most challenging setting for model extraction, where an adversary can observe only the final output label, such as "dog" or "cat." At Eurocrypt 2025, Carlini et al. proposed polynomial-time hard-label extraction of ReLU-based MLPs. However, one step of this attack process, i.e., sign recovery, requires a large number of queries and substantial computation. Implementing this step in a black-box setting remains difficult. Consequently, a fully black-box end-to-end demonstration on trained deep ReLU MLPs has remained a challenge. In this paper, we propose a new sign-recovery algorithm based on a completely different principle from the existing method. Our method requires no dedicated queries for sign recovery. In our experiments, it achieves higher sign-recovery accuracy than the existing method. Consequently, it enables efficient sign recovery even for trained models. With our sign-recovery algorithm, all steps of hard-label model extraction can be implemented in a black-box setting. By combining these implementations, we demonstrate end-to-end model extraction from models trained on MNIST and Fashion-MNIST, with width 16 and 4 or 6 hidden layers, achieving over 98% label agreement.

Figures & tables

Figure 1: ReLU-based MLP and model extraction.

Figure 2: Overview of the new sign-recovery method.

Symbol	Description
$f:\mathbb{R}^{d_{0}}\to\mathbb{R}^{d_{L}}$	ReLU network with $L$ layers
$\sigma:\mathbb{R}^{d_{}}\to\mathbb{R}^{d_{}}$	ReLU function applied component-wise
$\mathbf{W}^{(\ell)}\in\mathbb{R}^{d_{\ell}\times d_{\ell-1}}$	weight matrix in the $\ell$ th layer
$\bm{b}^{(\ell)}\in\mathbb{R}^{d_{\ell}}$	bias vector in the $\ell$ th layer
$\bm{h}^{(\ell)}(\bm{x})\in\mathbb{R}^{d_{\ell}}$	output vector for input $\bm{x}$ after the $\ell$ th layer
${\bf\Gamma}_{\bm{x}}^{(\ell)}\in\mathbb{R}^{d_{\ell}\times d_{0}}$	forward local linear matrix up to the $\ell$ th layer for input $\bm{x}$

Table 1: Notation

Figure 3: Illustration of a two-dimensional input space.

Figure 4: Existing sign-recovery method. Compare the distance between

\Delta

and

\Delta^{\prime}

Figure 5: Schematic three-dimensional visualization of the (weighted) cosine methods, obtained by taking the target-signature direction as the $z$ -axis.

Panel of Figure 6 — Figure 6: Direct cosine distributions for random and MNIST-trained models.

Panel of Figure 7 — Figure 7: $\Gamma$ -weighted cosine distributions for random and MNIST-trained models.

Panel of Figure 8 — Figure 8: Signature-weighted cosine distributions for random and MNIST-trained models.

		Signature-weighted cosine		Boundary-walking
Layer	Evaluated	Correct (HC)	Wrong (HC)	Correct (HC)	Wrong (HC)
2	128	127 (119)	1 (0)	105 (0)	23 (0)
3	128	128 (110)	0 (0)	85 (0)	43 (0)
4	128	128 (120)	0 (0)	80 (0)	48 (0)
5	126	123 (107)	3 (0)	67 (0)	59 (0)

Table 2: Sign-recovery results for an MNIST-trained

784

128^{(5)}

10

model from 50 intersection spaces per evaluated neuron. Numbers labeled by HC denote high-confidence results, where

|t|\geq 3

for the signature-weighted cosine method and

CL\geq 99.7\%

for the boundary-walking method. Here, HC under Wrong denotes a high-confidence error, namely, a case in which the incorrect sign direction is selected with high confidence.

Panel of Figure 9 — Figure 9: Groups passing the consistency check by layer, using 20,000 intersection spaces per trained model with six hidden layers of width 16.

