Extracting Some Layers of Deep Neural Networks in the Hard-Label Setting

Isaac A. Canales-Martínez; David Santos

Paper 2025/1118

Extracting Some Layers of Deep Neural Networks in the Hard-Label Setting

Isaac A. Canales-Martínez

, Technology Innovation Institute

David Santos, State University of Campinas

Abstract

Although studied for several years now, parameter extraction of Deep Neural Networks (DNNs) has seen the major advances only in recent years. Carlini et al. (Crypto 2020) and Canales-Martínez et al. (Eurocrypt 2024) showed how to extract the parameters of ReLU-based DNNs efficiently (polynomial time and polynomial number of queries, as a function on the number of neurons) in the raw-output setting, i.e., when the attacker has access to the raw output of the DNN. On the other hand, the more realistic hard-label setting gives the attacker access only to the most likely label after the DNN's raw output has been processed. Recently, Carlini et al. (Eurocrypt 2025) presented an efficient parameter extraction attack in the hard-label setting applicable to DNNs having a large number of parameters. The work in Eurocrypt 2025 recovers the parameters of all layers except the output layer. The techniques presented there are not applicable to this layer due to its lack of ReLUs. In this work, we fill this gap and present a technique that allows recovery of the output layer. Additionally, we show parameter extraction methods that are more efficient when the DNN has contractive layers, i.e., when the number of neurons decreases in those layers. We successfully apply our methods to some networks trained on the CIFAR-10 dataset. Asymptotically, our methods have polynomial complexity in time and number of queries. Thus, a complete extraction attack combining the techniques by Carlini et al. and ours remains with polynomial complexity. Moreover, real execution time is decreased when attacking DNNs with the required contractive architecture.

Note: Added URL for source code.

Metadata

Available format(s): PDF
Category: Attacks and cryptanalysis
Publication info: Published elsewhere. LATINCRYPT 2025
DOI: 10.1007/978-3-032-06754-8_15
Keywords: ReLU-Based Deep Neural Networks Neural Network Extraction Hard-label Attack
Contact author(s): icanalesm0500 @ gmail com
d261032 @ dac unicamp br
History: 2026-02-16: revised; 2025-06-13: received; See all versions
Short URL: https://ia.cr/2025/1118
License: CC BY

BibTeX

@misc{cryptoeprint:2025/1118,
      author = {Isaac A. Canales-Martínez and David Santos},
      title = {Extracting Some Layers of Deep Neural Networks in the Hard-Label Setting},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/1118},
      year = {2025},
      doi = {10.1007/978-3-032-06754-8_15},
      url = {https://eprint.iacr.org/2025/1118}
}