# Stealing Neural Networks via Timing Side Channels

arXiv: https://arxiv.org/abs/1812.11720 · HTML: https://mlsanity.com/paper/1812.11720/

## Key facts

- Cited by 43 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Dec 2018.

## Built on by (most cited first, 30 of 43)

- [I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences](https://mlsanity.com/paper/2206.08451/) (2022)
- [Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)](https://mlsanity.com/paper/2407.14937/) (2024)
- [DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories](https://mlsanity.com/paper/2111.04625/) (2021)
- [Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Ahead](https://mlsanity.com/paper/2101.02559/) (2021)
- [Privacy Side Channels in Machine Learning Systems](https://mlsanity.com/paper/2309.05610/) (2023)
- [What Was Your Prompt? A Remote Keylogging Attack on AI Assistants](https://mlsanity.com/paper/2403.09751/) (2024)
- [Selective KV-Cache Sharing to Mitigate Timing Side-Channels in LLM Inference](https://mlsanity.com/paper/2508.08438/) (2025)
- [MEA-Defender: A Robust Watermark against Model Extraction Attack](https://mlsanity.com/paper/2401.15239/) (2024)
- [AI Risk Management Should Incorporate Both Safety and Security](https://mlsanity.com/paper/2405.19524/) (2024)
- [Learning to Reverse DNNs from AI Programs Automatically](https://mlsanity.com/paper/2205.10364/) (2022)
- [Model Inversion Attacks: A Survey of Approaches and Countermeasures](https://mlsanity.com/paper/2411.10023/) (2024)
- [SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-supervised Learning](https://mlsanity.com/paper/2209.03563/) (2022)
- [AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Models](https://mlsanity.com/paper/2302.02162/) (2023)
- [Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel](https://mlsanity.com/paper/2109.07395/) (2021)
- [Decompiling x86 Deep Neural Network Executables](https://mlsanity.com/paper/2210.01075/) (2022)
- [Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective](https://mlsanity.com/paper/2111.03308/) (2021)
- [The Security of Deep Learning Defences for Medical Imaging](https://mlsanity.com/paper/2201.08661/) (2022)
- [Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directions](https://mlsanity.com/paper/2209.04022/) (2022)
- [Beyond Labeling Oracles: What does it mean to steal ML models?](https://mlsanity.com/paper/2310.01959/) (2023)
- [Ownership Verification of DNN Architectures via Hardware Cache Side Channels](https://mlsanity.com/paper/2102.03523/) (2021)
- [Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Models](https://mlsanity.com/paper/2104.12623/) (2021)
- [A Survey on Offensive AI Within Cybersecurity](https://mlsanity.com/paper/2410.03566/) (2024)
- [PINCH: An Adversarial Extraction Attack Framework for Deep Learning Models](https://mlsanity.com/paper/2209.06300/) (2022)
- [Unintended Memorization and Timing Attacks in Named Entity Recognition Models](https://mlsanity.com/paper/2211.02245/) (2022)
- [Like an Open Book? Read Neural Network Architecture with Simple Power Analysis on 32-bit Microcontrollers](https://mlsanity.com/paper/2311.01344/) (2023)
- [Inference Attacks: A Taxonomy, Survey, and Promising Directions](https://mlsanity.com/paper/2406.02027/) (2024)
- [Examining the Threat Landscape: Foundation Models and Model Stealing](https://mlsanity.com/paper/2502.18077/) (2025)
- [Activation Functions Considered Harmful: Recovering Neural Network Weights through Controlled Channels](https://mlsanity.com/paper/2503.19142/) (2025)
- [Stealing AI Model Weights Through Covert Communication Channels](https://mlsanity.com/paper/2510.00151/) (2025)
- [Steal the Patch Size: Adversarially Manipulate Vision-Language Models](https://mlsanity.com/paper/2607.00174/) (2026)

## Abstract (arXiv)

Deep learning is gaining importance in many applications. However, Neural Networks face several security and privacy threats. This is particularly significant in the scenario where Cloud infrastructures deploy a service with Neural Network model at the back end. Here, an adversary can extract the Neural Network parameters, infer the regularization hyperparameter, identify if a data point was part of the training data, and generate effective transferable adversarial examples to evade classifiers. This paper shows how a Neural Network model is susceptible to timing side channel attack. In this paper, a black box Neural Network extraction attack is proposed by exploiting the timing side channels to infer the depth of the network. Although, constructing an equivalent architecture is a complex search problem, it is shown how Reinforcement Learning with knowledge distillation can effectively reduce the search space to infer a target model. The proposed approach has been tested with VGG architectures on CIFAR10 data set. It is observed that it is possible to reconstruct substitute models with test accuracy close to the target models and the proposed approach is scalable and independent of type of Neural Network architectures.