mlsanityData to 7 Oct 2026

Reverse-Engineering Deep ReLU Networks

arXiv 1910.00744 ↗First posted 2 Oct 2019cs.LG stat.MLcited by 81

Not on the map. Why?

Abstract (arXiv)

It has been widely assumed that a neural network cannot be recovered from its outputs, as the network depends on its parameters in a highly nonlinear way. Here, we prove that in fact it is often possible to identify the architecture, weights, and biases of an unknown deep ReLU network by observing only its output. Every ReLU network defines a piecewise linear function, where the boundaries between linear regions correspond to inputs for which some neuron in the network switches between inactive and active ReLU states. By dissecting the set of region boundaries into components associated with particular neurons, we show both theoretically and empirically that it is possible to recover the weights of neurons and their arrangement within the network, up to isomorphism.

Key facts. Cited by 81 papers in the map (data through 7 Oct 2026). First posted on arXiv 2 Oct 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 13; 2022: 14; 2023: 14; 2024: 16; 2025: 13; 2026: 11.

81 papers.

Sort:

By area:

  1. 2022Reconstructing Training Data from Trained Neural Networkscited by 129
  2. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  3. 2022On the Symmetries of Deep Learning Models and their Internal Representationscited by 63
  4. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
  5. 2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
  6. 2023When Deep Learning Meets Polyhedral Theory: A Surveycited by 39
  7. 2023Hidden symmetries of ReLU networkscited by 38
  8. 2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
  9. 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
  10. 2022Interpreting Neural Networks through the Polytope Lenscited by 33
  11. 2025Symmetry in Neural Network Parameter Spacescited by 31
  12. 2022Hardness of Noise-Free Learning for Two-Hidden-Layer Neural Networkscited by 27
38 more
  1. 2022Improved Bounds on Neural Complexity for Representing Piecewise Linear Functionscited by 26
  2. 2021Parameter identifiability of a deep feedforward ReLU neural networkcited by 24
  3. 2024The Real Tropical Geometry of Neural Networkscited by 23
  4. 2024Scale Equivariant Graph Metanetworkscited by 23
  5. 2021An Embedding of ReLU Networks and an Analysis of their Identifiabilitycited by 20
  6. 2022Functional dimension of feedforward ReLU neural networkscited by 20
  7. 2024Privacy Backdoors: Stealing Data with Corrupted Pretrained Modelscited by 20
  8. 2021Scaling Up Exact Neural Network Compression by ReLU Stabilitycited by 19
  9. 2023Polynomial Time Cryptanalytic Extraction of Neural Network Modelscited by 17
  10. 2023Polyhedral Complex Extraction from ReLU Networks using Edge Subdivisioncited by 14
  11. 2021Universal Joint Approximation of Manifolds and Densities by Simple Injective Flowscited by 13
  12. 2022Local Identifiability of Deep ReLU Neural Networks: the Theorycited by 12
  13. 2023A Symmetry-Aware Exploration of Bayesian Neural Network Posteriorscited by 12
  14. 2025Identifiability of Deep Polynomial Neural Networkscited by 12
  15. 2021An Exact Poly-Time Membership-Queries Algorithm for Extraction a three-Layer ReLU Networkcited by 11
  16. 2021SoK: Machine Learning Governancecited by 9
  17. 2022Origami in N dimensions: How feed-forward networks manufacture linear separabilitycited by 9
  18. 2021Stable Recovery of Entangled Weights: Towards Robust Identification of Deep Neural Networks from Minimal Samplescited by 8
  19. 2024Polynomial Time Cryptanalytic Extraction of Deep Neural Networks in the Hard-Label Settingcited by 8
  20. 2024Beyond Slow Signs in High-fidelity Model Extractioncited by 7
  21. 2025The Computational Complexity of Counting Linear Regions in ReLU Neural Networkscited by 7
  22. 2021When are Deep Networks really better than Decision Forests at small sample sizes, and how?cited by 6
  23. 2021Efficiently Learning Any One Hidden Layer ReLU Network From Queriescited by 6
  24. 2022Reachable Polyhedral Marching (RPM): An Exact Analysis Tool for Deep-Learned Control Systemscited by 6
  25. 2025Convexity in ReLU Neural Networks: beyond ICNNs?cited by 6
  26. 2022Learning ReLU networks to high uniform accuracy is intractablecited by 5
  27. 2022Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systemscited by 5
  28. 2023Neural Characteristic Activation Analysis and Geometric Parameterization for ReLU Networkscited by 5
  29. 2023Fault Injection and Safe-Error Attack for Extraction of Embedded Neural Network Modelscited by 5
  30. 2024Evaluating Efficacy of Model Stealing Attacks and Defenses on Quantum Neural Networkscited by 5
  31. 2026Most ReLU Networks Admit Identifiable Parameterscited by 5
  32. 2022Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directionscited by 4
  33. 2023Exploring the Complexity of Deep Neural Networks through Functional Equivalencecited by 4
  34. 2023Compelling ReLU Networks to Exhibit Exponentially Many Linear Regions at Initialization and During Trainingcited by 4
  35. 2024Hard-Label Cryptanalytic Extraction of Neural Network Modelscited by 3
  36. 2025Constraining the outputs of ReLU neural networkscited by 3
  37. 2024Defining Neural Network Architecture through Polytope Structures of Datasetcited by 2
  38. 2024A singular Riemannian Geometry Approach to Deep Neural Networks III. Piecewise Differentiable Layers and Random Walks on n-dimensional Classescited by 2

50 most cited of 81 All 81 (JSON)