Model	Metric	Int. space collection	L1	L2	L3	L4	L5	L6	L7	Entire model
MNIST 784- $16^{(4)}$ -10	Active neurons	–	16	16	16	16	10	–	–	74
	Recovered neurons	–	16	16	16	16	10	–	–	74
	Signature time	–	2.95s	4.20s	9.02s	5.15s	3.20s	–	–	25s
	Sign time	–	0.23s	44s	29s	31s	0.23ms	–	–	1m44s
	Total queries	$2^{32.31}$	$2^{17.10}$	$2^{17.10}$	$2^{18.42}$	$2^{17.69}$	$0$	–	–	$2^{32.31}$
MNIST 784- $16^{(6)}$ -10	Active neurons	–	16	16	15	15	15	16	10	103

Table 3: Neuron recovery, queries, and running times for MNIST- and FMNIST-trained models with four or six hidden layers of width 16 (Int.: intersection).

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 10: Overview of how to collect intersection points and intersection spaces.

$r_{\mathbf{\Gamma}}$	Random		MNIST		Prediction
	2nd layer	4th layer	2nd layer	4th layer
50	0.6786	0.6602	0.6714	0.6699	0.6579
55	0.7629	0.7648	0.7500	0.7713	0.7746
60	0.9057	0.9049	0.9027	0.9012	0.9091
65	1.0550	1.0758	1.0501	1.0879	1.0656
70	1.2378	1.3441	1.2487	–	1.2500

Appendix

Table 4: Measured values of

\tilde{\bm{w}}_{t}^{\top}\tilde{\mathbf{C}}^{-1}\tilde{\bm{w}}_{t}

and the reference-model prediction.

Model Extraction Attacks

Model extraction attacks infer a machine-learning model’s behavior, architecture, parameters, or hidden assets from queries and system leakage.

See all 48 papers

CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks
Feb 23, 2026Bolin Shen, Zhan Cheng, Neil Zhenqiang Gong +2Model Extraction Attacks Black-Box Model Auditing
Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States · Department of Computer Science, Duke University, Durham, North Carolina, United States +1
InferNet: Exploiting Aggregate GPU Profiles as Side-Channel for DNN Architecture Inference
Apr 6, 2023Raja Hasnain Anwar, Jonah O'Brien Weiss, Tiago Alves +1Model Extraction Attacks
University of Massachusetts Amherst, USA · Rio de Janeiro State University, Brazil
TrEEStealer: Stealing Decision Trees via Enclave Side Channels
Apr 20, 2026Jonas Sander, Anja Rabich, Nick Mahling +5Model Extraction Attacks Decision Tree Learning
University of Luebeck, Luebeck, Germany · Durham University, Durham, United Kingdom

Feb 23, 2026J/K move · Enter open · S save

CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

Bolin Shen, Zhan Cheng, Neil Zhenqiang Gong, Fan Yao+1

Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States · Department of Computer Science, Duke University, Durham, North Carolina, United States+1

Model Extraction Attacks Black-Box Model Auditing

Open paper AskPDF arXiv

Machine Learning as a Service (MLaaS) has emerged as a widely adopted paradigm for providing access to deep neural network (DNN) models, enabling users to conveniently leverage these models through standardized APIs. However, such services are highly vulnerable to Model Extraction Attacks (MEAs), where an adversary repeatedly queries a target model to collect input-output pairs and uses them to train a surrogate model that closely replicates its functionality. While numerous defense strategies have been proposed, verifying the ownership of a suspicious model with strict theoretical guarantees remains a challenging task. To address this gap, we introduce CREDIT, a certified ownership verification against MEAs. Specifically, we employ mutual information to quantify the similarity between DNN models, propose a practical verification threshold, and provide rigorous theoretical guarantees for ownership verification based on this threshold. We extensively evaluate our approach on several mainstream datasets across different domains and tasks, achieving state-of-the-art performance. Our implementation is publicly available at: https://github.com/LabRAI/CREDIT.

Abstract

Model Extraction Attacks

Explore similar work

CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks

InferNet: Exploiting Aggregate GPU Profiles as Side-Channel for DNN Architecture Inference

TrEEStealer: Stealing Decision Trees via Enclave Side Channels