Abstract:Deep neural networks (DNNs) are valuable assets, yet their public accessibility raises security concerns about parameter extraction by malicious actors. Recent work by Carlini et al. (crypto'20) and Canales-Martínez et al. (eurocrypt'24) has drawn parallels between this issue and block cipher key extraction via chosen plaintext attacks. Leveraging differential cryptanalysis, they demonstrated that all the weights and biases of black-box ReLU-based DNNs could be inferred using a polynomial number of queries and computational time. However, their attacks relied on the availability of the exact numeric value of output logits, which allowed the calculation of their derivatives. To overcome this limitation, Chen et al. (asiacrypt'24) tackled the more realistic hard-label scenario, where only the final classification label (e.g., "dog" or "car") is accessible to the attacker. They proposed an extraction method requiring a polynomial number of queries but an exponential execution time. In addition, their approach was applicable only to a restricted set of architectures, could deal only with binary classifiers, and was demonstrated only on tiny neural networks with up to four neurons split among up to two hidden layers. This paper introduces new techniques that, for the first time, achieve cryptanalytic extraction of DNN parameters in the most challenging hard-label setting, using both a polynomial number of queries and polynomial time. We validate our approach by extracting nearly one million parameters from a DNN trained on the CIFAR-10 dataset, comprising 832 neurons in four hidden layers. Our results reveal the surprising fact that all the weights of a ReLU-based DNN can be efficiently determined by analyzing only the geometric shape of its decision boundaries.

On the Hardness of Learning One Hidden Layer Neural Networks

Learning Narrow One-Hidden-Layer ReLU Networks

Hardness of Learning Neural Networks under the Manifold Hypothesis

On the Complexity of Learning Neural Networks

Efficiently Learning One-Hidden-Layer ReLU Networks via Schur Polynomials

Learning Distributions Generated by One-Layer ReLU Networks

Polynomial Time Cryptanalytic Extraction of Deep Neural Networks in the Hard-Label Setting

On the Principles of ReLU Networks with One Hidden Layer

Polynomial Time Cryptanalytic Extraction of Neural Network Models

On the hardness of learning under symmetries

How (Implicit) Regularization of ReLU Neural Networks Characterizes the Learned Function -- Part II: the Multi-D Case of Two Layers with Random First Layer

Approximating Two-Layer ReLU Networks for Hidden State Analysis in Differential Privacy

Agnostic Learning of Arbitrary ReLU Activation under Gaussian Marginals

Properties of the geometry of solutions and capacity of multi-layer neural networks with Rectified Linear Units activations

Towards Lower Bounds on the Depth of ReLU Neural Networks

The Computational Complexity of ReLU Network Training Parameterized by Data Dimensionality

Finite-Sample Analysis of Learning High-Dimensional Single ReLU Neuron

How Implicit Regularization of ReLU Neural Networks Characterizes the Learned Function -- Part I: the 1-D Case of Two Layers with Random First Layer

Implicit Hypersurface Approximation Capacity in Deep ReLU Networks

Hard-Label Cryptanalytic Extraction of Neural Network Models

Intractability of Learning the Discrete Logarithm with Gradient-Based Methods