Delving into Cryptanalytic Extraction of PReLU Neural Networks

• URL: http://arxiv.org/abs/2509.16620v1
• Date: Sat, 20 Sep 2025 10:43:17 GMT
• Title: Delving into Cryptanalytic Extraction of PReLU Neural Networks
• Authors: Yi Chen, Xiaoyang Dong, Ruijie Ma, Yantian Shen, Anyu Wang, Hongbo Yu, Xiaoyun Wang,
• Abstract summary: PReLU neural networks employ more complex nonlinear activation functions than their ReLU counterparts.<n>This is the first practical demonstration of PReLU neural network extraction across three distinct attack scenarios.
• Score: 9.335653005772926
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: The machine learning problem of model extraction was first introduced in 1991 and gained prominence as a cryptanalytic challenge starting with Crypto 2020. For over three decades, research in this field has primarily focused on ReLU-based neural networks. In this work, we take the first step towards the cryptanalytic extraction of PReLU neural networks, which employ more complex nonlinear activation functions than their ReLU counterparts. We propose a raw output-based parameter recovery attack for PReLU networks and extend it to more restrictive scenarios where only the top-m probability scores are accessible. Our attacks are rigorously evaluated through end-to-end experiments on diverse PReLU neural networks, including models trained on the MNIST dataset. To the best of our knowledge, this is the first practical demonstration of PReLU neural network extraction across three distinct attack scenarios.

Related papers

• Navigating the Deep: Signature Extraction on Deep Neural Networks [7.13570508245734]
  Neural network model extraction has emerged as an important security concern.<n>Prior work introduced a technique inspired by differential cryptanalysis to extract neural network parameters.<n>We revisit and refine the signature extraction process by systematically identifying and addressing for the first time critical limitations of Carlini et al.'s signature extraction method.
  arXiv  Detail & Related papers  (2025-06-20T14:59:47Z)
• Hard-Label Cryptanalytic Extraction of Neural Network Models [10.568722566232127]
  We propose the first attack that theoretically achieves functionally equivalent extraction under the hard-label setting. The effectiveness of our attack is validated through practical experiments on a wide range of ReLU neural networks.
  arXiv  Detail & Related papers  (2024-09-18T02:17:10Z)
• Benign Overfitting for Two-layer ReLU Convolutional Neural Networks [60.19739010031304]
  We establish algorithm-dependent risk bounds for learning two-layer ReLU convolutional neural networks with label-flipping noise. We show that, under mild conditions, the neural network trained by gradient descent can achieve near-zero training loss and Bayes optimal test risk.
  arXiv  Detail & Related papers  (2023-03-07T18:59:38Z)
• Robust Training and Verification of Implicit Neural Networks: A Non-Euclidean Contractive Approach [64.23331120621118]
  This paper proposes a theoretical and computational framework for training and robustness verification of implicit neural networks. We introduce a related embedded network and show that the embedded network can be used to provide an $ell_infty$-norm box over-approximation of the reachable sets of the original network. We apply our algorithms to train implicit neural networks on the MNIST dataset and compare the robustness of our models with the models trained via existing approaches in the literature.
  arXiv  Detail & Related papers  (2022-08-08T03:13:24Z)
• Validation of RELU nets with tropical polyhedra [7.087237546722617]
  We present an approach that abstracts ReLU feedforward neural networks using tropical polyhedra. We show how the connection between ReLU networks and tropical rational functions can provide approaches for range analysis of ReLU neural networks.
  arXiv  Detail & Related papers  (2021-07-30T06:22:59Z)
• And/or trade-off in artificial neurons: impact on adversarial robustness [91.3755431537592]
  Presence of sufficient number of OR-like neurons in a network can lead to classification brittleness and increased vulnerability to adversarial attacks. We define AND-like neurons and propose measures to increase their proportion in the network. Experimental results on the MNIST dataset suggest that our approach holds promise as a direction for further exploration.
  arXiv  Detail & Related papers  (2021-02-15T08:19:05Z)
• Measuring Model Complexity of Neural Networks with Curve Activation Functions [100.98319505253797]
  We propose the linear approximation neural network (LANN) to approximate a given deep model with curve activation function. We experimentally explore the training process of neural networks and detect overfitting. We find that the $L1$ and $L2$ regularizations suppress the increase of model complexity.
  arXiv  Detail & Related papers  (2020-06-16T07:38:06Z)
• Feature Purification: How Adversarial Training Performs Robust Deep Learning [66.05472746340142]
  We show a principle that we call Feature Purification, where we show one of the causes of the existence of adversarial examples is the accumulation of certain small dense mixtures in the hidden weights during the training process of a neural network. We present both experiments on the CIFAR-10 dataset to illustrate this principle, and a theoretical result proving that for certain natural classification tasks, training a two-layer neural network with ReLU activation using randomly gradient descent indeed this principle.
  arXiv  Detail & Related papers  (2020-05-20T16:56:08Z)
• Neural Networks and Value at Risk [59.85784504799224]
  We perform Monte-Carlo simulations of asset returns for Value at Risk threshold estimation. Using equity markets and long term bonds as test assets, we investigate neural networks. We find our networks when fed with substantially less data to perform significantly worse.
  arXiv  Detail & Related papers  (2020-05-04T17:41:59Z)
• A Deep Conditioning Treatment of Neural Networks [37.192369308257504]
  We show that depth improves trainability of neural networks by improving the conditioning of certain kernel matrices of the input data. We provide versions of the result that hold for training just the top layer of the neural network, as well as for training all layers via the neural tangent kernel.
  arXiv  Detail & Related papers  (2020-02-04T20:21:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.