首次实现硬标签下神经网络功能等价提取，适用于ReLU模型。
Hard-Label Cryptanalytic Extraction of Neural Network Models
- 基于硬标签设计新攻击，理论可实现功能等价还原
- 对含10万参数的网络，单核数小时即可完成
- 在MNIST、CIFAR10上验证有效性，适配实际视觉模型
机器学习中的神经网络参数提取问题已研究近三十年。当攻击者可访问网络原始输出时，已有多种攻击（如CRYPTO 2020、EUROCRYPT 2024）成功实现功能等价提取。然而，在原始输出不可访问的硬标签设置下，该目标尚未达成。本文提出首个理论上可在硬标签设置下实现功能等价提取的攻击方法，适用于ReLU神经网络。通过大量实践实验验证了其有效性，涵盖在两个主流计算机视觉基准数据集（MNIST、CIFAR10）上训练的多种ReLU神经网络。对于包含10^5个参数的网络，本攻击仅需单核数小时即可完成。
原文摘要 · Abstract (English)
The machine learning problem of extracting neural network parameters has been proposed for nearly three decades. Functionally equivalent extraction is a crucial goal for research on this problem. When the adversary has access to the raw output of neural networks, various attacks, including those presented at CRYPTO 2020 and EUROCRYPT 2024, have successfully achieved this goal. However, this goal is not achieved when neural networks operate under a hard-label setting where the raw output is inaccessible. In this paper, we propose the first attack that theoretically achieves functionally equivalent extraction under the hard-label setting, which applies to ReLU neural networks. The effectiveness of our attack is validated through practical experiments on a wide range of ReLU neural networks, including neural networks trained on two real benchmarking datasets (MNIST, CIFAR10) widely used in computer vision. For a neural network consisting of $10^5$ parameters, our attack only requires several hours on a single core.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。