Curvature Cryptanalysis of Smooth Transformer Feed-Forward Networks

• URL: http://arxiv.org/abs/2608.28843v1
• Date: Fri, 28 Aug 2026 20:26:07 GMT
• Title: Curvature Cryptanalysis of Smooth Transformer Feed-Forward Networks
• Abstract summary: We show that smooth two-layer feed-forward networks (FFNs) expose an additional structural model extraction channel.<n>We exploit a second-order leakage channel in which projected input Hessians form different mixtures of the same hidden symmetric rank-one factors.<n>On independently trained CIFAR-10 vision transformers, only 16 projected Hessians, corresponding to 8193 black-box queries, recover the hidden FFN directions.
• Score: 0.20313422213594776
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We show that smooth two-layer feed-forward networks (FFNs) expose an additional structural model extraction channel under a chosen-input raw-output oracle at the FFN branch; consider transformer FFN branches with GELU or SiLU activations under chosen-input raw-output access, without access to parameters, gradients, or internal activations; exploit a second-order leakage channel in which projected input Hessians form different mixtures of the same hidden symmetric rank-one factors induced by the FFN input weights. We formalize resulting Hessian collection as a partially symmetric decomposition to establish conditions for local identifiability and stability to exploit vector-output stencil reuse to reduce the structural query cost by a factor of 16. On independently trained CIFAR-10 vision transformers, only 16 projected Hessians, corresponding to 8193 black-box queries, recover the hidden FFN directions with average absolute cosine alignment above 0.94, with 95.1 % of GELU and 91.9 % of SiLU directions exceeding 0.90 alignment. Recovery remains high across independently trained models, repeated extraction runs, and all transformer blocks. The recovered structure supports functional extraction too. Keeping the recovered directions fixed and fitting only the remaining FFN parameters yields high-fidelity substitutes with more than 93 % top-1 agreement, while test accuracy remains within 0.90% and 0.62% of the GELU and SiLU targets. Output rounding and Gaussian noise substantially reduce recovery under a fixed attack configuration, but adapting the finite-difference step restores average alignment to 0.9603 and 0.9398. This is an end-to-end path from black-box second-order observations to hidden FFN-structure recovery and functional replacement. Under the stated oracle model, smooth FFN curvature exposes internal parameter geometry that behavioral fidelity alone cannot reveal.

Related papers

• Scale-Consistent Posterior Dynamics for Diffusion Inverse Problems [16.685352002333225]
  Posterior sampling with a pretrained diffusion prior is governed by a conditional score whose likelihood component is generally intractable.<n>We show that a noise-conditioned path whose targets approach the clean posterior produces a continuous surrogate SDE.<n>Experiments on FFHQ and ImageNet with 100 score evaluations demonstrate competitive reconstruction fidelity for superresolution and deblurring.
  arXiv  Detail & Related papers  (2026-08-15T09:38:41Z)
• Support Operation Factorization: Compositional Readout of Frozen Vision Encoders under Controlled Interventions [87.95757610455173]
  We introduce an injectively aligned leave-one-cell-out protocol over support x operation grids and SO-OPF.<n>We separate two questions that aggregate scores conflate: whether the carrier composes held-out bindings when the grid is known, and whether that grid can be recovered from flat cell labels.
  arXiv  Detail & Related papers  (2026-08-06T15:38:55Z)
• Post-Operative Glioma Segmentation via Loss Stabilization, Normalization and Subspace Attention [46.03321798937855]
  We show that the standard Generalized Dice Loss (GDL) is unstable under domain shift.<n>We propose a Subspace-Aware Class Attention (SACA) module that re-calibrates the bottleneck features and raises Enhancing Tumor (ET) sensitivity by 8%.
  arXiv  Detail & Related papers  (2026-07-23T09:59:30Z)
• The Rescue Effect: Spatio-Semantic Early Exit Bypasses Quantization Collapse in CLIP [6.450516062706025]
  In joint-embedding architectures such as CLIP this introduces a failure mode distinct from quantized CNN classifiers.<n>We characterize this as Quantization-Induced Representation Collapse (QIRC) and quantify it on INT8 replacing CLIP ViT-B/32.<n>We propose LRA-EE (Layer-wise Representation-Aware Early Exit), which bypasses noise-saturated deep layers.<n>On ImageNet-1K zero-shot classification, LRA-EE reduces FLOPs by 13.4% and improves Top-1 accuracy by +2.44%p (58.72% -> 61.16%) over the INT8 baseline
  arXiv  Detail & Related papers  (2026-05-26T00:45:46Z)
• Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams [0.0]
  Harmful intent is geometrically recoverable from large language model residual streams.<n>We characterise this geometry through six direction-finding strategies.<n>A direction fitted on AdvBench transfers to held-out HarmBench and JailbreakBench with worst-case AUROC 0.96.
  arXiv  Detail & Related papers  (2026-04-20T23:02:37Z)
• Self-Adversarial One Step Generation via Condition Shifting [11.426065945265647]
  APEX is a framework for adversarial correction signals extracted endogenously from a flow model.<n>Our 0.6B model surpasses FLUX-Schnell 12B (20$times$ more parameters) in one step quality.<n>With LoRA tuning on Qwen-Image 20B, APEX reaches a GenEval score of 0.89 at NFE=1 in 6 hours, surpassing the original 50-step teacher (0.87) and providing a 15.33$times$ inference speedup.
  arXiv  Detail & Related papers  (2026-04-14T05:54:33Z)
• BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learning [73.46118996284888]
  Research on backdoor attacks against multimodal contrastive learning models faces two key challenges: stealthiness and persistence.<n>We propose BadCLIP++, a unified framework that tackles both challenges.<n>For stealthiness, we introduce a semantic-fusion QR micro-trigger that embeds imperceptible patterns near task-relevant regions.<n>For persistence, we stabilize trigger embeddings via radius shrinkage and centroid alignment.
  arXiv  Detail & Related papers  (2026-02-19T08:31:16Z)
• Unbiased Gradient Estimation for Event Binning via Functional Backpropagation [64.88399635309918]
  We propose a novel framework for unbiased gradient estimation of arbitrary binning functions by synthesizing weak derivatives during backpropagation.<n>We achieve 9.4% lower EPE in self-supervised optical flow, and 5.1% lower RMS error in SLAM, demonstrating broad benefits for event-based visual perception.
  arXiv  Detail & Related papers  (2026-02-13T04:05:03Z)
• Function-Space Decoupled Diffusion for Forward and Inverse Modeling in Carbon Capture and Storage [65.51149575007149]
  We present Fun-DDPS, a generative framework that combines function-space diffusion models with differentiable neural operator surrogates for both forward and inverse modeling.<n>Fun-DDPS produces physically consistent realizations free from the high-frequency artifacts observed in joint-state baselines.
  arXiv  Detail & Related papers  (2026-02-12T18:58:12Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.