Paper 2026/1025

Geometric Critical Point Screening: Clustering-Free Cryptanalytic Extraction of Neural Network Models

Abstract

Neural network model extraction has recently emerged as a critical security issue. In 2020, Carlini et al. categorized model extraction into signature extraction and sign extraction. In 2024, Canales-Martínez et al. proposed a polynomial-time sign extraction method. In 2026, Liu et al. achieved the first successful model extraction of 8-layer deep neural networks. However, existing signature extraction methods follow an inefficient compute-first, cluster-later paradigm: they first compute signatures for massive candidate critical points of unknown layer provenance, then separate points from different layers via clustering, which incurs prohibitive query and computational overhead. This paper presents a geometric relationship-based critical point screening method. By searching for critical points on three coplanar parallel lines, we can rapidly separate critical points of first hidden layer neurons with minimal signature extraction, reducing the query complexity of signature extraction from $O(N \log N \cdot d_0)$ to $O(d_1\cdot d_0)$. For neural networks where the input dimension exceeds the first hidden layer dimension, we can further achieve efficient screening of second hidden layer critical points by searching on three coplanar line segments within a fully activated space where all first hidden layer neurons are activated. Geometric Critical Point Screening only requires computing signatures for a small number of non-target critical points. It offers advantages including low query cost and automatic validation of contaminated critical points. Experiments on a $784-8^{(8)}-1$ network demonstrate that the time required for signature extraction of first and second hidden layer neurons is only 1.7\% and 3.7\% of existing methods, respectively, with query cost reduced to 3.2\% and 0.1\% of state-of-the-art approaches. Furthermore, this method is not limited to ReLU activation and can be extended to other piecewise linear activation functions, providing a fundamental and general lightweight approach for neural network model extraction.