Search papers, labs, and topics across Lattice.
This paper reformulates the state-of-the-art neural network model extraction attack in the hard-label setting into an algebraic framework, significantly improving computational efficiency. By introducing the Approximate Signature Vector (ASV) method, the authors reduce the clustering complexity from $\mathcal{O}(n^2 \cdot (d^{(k)})^3)$ to $\mathcal{O}(n \cdot (d^{(k)})^3)$ on average, while also successfully extending the attack to hard-label max-pooling CNNs. Experimental results on both Fully Connected Neural Networks and LeNet-5 show that the ASV method drastically reduces clustering time and enhances overall extraction efficiency.
A novel algebraic approach to model extraction cuts clustering time by over 90%, enabling efficient attacks on hard-label max-pooling CNNs.
Although the state-of-the-art neural network model extraction attack in the hard-label setting by Carlini et al. at EUROCRYPT 2025 has polynomial-time complexity in theory, its dual-point clustering relies on singular value decomposition (SVD) with a time complexity of $\mathcal{O}(n^2 \cdot (d^{(k)})^3)$, resulting in huge runtime in practice. To address this computational bottleneck, this work transforms Carlini et al.'s geometric-view hard-label attack into an algebraic framework, and proposes a novel Approximate Signature Vector (ASV) method to achieve efficient parameter extraction on Fully Connected Neural Networks (FCNNs) by leveraging two key observations: high-dimensional random vectors are nearly orthogonal, and neurons in practical DNNs tend to learn disentangled features. The proposed ASV method replaces SVD-based rank checking with simple inner-product operations, reducing the clustering complexity to $\mathcal{O}(n \cdot (d^{(k)})^3)$ on average. Furthermore, this paper presents the first model extraction attack against hard-label max-pooling Convolutional Neural Networks (CNNs) by proposing an advanced ASV method with a kernel-centric clustering scheme instead of the neuron-centric clustering, which fully exploits the property of weight sharing in convolutions and fills the cryptanalysis gap. Experiments on a 64-64$\times$4-10 FCNN and LeNet-5 (CNN) with max pooling demonstrate that our ASV method drastically cuts clustering time, and improves the overall efficiency in the model extraction.
