Navigating the Deep: End-to-End Extraction on Deep Neural Networks

1. Problem Statement

The paper addresses the critical security vulnerability of Neural Network Model Extraction, where an adversary attempts to recover the internal parameters (weights and biases) of a Deep Neural Network (DNN) using only black-box queries (input-output pairs).

While previous state-of-the-art methods (specifically Carlini et al., CRYPTO'20 and Canales-Martínez et al., Eurocrypt'24) successfully extracted parameters for shallow networks, they failed to scale to deep networks (beyond 3 hidden layers). The authors identify two primary bottlenecks preventing deeper extraction:

1. Signature Extraction Failure: The method for recovering the absolute values of weights (signatures) breaks down in deeper layers due to rank deficiency in the linear systems used for calculation and noise propagation from deeper layers being misidentified as target-layer signatures.
2. Sign Extraction Failure: The method for determining the signs of weights (sign extraction) relies on "neuron wiggle" techniques that fail for "low-confidence" neurons. Previous solutions required exponential exhaustive search, making the attack infeasible for large networks.

2. Methodology

The authors propose a refined, end-to-end extraction framework that operates in polynomial time. The methodology is divided into three main technical pillars:

A. Improving Signature Extraction

The authors systematically address the limitations of the original signature extraction algorithm:

• Addressing Rank Deficiency (Subspace Intersections): In deep networks, the linear system used to solve for weights often becomes underdetermined (rank-deficient) because earlier layers block information flow. The authors propose intersecting the solution spaces of multiple critical points. By solving for the intersection of subspaces ($S_x \cap S_{x'}$), they can uniquely determine the weight vector up to a scaling factor, even when individual points yield underdetermined systems.
• Filtering Deeper Layer Noise: The original method assumed that merged components of size $>2$ must belong to the target layer. The authors prove this false: critical points from deeper layers can also merge. They propose a two-step filtering strategy:
  1. Discarding Deeper Points: Verifying if a critical point's hyperplane bends on a layer that has not yet been extracted.
  2. Discarding Deeper Components: Using a "noise ratio" metric (merges with deeper points vs. component size) and size thresholds to filter out components originating from deeper layers.
• Numerical Precision Enhancements: To combat floating-point errors accumulating across layers, they introduce:
  • Normalization: Scaling columns of the linear system to $[-1, 1]$ to prevent ill-conditioning caused by disparate scaling factors.
  • Flat Region Avoidance: Discarding critical points found in "flat" regions where derivative changes are minimal, as these yield imprecise intersection points.

B. Confident Sign Extraction (SOE + Wiggle)

To avoid exponential exhaustive search for low-confidence neurons, the authors combine two polynomial-time methods:

• System of Equations (SOE): Solves for signs of multiple neurons simultaneously but requires a high-rank system.
• Neuron Wiggle: Determines signs individually but fails on low-confidence neurons.
• The Hybrid Strategy (SOE+Wiggle): The authors use the "Neuron Wiggle" to identify high-confidence neurons and fix their signs (treating them as knowns). They then use these fixed signs to increase the rank of the SOE system, allowing them to solve for the remaining low-confidence neurons deterministically. They also propose an "Extension Strategy" that builds the SOE system over a large zone of input space rather than a single point, further increasing system rank.

C. End-to-End Execution

Unlike previous works that assumed signatures were already perfect, this method runs the signature extraction, precision refinement, and sign extraction iteratively from the first layer to the last, ensuring that errors do not compound catastrophically.

3. Key Contributions

1. Diagnosis of Deep Extraction Failures: The paper is the first to formally identify and explain why signature extraction fails in deep networks (rank deficiency and deeper-layer noise merging), correcting previous misconceptions.
2. Polynomial-Time End-to-End Attack: They present the first model extraction method that runs in polynomial time for deep networks, eliminating the need for exponential exhaustive searches on low-confidence neurons.
3. Algorithmic Innovations:
   • Subspace intersection for rank-deficient systems.
   • Noise filtering based on noise ratios and component sizes.
   • A hybrid sign-extraction strategy (SOE+Wiggle) that achieves high confidence without exhaustive search.
4. New Evaluation Metrics: Introduction of "Coverage" (the proportion of the input space where all effective weights are recovered) and a taxonomy of unrecovered weights (non-effective, unreachable, and query-intensive) to provide a more accurate assessment of extraction quality than simple weight-counting.

4. Experimental Results

The authors validated their attack on ReLU-based networks trained on MNIST and CIFAR-10 datasets with architectures up to 8 hidden layers.

• Depth Capability: Previous works (e.g., Foerster et al.) failed to recover the 4th layer of an 8-layer network even after 36 hours. The proposed method successfully extracts all 8 layers.
• Accuracy:
  • On an 8-layer MNIST network (784-8(8)-1), they recovered 99.68% of effective weights with a relative error $\epsilon \le 2.96 \times 10^{-5}$ on 74.82% of the input space.
  • On an 8-layer CIFAR-10 network (3072-8(8)-10), they recovered 99.90% of effective weights.
• Efficiency: The attack is significantly faster than previous attempts. For the 8-layer CIFAR-10 model, the total extraction time was approximately 19 hours, whereas previous attempts on similar depths failed or required exponential time for sign recovery.
• Sign Recovery: The SOE+Wiggle method achieved 100% correct sign extraction across all layers for the tested models, whereas the "Neuron Wiggle" alone failed on layers 2–5 of the CIFAR-10 model.

5. Significance

This work represents a crucial milestone in the security of Deep Neural Networks:

• Practical Threat: It demonstrates that deep, complex neural networks (previously thought secure against full parameter recovery) are vulnerable to polynomial-time black-box attacks.
• Theoretical Advancement: It resolves the long-standing bottleneck of "low-confidence" neurons and rank deficiency, proving that full end-to-end extraction is theoretically and practically feasible without exponential complexity.
• Future Implications: The findings suggest that current defenses relying on hiding confidence scores or limiting query depth may be insufficient. It necessitates the development of new robust training techniques or architectural defenses specifically designed to prevent weight recovery in deep networks.

In summary, "Navigating the Deep" transforms model extraction from a theoretical curiosity limited to shallow networks into a practical, scalable threat against modern deep learning architectures.