Extraction meets Distillation - cryptanalytic techniques to recover parameters from a Deep Neural Network

Biprarshi Biswas; Arya Anshuman Ojha; Yubaraj Das; Devansh Khosla; Kamran Rais; Saankhya Samanta; Subhamoy Maitra; Pantelimon Stanica

cs.LGOct 24, 2026

Extraction meets Distillation - cryptanalytic techniques to recover parameters from a Deep Neural Network

Authors: Biprarshi Biswas, Arya Anshuman Ojha, Yubaraj Das, Devansh Khosla, Kamran Rais, Saankhya Samanta, Subhamoy Maitra, Pantelimon Stanica

Organizations: 1*Jadavpur University, Kolkata, India. · 2*National Institute of Science Education and Research, Bhubaneswar, India. · 3*Institute of Mathematics and Application, Bhubaneswar, India. · 4*Indian Institute of Technology, Kharagpur, India. ·

Abstract

We study fully connected neural-network reconstruction by combining cryptanalytic weight-direction extraction with learning from predicted labels. We adapt a ReLU extraction implementation to Leaky ReLU, compare sign-search methods, and estimate biases and output layers. We prove conditional bounds for direction recovery with approximate prefixes, preservation of local distance votes, prediction changes from aligned parameter errors, and sign selection with independent scoring data. We also specify exact row restoration and distinguish its guarantee from that of gradient masking. The experiments evaluate assisted extraction, with privileged access to gradients, hidden activations, and victim parameters, followed by label-based reconstruction. Across eight search seeds on the largest synthetic architecture, Leaky ReLU recovers 51--57 neurons in the deepest hidden layer, while ReLU recovers none. This advantage does not hold uniformly across architectures and layers. Removing victim-weight access from the sign walk gives less accurate signs, despite high final prediction agreement. Across 40 seeded runs on the two smallest synthetic victims, agreement on 5,000 inputs excluded from fitting and selection ranges from $0.9890$ to $0.9992$ . On two CIFAR-10 victims, the reconstructed models achieve $56.40\%$ and $58.29\%$ agreement and exceed the distillation baseline on three functional metrics. We report label requests separately from privileged access and explain why prediction agreement does not identify network parameters.

Figures & tables

Operation	Reads	Type	Role in the reported implementation
D1 – Boundary detection	Logit gap	A	In the D1 ablation, disabling it reduces accepted directions on the tiny ReLU victim from 142/256 to 24/256. This is an implementation ablation, not an impossibility result.
D2 – Boundary refinement	Exact logit gradients	A	A label-based fallback exists in the reference code. Its use must be specified in a strict-oracle experiment.
D3 – Neuron clustering	Hidden activations	A	The reference code also provides an SVD-based alternative. Its reported higher cost does not make privileged access necessary in principle.
D4 – Prefix initialization	True weight matrices	W	Supplies the prefix used to extract deeper layers. The present experiments do not replace it with a fully reconstructed prefix.
D5 – Signature scaling	True weight vector	W	Corrects scale and checks candidates. In the Leaky ReLU path, ground-truth agreement also determines candidate acceptance.
D6 – Sign-walk parameters	True weights and biases	W	Supplies the prefix used by the sign-recovery walk. The recovered-frame conversion also compares recovered rows with true rows before choosing directions.

Table 1: Privileged accesses in the evaluated extraction implementation.

Slice	Role	Source ( make_blobs / CIFAR-10)
$X_{\mathrm{test}}$	Phase-3 training pool	seed 42 / test batch
$X_{\mathrm{test2}}$	Phase-3 training pool	seed 99 / train idx 40000–49999
$X_{\mathrm{test3}}$	Evaluation and early stopping	seed 123 / train idx 10000–19999

Table 2: Dataset contract for joint-fit experiments. The split-fit comparison uses the separate roles described in Section 7.7 .

Parameter	tiniest	tinier	tiny	full (CIFAR)
dual-search rounds	6	8	20	150
dual workers / batch	7 / 256	7 / 256	7 / 256	1–3 / 256
target triplets / round	3000	2000	10000	10000
sign restarts	1	1	2	0–1
sign pair-lookahead	8	8	8	4
sign refine cycles	3	3	3	1

Table 3: Per-architecture tuned parameters. The CIFAR runs use simulated annealing (SA) with the margin score. PT denotes parallel tempering.

