Research map / Adversarial robustness and security / Attacks on text and graphs
Train to Defend: First Defense Against Cryptanalytic Neural Network Parameter Extraction Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes extraction-aware training, adding an intra-layer neuron weight similarity regularizer to the loss, as the first defense against cryptanalytic ReLU MLP parameter extraction attacks, with zero inference overhead and a theoretical attack-success bound.
Problem
Cryptanalytic parameter extraction attacks can recover ReLU MLP weights from black-box queries in polynomial time, and no countermeasure existed; prior attack evaluations also used an arbitrary runtime threshold to define success.
Approach
Add a regularization term to the training loss that minimizes pairwise distances between neuron weights within a layer, making neurons activate together so the signature extraction cannot isolate individual neurons; also derive a probability bound on attack success as a function of neuron dissimilarity.
Key results
- Defended models keep accuracy change within 1% (e.g., MNIST784-16x8-1 drops 0.92%) while previously broken models were extracted in 14 minutes to 4 hours.
- For MNIST784-16x8-1(s2), attack success probability drops from 0.74 for baseline to 0.0017 for the secure model, a 435x decrease.
- Secure models' first-layer weight variance drops to 0.08 from 0.43 in the baseline.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add intra-layer neuron similarity regularization during training | MNIST784-16x8-1 (s2) · MNIST784-16x8-1 (s2) | attack success probability: 0.74 -> 0.0017 | Helped |
| Add intra-layer neuron similarity regularization during training | MNIST784-16x8-1 (s2) · MNIST784-16x8-1 (s2) | accuracy change (%): -0.92 | Mixed |
| Add intra-layer neuron similarity regularization during training | MNIST784-16x3-1 (s1) · MNIST784-16x3-1 (s1) | accuracy change (%): +0.43 | Helped |
| Add intra-layer neuron similarity regularization during training | Previously studied attack settings · Cryptanalytic parameter extraction | extraction resistance: 48 hours | Helped |
| Protect only the first layer with similarity regularization | Layer-wise cryptanalytic extraction · Subsequent-layer parameter extraction | attack success | Helped |
Surprising findings
- Some defended models slightly improve accuracy (e.g., MNIST784-16x3-1(s1) +0.43%).
Limitations
- Accuracy drops of up to about 1% for some configurations.
- Evaluated only on MLPs with piecewise linear activations and MNIST/random data; cryptanalytic attacks not demonstrated on CNNs or LLMs.
- Does not improve theoretical security; the defense only increases practical search complexity of critical points.
Experimental setup
Datasets: MNIST random data
Benchmarks: MNIST
Metrics: test accuracy change (%) signature extraction time (s) sign extraction time (s) number of queries attack success probability
Baselines: Carlini et al. signature extraction Canales-Martinez et al. sign extraction Foerster et al. end-to-end extraction
Builds on: cryptanalytic signature extraction (Carlini et al.) sign recovery (Canales-Martinez et al.) end-to-end extraction (Foerster et al.)
Closest papers by meaning
- Dynamic Neural Fortresses: An Adaptive Shield for Model Extraction Defense (ICLR 2025 · similarity 0.88)
- Beyond Slow Signs in High-fidelity Model Extraction (NeurIPS 2024 · similarity 0.88)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.85)
- HoneypotNet: Backdoor Attacks Against Model Extraction (AAAI 2025 · similarity 0.85)
- Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.84)
- Efficient Model Stealing Defense with Noise Transition Matrix (CVPR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.