Algebraic Attack on Convolutional Neural Networks with Max Pooling

• URL: http://arxiv.org/abs/2608.08030v1
• Date: Sat, 08 Aug 2026 09:36:35 GMT
• Title: Algebraic Attack on Convolutional Neural Networks with Max Pooling
• Abstract summary: We propose the first cryptanalytic extraction attack tailored for CNNs with the max pooling function.<n>We identify two novel types of critical points in CNNs: ReLU-Pooling Critical Points (RPCPs) and Pooling Switching Points (PSPs)
• Score: 4.621555619872168
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Recovering the weights and biases of deep neural networks (DNNs) via black-box input-output queries, known as parameter extraction attacks, has been extensively studied for ReLU-based fully connected neural networks (FCNNs), but remains unexplored for convolutional neural networks (CNNs) with the max pooling function, a core architecture for computer vision and multimedia processing. The key challenge lies in the CNN max pooling layer, which introduces an additional non-linearity and hides ReLU critical points, rendering existing FCNN extraction methods inapplicable. To address this gap, we propose the first cryptanalytic extraction attack tailored for CNNs with the max pooling function. First, we establish an algebraic representation of CNNs, formally proving that CNNs are piecewise linear functions enabling the extension of linearity-based extraction principles. We then identify two novel types of critical points in CNNs: ReLU-Pooling Critical Points (RPCPs) and Pooling Switching Points (PSPs). We design complementary extraction techniques: a pattern matching method for RPCPs to recover partial signatures and signs, and an internal differential extraction attack for PSPs, inspired by cryptographic internal differential analysis, to recover high-accuracy signatures. Given that PSPs are far more abundant than RPCPs and yield a highly efficient extraction method, and that RPCPs are indispensable for bias recovery, we integrate both methods: the PSP method enables efficient signature extraction, while a single RPCP recovers the sign and bias. We evaluate our attack on multiple CNN architectures, including modern adaptations of LeNet-5, trained on random data, MNIST, and CIFAR-10. Experimental results demonstrate that our approach achieves high extraction accuracy with polynomial query complexity and runtime, even for deep CNN layers. This work fills a research gap in CNN security.

Related papers

• Efficient Encrypted Computation in Convolutional Spiking Neural Networks with TFHE [1.3047787405425166]
  Homomorphic Encryption (FHE) is a crucial technology for privacy-preserving computation.<n>FHE struggles with continuous non-polynomial functions, as it operates on discrete integers and supports only addition and multiplication.<n>We introduce FHE-DiCSNN, a framework built on the TFHE scheme, utilizing the discrete nature of SNNs for secure and efficient computations.
  arXiv  Detail & Related papers  (2026-03-25T03:15:59Z)
• Peregrine: One-Shot Fine-Tuning for FHE Inference of General Deep CNNs [5.719717928243504]
  We address two fundamental challenges in adapting general deep CNNs for FHE-based inference.<n>The first is approximating non-linear activations such as ReLU with low-degrees while minimizing accuracy degradation.<n>The second is overcoming the cipher capacity barrier that constrains high-resolution image processing on FHE inference.
  arXiv  Detail & Related papers  (2025-11-24T10:47:39Z)
• Dynamic Semantic Compression for CNN Inference in Multi-access Edge Computing: A Graph Reinforcement Learning-based Autoencoder [82.8833476520429]
  We propose a novel semantic compression method, autoencoder-based CNN architecture (AECNN) for effective semantic extraction and compression in partial offloading. In the semantic encoder, we introduce a feature compression module based on the channel attention mechanism in CNNs, to compress intermediate data by selecting the most informative features. In the semantic decoder, we design a lightweight decoder to reconstruct the intermediate data through learning from the received compressed data to improve accuracy.
  arXiv  Detail & Related papers  (2024-01-19T15:19:47Z)
• Deep neural networks have an inbuilt Occam's razor [4.330196787806085]
  We show that structured data combined with an intrinsic Occam's razor-like inductive bias towards simple functions counteracts the exponential growth of functions with complexity.<n>This analysis reveals that structured data, combined with an intrinsic Occam's razor-like inductive bias towards (Kolmogorov) simple functions that is strong enough to counteract the exponential growth of functions with complexity, is a key to the success of DNNs.
  arXiv  Detail & Related papers  (2023-04-13T16:58:21Z)
• Attention-based Feature Compression for CNN Inference Offloading in Edge Computing [93.67044879636093]
  This paper studies the computational offloading of CNN inference in device-edge co-inference systems. We propose a novel autoencoder-based CNN architecture (AECNN) for effective feature extraction at end-device. Experiments show that AECNN can compress the intermediate data by more than 256x with only about 4% accuracy loss.
  arXiv  Detail & Related papers  (2022-11-24T18:10:01Z)
• BreakingBED -- Breaking Binary and Efficient Deep Neural Networks by Adversarial Attacks [65.2021953284622]
  We study robustness of CNNs against white-box and black-box adversarial attacks. Results are shown for distilled CNNs, agent-based state-of-the-art pruned models, and binarized neural networks.
  arXiv  Detail & Related papers  (2021-03-14T20:43:19Z)
• Decentralizing Feature Extraction with Quantum Convolutional Neural Network for Automatic Speech Recognition [101.69873988328808]
  We build upon a quantum convolutional neural network (QCNN) composed of a quantum circuit encoder for feature extraction. An input speech is first up-streamed to a quantum computing server to extract Mel-spectrogram. The corresponding convolutional features are encoded using a quantum circuit algorithm with random parameters. The encoded features are then down-streamed to the local RNN model for the final recognition.
  arXiv  Detail & Related papers  (2020-10-26T03:36:01Z)
• How Neural Networks Extrapolate: From Feedforward to Graph Neural Networks [80.55378250013496]
  We study how neural networks trained by gradient descent extrapolate what they learn outside the support of the training distribution. Graph Neural Networks (GNNs) have shown some success in more complex tasks.
  arXiv  Detail & Related papers  (2020-09-24T17:48:59Z)
• Extension of Direct Feedback Alignment to Convolutional and Recurrent Neural Network for Bio-plausible Deep Learning [0.0]
  We focus on the improvement of the direct feedback alignment (DFA) algorithm. We extend the usage of the DFA to convolutional and recurrent neural networks (CNNs and RNNs) We propose a new DFA algorithm for BP-level accurate CNN and RNN training.
  arXiv  Detail & Related papers  (2020-06-23T08:42:22Z)
• Enhancing Intrinsic Adversarial Robustness via Feature Pyramid Decoder [11.701729403940798]
  We propose an attack-agnostic defence framework to enhance the intrinsic robustness of neural networks. Our framework applies to all block-based convolutional neural networks (CNNs)
  arXiv  Detail & Related papers  (2020-05-06T01:40:26Z)
• Approximation and Non-parametric Estimation of ResNet-type Convolutional Neural Networks [52.972605601174955]
  We show a ResNet-type CNN can attain the minimax optimal error rates in important function classes. We derive approximation and estimation error rates of the aformentioned type of CNNs for the Barron and H"older classes.
  arXiv  Detail & Related papers  (2019-03-24T19:42:39Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.