Phase	Parameter	Value
Dual search	implementation	torch , CUDA float64
Sign recovery	runner	batched_sign_recovery.py , float64
Reconstruction	sign-search method	SA+margin (default), PT+margin (comparison)
	mini-refine	20 epochs, lr $5{\times}10^{-3}$ , wd $10^{-4}$
	refine optimiser	AdamW, cosine lr, wd $10^{-4}$
	early stopping	patience 5, evaluation every 10 epochs

Table 4: Pipeline parameters held fixed across all victims.

Metric	Interpretation
$C_{1}$ – Evaluation-slice agreement	Prediction agreement on the slice also used for early stopping.
$C_{2}$ – Off-distribution agreement	Prediction agreement under the specified alternative input distributions.
$C_{3}$ – Margin-conditioned agreement	Prediction agreement in the far bin of the directional search-radius proxy.

Table 5: Functional agreement metrics. None identifies the victim’s parameters.

Model	Recovered	fc1/fc2/fc3/fc4	Sign acc	Victim acc	Ext acc	Agreement
tiniest_relu	20/32 (62.5%)	8/8 $\cdot$ 7/8 $\cdot$ 0/8 $\cdot$ 5/8	0.601	99.90%	99.40%	99.30%
tiniest_leakyrelu	25/32 (78.1%)	8/8 $\cdot$ 8/8 $\cdot$ 3/8 $\cdot$ 6/8	0.771	100.00%	100.00%	100.00%
tinier_relu	29/56 (51.8%)	16/16 $\cdot$ 12/16 $\cdot$ 1/16 $\cdot$ 0/8	0.347	100.00%	100.00%	100.00%
tinier_leakyrelu	35/56 (62.5%)	16/16 $\cdot$ 13/16 $\cdot$ 4/16 $\cdot$ 2/8	0.463	100.00%	100.00%	100.00%
tiny_relu	139/256 (54.3%)	64/64 $\cdot$ 61/64 $\cdot$ 14/64 $\cdot$ 0/64	0.503	100.00%	100.00%	100.00%
tiny_leakyrelu	226/256 (88.3%)	63/64 $\cdot$ 60/64 $\cdot$ 49/64 $\cdot$ 54/64	0.500	100.00%	100.00%	100.00%

Table 6: Assisted reconstruction across the victim suite (SA with a margin score). Sign accuracy averages over nonempty hidden layers.

Architecture	ReLU recovered	Leaky recovered	Delta	fc4 ReLU	fc4 Leaky
tiniest	20/32	25/32	$+5$	5/8	6/8
tinier	29/56	35/56	$+6$	0/8	2/8
tiny	139/256	226/256	$+87$	0/64	54/64
cifar	499/832	807/832	$+308$	0/64	58/64

Table 7: Phase 1–2 recovery, ReLU vs Leaky ReLU.

Layer	Mean	SD	Range
fc1	8.00	0.00	8
fc2	6.97	0.16	6–7
fc3	2.25	1.37	0–5
fc4	4.60	0.54	3–5

Table 8: Per-layer recovered neurons over

40

reported repeated extractions of tiniest_relu .

Model	$C_{1}$		$C_{2}$		$C_{3}$
	ext	dis	ext	dis	ext	dis
tiniest_relu	0.9930	0.9610	0.2166	0.3304	0.9910	0.9731
tiniest_leakyrelu	1.0000	0.9860	0.5880	0.3756	1.0000	1.0000
tinier_relu	1.0000	1.0000	0.5297	0.5295	1.0000	1.0000
tinier_leakyrelu	1.0000	1.0000	0.6123	0.5132	1.0000	1.0000
tiny_relu (SA)	1.0000	1.0000	0.4335	0.3338	1.0000	1.0000

Table 9: Per-metric agreement for the extraction arm and a matched distillation baseline.

Arch	Stage	ReLU Agr	Leaky ReLU Agr
tiniest	RAW (Phase 1+2)	12.40%	12.50%
	+ bias recovery	22.80%	2.80%
	+ output-layer fit	92.40%	98.00%
	+ sign search	99.40%	97.90%
	+ masked refinement	99.70%	98.90%
	distillation baseline	96.00%	98.60%

Table 10: Additive Phase-3 ablation on the six make_blobs victims, evaluated on the selection slice X_test3.

Victim	Accepted rows	Output fit	Sign search	Refinement
tiniest_relu	20/32	99.60%	99.90%	99.90%
tiniest_leakyrelu	20/32	97.90%	99.50%	99.20%
tinier_relu	28/56	100.00%	100.00%	100.00%
tinier_leakyrelu	31/56	100.00%	100.00%	100.00%
tiny_relu	142/256	100.00%	100.00%	100.00%
tiny_leakyrelu	231/256	100.00%	100.00%	100.00%

Table 11: D1 ON split-fit reconstruction. Accepted rows are counted across all hidden layers. Agreement is measured on the reserved reporting slice.

