Cryptanalytic Extraction of Neural Networks Without Known Architecture Assumption

2026-09-13

AI Summary

本文提出了一种无需已知网络架构即可恢复ReLU全连接神经网络架构和参数的猜测-确定框架，通过识别两种架构敏感痕迹实现。

Abstract

Cryptanalytic extraction attacks recover the parameters of a neural network given only black-box access to its raw output. However, all existing attacks rely on a fundamental assumption: the attacker knows the network architecture. For example, regarding ReLU activation-based fully connected networks, the network depth and the dimension of each hidden layer are known. In this paper, we study whether this assumption can be removed. We focus on ReLU fully connected networks and propose a guess-and-determine framework that recovers the architecture and the parameters jointly. The core of our approach is a simple but powerful observation: dimension guessing leaves architecture-sensitive traces in the parameter recovery process. We identify two such traces: (i) a \emph{zero suffix} in the merged weight vectors produced by signature recovery, whose length reveals the number of excess guesses; and (ii) an \emph{equality pattern} in the preimage-based sign recovery, which occurs only when the dimension guess is correct. These two signals give rise to two complementary recovery routes. We further propose two criteria for identifying the second-to-last layer, which is necessary for terminating the guessing process. We implement end-to-end attacks on a wide range of ReLU networks, including both expansive and non-expansive architectures. To the best of our knowledge, this is the first cryptanalytic extraction attack that removes the assumption of known network architecture.

Problem

• cryptanalytic extraction
• neural networks
• unknown architecture
• black-box access
• ReLU

Innovation

• guess-and-determine framework
• architecture recovery
• ReLU networks
• zero suffix
• equality pattern