Algebraic Attack on Convolutional Neural Networks with Max Pooling

2026-08-08

AI Summary

This work addresses the challenge of extracting parameters from convolutional neural networks (CNNs) containing max-pooling layers, which existing black-box attacks fail to handle effectively due to the nonlinearity introduced by pooling that disrupts conventional parameter extraction techniques designed for fully connected networks. The paper presents the first dedicated parameter extraction attack against such CNNs, leveraging algebraic modeling to identify two critical types of boundary points—ReLU-Pooling Critical Points (RPCPs) and Pooling Switch Points (PSPs). By integrating ideas from cryptographic internal differential analysis with pattern-matching techniques, the method efficiently recovers both weights and biases. Empirical validation on architectures like LeNet-5 demonstrates its effectiveness across models trained on MNIST, CIFAR-10, and random data, achieving high extraction accuracy with polynomial query complexity.

Abstract

Recovering the weights and biases of deep neural networks (DNNs) via black-box input-output queries, known as parameter extraction attacks, has been extensively studied for ReLU-based fully connected neural networks (FCNNs), but remains unexplored for convolutional neural networks (CNNs) with the max pooling function, a core architecture for computer vision and multimedia processing. The key challenge lies in the CNN max pooling layer, which introduces an additional non-linearity and hides ReLU critical points, rendering existing FCNN extraction methods inapplicable. To address this gap, we propose the first cryptanalytic extraction attack tailored for CNNs with the max pooling function. First, we establish an algebraic representation of CNNs, formally proving that CNNs are piecewise linear functions enabling the extension of linearity-based extraction principles. We then identify two novel types of critical points in CNNs: ReLU-Pooling Critical Points (RPCPs) and Pooling Switching Points (PSPs). We design complementary extraction techniques: a pattern matching method for RPCPs to recover partial signatures and signs, and an internal differential extraction attack for PSPs, inspired by cryptographic internal differential analysis, to recover high-accuracy signatures. Given that PSPs are far more abundant than RPCPs and yield a highly efficient extraction method, and that RPCPs are indispensable for bias recovery, we integrate both methods: the PSP method enables efficient signature extraction, while a single RPCP recovers the sign and bias. We evaluate our attack on multiple CNN architectures, including modern adaptations of LeNet-5, trained on random data, MNIST, and CIFAR-10. Experimental results demonstrate that our approach achieves high extraction accuracy with polynomial query complexity and runtime, even for deep CNN layers. This work fills a research gap in CNN security.

Problem

• parameter extraction attack
• convolutional neural networks
• max pooling
• black-box attack
• neural network security

Innovation

• algebraic attack
• parameter extraction
• convolutional neural networks
• max pooling
• critical points