Cryptanalytic Extraction of Neural Networks Without Known Architecture Assumption
Yantian Shen, Yi Chen, Anyu Wang, Hongbo Yu, Xiaoyun Wang
cs.CR
2026-09-13
Tsinghua recovers ReLU MLP widths and weights from raw black-box outputs without knowing the architecture; every tested net is extracted, with query cost growing linearly.
If a network is sold as a black-box API, existing cryptanalytic extraction attacks can already recover its weights from inputs and outputs. They all assume the architecture is known: depth and every hidden width. Carlini-style differential extraction is the template. Production APIs rarely publish those widths. Whether unknown architecture kills functionally equivalent extraction had not been treated as a hypothesis that had to fall.
This Tsinghua, Zhongguancun Laboratory, and Shandong University paper stays on ReLU fully connected nets. Input dimension d0 and output dimension are known because raw outputs are returned. Hidden depth and widths are not.
The attack reuses layer-wise extraction: find critical points, recover neuron signatures (weight directions), then recover signs. The new move is to read architecture traces inside that process, rather than invent a second query strategy.
Guessing starts at layer 1 with width 1 and increments by one. Each guess runs a partial parameter recovery, collects observables, and decides whether the guess is exact and whether the layer is the second-to-last. A confirmed width is frozen and the attack moves on; an underestimate increments the guess.
Two routes read different traces:
Two further tests identify the second-to-last layer, via fixed output coefficients and a linear relation with the last layer, so guessing can stop. Signatures are recovered by solving linear systems. On expansive nets, sign recovery switches to neuron wiggling because preimages fail.
The threat model is the old one: arbitrary real inputs, complete raw outputs, ReLU, 64-bit floats. Only "architecture known" is dropped.
End-to-end attacks run on a CPU server with 10 workers. The test set includes nets from prior work, newly trained depths and widths, random-data models, an MNIST 784-64-64-10 net, and both expansive and non-expansive layouts. Every architecture and parameter set is recovered. Maximum absolute parameter error matches the known-architecture attack.
| Architecture | Known-arch [4] queries / time | This attack (signature) |
| 10-20-20-1 | 2^18.7 / 108.6s | 2^19.9 / 143.9s |
| 40-20-10-10-1 | 2^18.1 / 34.4s | 2^20.0 / 42.4s |
| 80-40-20-1 | 2^19.4 / 42.7s | 2^21.5 / 501.8s |
| 784-64-64-10 | n/a | 2^23.4 / 8895.6s |
The extra cost is not a full factor of the true width. Critical-point queries collected for one layer are reused across width guesses. Narrow hidden layers finish in time close to the old attack. When the first hidden layer is width 40, the signature route slows by about an order of magnitude (501.8s vs 42.7s on 80-40-20-1). Both routes work on non-expansive nets: signature is slower on non-final layers, sign recovery is slower on the second-to-last layer.
Architecture secrecy is not a moat. If an API returns raw logits or regression values, an attacker can guess widths on the fly and still obtain a functionally equivalent copy. Secure inference that hides weights but not output precision or query budget is defending a thinner surface than it thought. For extraction research, the threat model moves from "white-box architecture, black-box weights" to "known input and output dimensions only."
This is incremental algebra. The paper does not invent a new recovery identity. It treats the intermediates of the old attack as an architecture side channel.
The framework is glued to ReLU MLPs, arbitrary real inputs, and full high-precision outputs. Convolutions, residuals, LayerNorm, softmax probabilities, and quantized APIs are out of scope. The authors flag other piecewise-linear activations and conv nets as future work. Guessing adds linear time; wide layers already take hundreds of seconds, the MNIST net more than two hours. Tested depths stay modest, nowhere near modern MLP-Mixer widths. The 64-bit assumption is false on real GPU inference, and the paper never checks whether numerical noise eats the zero suffix.