Research map / Architectures and efficiency / RNNs and normalization
Beyond Slow Signs in High-fidelity Model Extraction
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Unifies cryptanalytic signature and sign extraction codebases for DNNs and optimizes sign extraction (easy/hard neurons, pipelined parallel sign checks, deduplication, lower precision) so that weight extraction, not sign extraction, becomes the bottleneck, extracting a 16,721-parameter MNIST model in 98 minutes.
Problem
Precise model extraction (functionally equivalent weight recovery) of deep ReLU networks trained on standard benchmarks is slow; prior claims that sign extraction is the bottleneck and prior benchmarks on random data may be misleading.
Approach
Builds a unified codebase combining Carlini et al.'s signature extraction with Canales-Martinez et al.'s Neuron Wiggle sign extraction, reduces sign-extraction samples to s=15, defers low-confidence ("hard") neuron signs by enumerating sign combinations and checking the next layer's extraction for errors, and drops float64 precision improvement for sign recovery.
Key results
- Sign extraction sped up by up to 14.8x (up to 16.40x vs CM in table) and total parameter extraction by up to 2.52x for random models.
- A 16,721-parameter MNIST model with 2 hidden layers is extracted in 98 minutes versus at least 150 minutes previously.
- With the optimisations, signature extraction (not sign extraction) becomes the dominant cost; sign extraction is as little as 0.002% of total time for larger models.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Reduce sign-extraction iterations to s=15 and identify easy and hard neurons (ablation) | Canales-Martinez sign extraction · Random models, layer 2 | sign-extraction speedup: up to $14.8$ times | Helped |
| Use the proposed sign extraction instead of Canales-Martinez sign extraction | Parameter extraction pipeline · Random models, layer 2 | total extraction speedup: up to $2.52$ times | Helped |
| Add memory deduplication of redundant critical points and partial signatures (ablation) | Signature extraction · Random model, layer 2, 128 neurons per hidden layer | time efficiency: $1.3$ times more time-efficient | Helped |
| Add memory deduplication of redundant critical points and partial signatures (ablation) | Signature extraction · MNIST model, layer 2, 64 neurons | time efficiency: $2$ times as time efficient | Helped |
| Increase sign-extraction iterations beyond s=15 (ablation) | Neuron Wiggle sign extraction · Models evaluated in Figure (b) | correctly recovered neurons: s=15; s=25 | No clear effect |
| Perform sign extraction with extracted weights in float32 rather than float64 (ablation) | Neuron Wiggle sign extraction · MNIST models | sign-recovery correctness | No clear effect |
| Skip precision improvement before subsequent extraction (ablation) | Parameter extraction pipeline · Models in the performance table | overall extraction speedup: [1.36, 6.01, 3.44, 2.64, 3.60, 2.94, 6.63, 2.52, 2.08, 2.18] | Helped |
| Spend more time repeating sign extraction for hard-to-extract neurons (ablation) | Neuron Wiggle sign extraction · Neuron sign prediction | correct sign recovery | No clear effect |
| Flip one hard-to-extract neuron sign (ablation) | CIFAR10 model with 8 hidden layers and 128 neurons · CIFAR10 test set | accuracy: 0.9451 | Hurt |
| Flip 5 hard-to-extract neuron signs (ablation) | CIFAR10 model with 8 hidden layers and 128 neurons · CIFAR10 test set | accuracy: between 0.55 and 0.68 | Hurt |
| Flip 28 hard-to-extract neuron signs (ablation) | CIFAR10 model with 8 hidden layers and 128 neurons · CIFAR10 test set | accuracy: 0.268 | Hurt |
Surprising findings
- Contrary to prior assumptions, sign extraction is not the bottleneck after Canales-Martinez's method; weight (signature) extraction dominates.
- A single incorrect neuron sign flip in a CIFAR10 model drops test accuracy to 0.9451, and 28 flips reduce it to 0.268.
Limitations
- Extraction of deeper MNIST models (e.g., 8 hidden layers) exceeded 36 hours for later layers, so deeper models remain infeasible.
- Results vary strongly with training and extraction random seeds, hampering replicability.
- Some neurons' signs remain uncertain and rely on error checks in the next layer; about 30% of cases may need an extra round.
Experimental setup
Datasets: MNIST CIFAR10 random normal data
Benchmarks: MNIST CIFAR10
Metrics: extraction time (s) number of queries fraction of correctly recovered signs signature extraction time speedup factor test accuracy after sign flips
Baselines: Carlini et al. signature extraction Canales-Martinez et al. sign extraction (CM)
Builds on: Carlini et al. cryptanalytic parameter extraction Canales-Martinez et al. Neuron Wiggle sign extraction
Closest papers by meaning
- Train to Defend: First Defense Against Cryptanalytic Neural Network Parameter Extraction Attacks (NeurIPS 2025 · similarity 0.88)
- HoneypotNet: Backdoor Attacks Against Model Extraction (AAAI 2025 · similarity 0.85)
- CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisition (ICML 2025 · similarity 0.84)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.84)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.84)
- Sim4Rec: Data-Free Model Extraction Attack on Sequential Recommendation (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.