mlsanityData to 14 Oct 2026

Stealing Neural Networks via Timing Side Channels

arXiv 1812.11720 ↗First posted 31 Dec 2018cs.CR cs.LGcited by 43

Not on the map. Why?

Abstract (arXiv)

Deep learning is gaining importance in many applications. However, Neural Networks face several security and privacy threats. This is particularly significant in the scenario where Cloud infrastructures deploy a service with Neural Network model at the back end. Here, an adversary can extract the Neural Network parameters, infer the regularization hyperparameter, identify if a data point was part of the training data, and generate effective transferable adversarial examples to evade classifiers. This paper shows how a Neural Network model is susceptible to timing side channel attack. In this paper, a black box Neural Network extraction attack is proposed by exploiting the timing side channels to infer the depth of the network. Although, constructing an equivalent architecture is a complex search problem, it is shown how Reinforcement Learning with knowledge distillation can effectively reduce the search space to infer a target model. The proposed approach has been tested with VGG architectures on CIFAR10 data set. It is observed that it is possible to reconstruct substitute models with test accuracy close to the target models and the proposed approach is scalable and independent of type of Neural Network architectures.

Key facts. Cited by 43 papers in the map (data through 14 Oct 2026). First posted on arXiv 31 Dec 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 7; 2022: 10; 2023: 6; 2024: 9; 2025: 6; 2026: 5.

43 papers.

Sort:

By area:

  1. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  2. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 46
  3. 2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
  4. 2021Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Aheadcited by 41
  5. 2023Privacy Side Channels in Machine Learning Systemscited by 40
  6. 2024What Was Your Prompt? A Remote Keylogging Attack on AI Assistantscited by 26
  7. 2025Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inferencecited by 18
  8. 2024MEA-Defender: A Robust Watermark against Model Extraction Attackcited by 17
  9. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  10. 2022Learning to Reverse DNNs from AI Programs Automaticallycited by 12
  11. 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
  12. 2022SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-supervised Learningcited by 9
31 more
  1. 2023AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Modelscited by 9
  2. 2021Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channelcited by 8
  3. 2022Decompiling x86 Deep Neural Network Executablescited by 7
  4. 2021Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspectivecited by 4
  5. 2022The Security of Deep Learning Defences for Medical Imagingcited by 4
  6. 2022Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directionscited by 4
  7. 2023Beyond Labeling Oracles: What does it mean to steal ML models?cited by 4
  8. 2021Ownership Verification of DNN Architectures via Hardware Cache Side Channelscited by 3
  9. 2021Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Modelscited by 3
  10. 2024A Survey on Offensive AI Within Cybersecuritycited by 3
  11. 2022PINCH: An Adversarial Extraction Attack Framework for Deep Learning Modelscited by 2
  12. 2022Unintended Memorization and Timing Attacks in Named Entity Recognition Modelscited by 2
  13. 2023Like an Open Book? Read Neural Network Architecture with Simple Power Analysis on 32-bit Microcontrollerscited by 2
  14. 2024Inference Attacks: A Taxonomy, Survey, and Promising Directionscited by 2
  15. 2025Examining the Threat Landscape: Foundation Models and Model Stealingcited by 2
  16. 2025Activation Functions Considered Harmful: Recovering Neural Network Weights through Controlled Channelscited by 2
  17. 2025Stealing AI Model Weights Through Covert Communication Channelscited by 2
  18. 2026Steal the Patch Size: Adversarially Manipulate Vision-Language Modelscited by 2
  19. 2021Power-Based Attacks on Spatial DNN Acceleratorscited by 1
  20. 2023The Adversarial Implications of Variable-Time Inferencecited by 1
  21. 2024SoK: A Systems Perspective on Compound AI Threats and Countermeasurescited by 1
  22. 2022Securing AI-based Healthcare Systems using Blockchain Technology: A State-of-the-Art Systematic Literature Review and Future Research Directionscited by 0
  23. 2022On the Evaluation of User Privacy in Deep Neural Networks using Timing Side Channelcited by 0
  24. 2023On the Adversarial Inversion of Deep Biometric Representationscited by 0
  25. 2024Stealing the Invisible: Unveiling Pre-Trained CNN Models through Adversarial Examples and Timing Side-Channelscited by 0
  26. 2025Hot-Swap MarkBoard: An Efficient Black-box Watermarking Approach for Large-scale Model Distributioncited by 0
  27. 2025I Stolenly Swear That I Am Up to (No) Good: Design and Evaluation of Model Stealing Attackscited by 0
  28. 2026ALDEN: Boosting Private Data Extraction from Retrieval-Augmented Generation Systems via Active Learning and Distribution Estimationcited by 0
  29. 2026Black-Box Inference of LLM Architectural Properties with Restrictive API Accesscited by 0
  30. 2026Leaky Language Models: Stealing Architecture and Inference Optimizations via Per-Token Timingcited by 0
  31. 2026JudgeStealer: Extracting LLM Judging Capabilities across Evaluation Protocolscited by 0