Phase-3 protocol	Minimum	Maximum	Runs below $0.995$
Joint-fit	0.9918	0.9998	4/40
Split-fit	0.9890	0.9992	15/40
Split-fit, restoration and initial checkpoint	0.9910	0.9996	16/40
Also separate stopping pool	0.9910	0.9998	13/40

Table 12: Final agreement on 5,000 held-out inputs across 40 seeded tiniest runs. The extraction and canonical sign walk retain privileged access.

Victim	Total accepted rows	Deepest hidden layer
Tiniest ReLU	20–23 (22.125)	4–5 (4.875)
Tiniest Leaky ReLU	21–25 (22.875)	2–5 (3.250)
Tinier ReLU	29–31 (30.000)	0 (0.000)
Tinier Leaky ReLU	31–34 (32.875)	0–1 (0.250)
Tiny ReLU	131–141 (136.000)	0 (0.000)
Tiny Leaky ReLU	221–229 (225.875)	51–57 (54.375)

Table 13: Accepted rows across eight recorded dual-search seeds per synthetic victim. Parentheses give means.

Model Extraction Attacks

Model extraction attacks infer a machine-learning model’s behavior, architecture, parameters, or hidden assets from queries and system leakage.

See all 49 papers

End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery
Sep 18, 2026Akira Ito, Takayuki Miura, Yosuke TodoModel Extraction Attacks ReLU Neural Networks
Tohoku University 2–1–1 Katahira, Aoba-ku, Sendai-shi, 980-8577, Japan · NTT Social Informatics Laboratories, 3–9–11 Midori-cho, Musashino-shi, Tokyo, 180-8585, Japan
Efficient Techniques for Data Reconstruction, with Finite-Width Recovery Guarantees
May 7, 2026Edward Tansley, Roy Makhlouf, Estelle Massart +1Training Data Reconstruction Attacks Random Feature Methods
Mathematical Institute, Woodstock Road, University of Oxford, Oxford, UK, OX2 6GG. · ICTEAM Institute, UCLouvain, Euler Building, Avenue Georges Lemaˆıtre, 4 - bte L4.05.01, Louvain-la-Neuve, B - 1348, Belgium.
Layer-wise Input Recoverability in Deep Neural Networks
Oct 9, 2026Maxwell Spiridonov, Alireza Rahmansetayesh, Pierre BaldiConvolutional Neural Networks Neural Network Interpretability
Department of Computer Science, University of California, Irvine

Sep 18, 2026J/K move · Enter open · S save

End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery

Akira Ito, Takayuki Miura, Yosuke Todo

Tohoku University 2–1–1 Katahira, Aoba-ku, Sendai-shi, 980-8577, Japan · NTT Social Informatics Laboratories, 3–9–11 Midori-cho, Musashino-shi, Tokyo, 180-8585, Japan

Model Extraction Attacks ReLU Neural Networks

Open paper AskPDF arXiv

The importance of deep neural networks (DNNs) is widely recognized, and the parameters obtained through training are regarded as valuable assets. Recently, attacks that extract these parameters using only oracle queries to a DNN have been actively studied at IACR conferences. The hard-label setting is the most challenging setting for model extraction, where an adversary can observe only the final output label, such as "dog" or "cat." At Eurocrypt 2025, Carlini et al. proposed polynomial-time hard-label extraction of ReLU-based MLPs. However, one step of this attack process, i.e., sign recovery, requires a large number of queries and substantial computation. Implementing this step in a black-box setting remains difficult. Consequently, a fully black-box end-to-end demonstration on trained deep ReLU MLPs has remained a challenge. In this paper, we propose a new sign-recovery algorithm based on a completely different principle from the existing method. Our method requires no dedicated queries for sign recovery. In our experiments, it achieves higher sign-recovery accuracy than the existing method. Consequently, it enables efficient sign recovery even for trained models. With our sign-recovery algorithm, all steps of hard-label model extraction can be implemented in a black-box setting. By combining these implementations, we demonstrate end-to-end model extraction from models trained on MNIST and Fashion-MNIST, with width 16 and 4 or 6 hidden layers, achieving over 98% label agreement.

Abstract

Model Extraction Attacks

Explore similar work

End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery

Efficient Techniques for Data Reconstruction, with Finite-Width Recovery Guarantees

Layer-wise Input Recoverability in Deep Neural Networks