Cryptanalytic Extraction of Neural Networks Without Known Architecture Assumption

• URL: http://arxiv.org/abs/2609.14379v1
• Date: Sun, 13 Sep 2026 08:28:34 GMT
• Title: Cryptanalytic Extraction of Neural Networks Without Known Architecture Assumption
• Abstract summary: Existing attacks rely on a fundamental assumption: the attacker knows the network architecture.<n>We propose a guess-and-determine framework that recovers the architecture and the parameters jointly.<n>This is the first cryptanalytic extraction attack that removes the assumption of known network architecture.
• Score: 8.049549094546977
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Cryptanalytic extraction attacks recover the parameters of a neural network given only black-box access to its raw output. However, all existing attacks rely on a fundamental assumption: the attacker knows the network architecture. For example, regarding ReLU activation-based fully connected networks, the network depth and the dimension of each hidden layer are known. In this paper, we study whether this assumption can be removed. We focus on ReLU fully connected networks and propose a guess-and-determine framework that recovers the architecture and the parameters jointly. The core of our approach is a simple but powerful observation: dimension guessing leaves architecture-sensitive traces in the parameter recovery process. We identify two such traces: (i) a \emph{zero suffix} in the merged weight vectors produced by signature recovery, whose length reveals the number of excess guesses; and (ii) an \emph{equality pattern} in the preimage-based sign recovery, which occurs only when the dimension guess is correct. These two signals give rise to two complementary recovery routes. We further propose two criteria for identifying the second-to-last layer, which is necessary for terminating the guessing process. We implement end-to-end attacks on a wide range of ReLU networks, including both expansive and non-expansive architectures. To the best of our knowledge, this is the first cryptanalytic extraction attack that removes the assumption of known network architecture.

Related papers

• Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks [0.9099663022952497]
  We investigate whether comparable undetectability extends to modern, end-to-end trained networks.<n>We construct such an attack mechanism for state-of-the-art architectures, closely aligned to the cryptographic notion of undetectability.<n>Our results establish that cryptographic backdoors need not be artefacts requiring exotic architectures or artificial constructions, but identifiable as latent properties inherent to the geometry of learned representations.
  arXiv  Detail & Related papers  (2026-05-13T09:06:25Z)
• Adversarial generalization of unfolding (model-based) networks [0.0]
  We study the adversarial generalization of unfolding networks when perturbed with $l$-norm constrained attacks.<n>This is the first theoretical analysis on the adversarial generalization of unfolding networks.<n>We present a series of experiments on real-world data, with results corroborating our derived theory.
  arXiv  Detail & Related papers  (2025-09-18T19:17:07Z)
• Navigating the Deep: Signature Extraction on Deep Neural Networks [7.13570508245734]
  Neural network model extraction has emerged as an important security concern.<n>Prior work introduced a technique inspired by differential cryptanalysis to extract neural network parameters.<n>We revisit and refine the signature extraction process by systematically identifying and addressing for the first time critical limitations of Carlini et al.'s signature extraction method.
  arXiv  Detail & Related papers  (2025-06-20T14:59:47Z)
• Find A Winning Sign: Sign Is All We Need to Win the Lottery [52.63674911541416]
  We show that a sparse network trained by an existing IP method can retain its basin of attraction if its parameter signs and normalization layer parameters are preserved.<n>To take a step closer to finding a winning ticket, we alleviate the reliance on normalization layer parameters by preventing high error barriers along the linear path between the sparse network trained by our method and its counterpart with normalization layer parameters.
  arXiv  Detail & Related papers  (2025-04-07T09:30:38Z)
• Dual-branch Graph Feature Learning for NLOS Imaging [51.31554007495926]
  Non-line-of-sight (NLOS) imaging offers the capability to reveal occluded scenes that are not directly visible.<n>xnet methodology integrates an albedo-focused reconstruction branch dedicated to albedo information recovery and a depth-focused reconstruction branch that extracts geometrical structure.<n>Our method attains the highest level of performance among existing methods across synthetic and real data.
  arXiv  Detail & Related papers  (2025-02-27T01:49:00Z)
• End-to-End Convolutional Activation Anomaly Analysis for Anomaly Detection [41.94295877935867]
  End-to-end Convolutional Activation Anomaly Analysis (E2E-CA$3$) We propose an End-to-end Convolutional Activation Anomaly Analysis (E2E-CA$3$) It is a significant extension of A$3$ anomaly detection approach proposed by Sperl, Schulze and B"ottinger.
  arXiv  Detail & Related papers  (2024-11-21T10:22:50Z)
• Understanding Reconstruction Attacks with the Neural Tangent Kernel and Dataset Distillation [110.61853418925219]
  We build a stronger version of the dataset reconstruction attack and show how it can provably recover the emphentire training set in the infinite width regime. We show that both theoretically and empirically, reconstructed images tend to "outliers" in the dataset. These reconstruction attacks can be used for textitdataset distillation, that is, we can retrain on reconstructed images and obtain high predictive accuracy.
  arXiv  Detail & Related papers  (2023-02-02T21:41:59Z)
• Towards Bi-directional Skip Connections in Encoder-Decoder Architectures and Beyond [95.46272735589648]
  We propose backward skip connections that bring decoded features back to the encoder. Our design can be jointly adopted with forward skip connections in any encoder-decoder architecture. We propose a novel two-phase Neural Architecture Search (NAS) algorithm, namely BiX-NAS, to search for the best multi-scale skip connections.
  arXiv  Detail & Related papers  (2022-03-11T01:38:52Z)
• Over-and-Under Complete Convolutional RNN for MRI Reconstruction [57.95363471940937]
  Recent deep learning-based methods for MR image reconstruction usually leverage a generic auto-encoder architecture. We propose an Over-and-Under Complete Convolu?tional Recurrent Neural Network (OUCR), which consists of an overcomplete and an undercomplete Convolutional Recurrent Neural Network(CRNN) The proposed method achieves significant improvements over the compressed sensing and popular deep learning-based methods with less number of trainable parameters.
  arXiv  Detail & Related papers  (2021-06-16T15:56:34Z)
• Spatio-Temporal Inception Graph Convolutional Networks for Skeleton-Based Action Recognition [126.51241919472356]
  We design a simple and highly modularized graph convolutional network architecture for skeleton-based action recognition. Our network is constructed by repeating a building block that aggregates multi-granularity information from both the spatial and temporal paths.
  arXiv  Detail & Related papers  (2020-11-26T14:43:04Z)
• Understanding Self-supervised Learning with Dual Deep Networks [74.92916579635336]
  We propose a novel framework to understand contrastive self-supervised learning (SSL) methods that employ dual pairs of deep ReLU networks. We prove that in each SGD update of SimCLR with various loss functions, the weights at each layer are updated by a emphcovariance operator. To further study what role the covariance operator plays and which features are learned in such a process, we model data generation and augmentation processes through a emphhierarchical latent tree model (HLTM)
  arXiv  Detail & Related papers  (2020-10-01T17:51:49Z)
• An Improved Dilated Convolutional Network for Herd Counting in Crowded Scenes [1.7358040670413502]
  We propose an accurate monitoring system composed of two bi-d convolutional deep learning architectures. The proposed model is shown to converge 30% faster than state-of-the-art approaches. It achieves 20% lower Mean Absolute Error (MAE) when applied to the Shanghai dataset.
  arXiv  Detail & Related papers  (2020-08-17T12:31:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.