Data to 7 Oct 2026

Cryptanalytic Extraction of Neural Network Models

arXiv 2003.04884 ↗First posted 10 Mar 2020cs.LG cs.CRcited by 65

Not on the map. Why?

Abstract (arXiv)

We argue that the machine learning problem of model extraction is actually a cryptanalytic problem in disguise, and should be studied as such. Given oracle access to a neural network, we introduce a differential attack that can efficiently steal the parameters of the remote model up to floating point precision. Our attack relies on the fact that ReLU neural networks are piecewise linear functions, and thus queries at the critical points reveal information about the model parameters. We evaluate our attack on multiple neural network models and extract models that are 2^20 times more precise and require 100x fewer queries than prior work. For example, we extract a 100,000 parameter neural network trained on the MNIST digit recognition task with 2^21.5 queries in under an hour, such that the extracted model agrees with the oracle on all inputs up to a worst-case error of 2^-25, or a model with 4,000 parameters in 2^18.5 queries with worst-case error of 2^-40.4. Code is available at https://github.com/google-research/cryptanalytic-model-extraction.

Key facts. Cited by 65 papers in the map (data through 7 Oct 2026). First posted on arXiv 10 Mar 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 16; 2022: 14; 2023: 14; 2024: 8; 2025: 7; 2026: 6.

65 papers.

Sort:

By area:

2022Reconstructing Training Data from Trained Neural Networkscited by 129
2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
2023Hidden symmetries of ReLU networkscited by 38
2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
2021Parameter identifiability of a deep feedforward ReLU neural networkcited by 24
2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 21
2021An Embedding of ReLU Networks and an Analysis of their Identifiabilitycited by 20
2024Privacy Backdoors: Stealing Data with Corrupted Pretrained Modelscited by 20

38 more

2023False Claims against Model Ownership Resolutioncited by 17
2023Polynomial Time Cryptanalytic Extraction of Neural Network Modelscited by 17
2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
2021Teacher Model Fingerprinting Attacks Against Transfer Learningcited by 15
2022Local Identifiability of Deep ReLU Neural Networks: the Theorycited by 12
2022Conflicting Interactions Among Protection Mechanisms for Machine Learning Modelscited by 12
2021An Exact Poly-Time Membership-Queries Algorithm for Extraction a three-Layer ReLU Networkcited by 11
2023MIST: Defending Against Membership Inference Attacks Through Membership-Invariant Subspace Trainingcited by 11
2021SoK: Machine Learning Governancecited by 9
2022Split HE: Fast Secure Inference Combining Split Learning and Homomorphic Encryptioncited by 9
2021Model Extraction and Defenses on Generative Adversarial Networkscited by 8
2022A Practical Introduction to Side-Channel Extraction of Deep Neural Network Parameterscited by 8
2024Polynomial Time Cryptanalytic Extraction of Deep Neural Networks in the Hard-Label Settingcited by 8
2021Responsible and Regulatory Conform Machine Learning for Medicine: A Survey of Challenges and Solutionscited by 7
2024Beyond Slow Signs in High-fidelity Model Extractioncited by 7
2021Efficiently Learning Any One Hidden Layer ReLU Network From Queriescited by 6
2021On managing vulnerabilities in AI/ML systemscited by 5
202110 Security and Privacy Problems in Large Foundation Modelscited by 5
2022Preprocessors Matter! Realistic Decision-Based Attacks on Machine Learning Systemscited by 5
2023Fault Injection and Safe-Error Attack for Extraction of Embedded Neural Network Modelscited by 5
2024Understanding Data Importance in Machine Learning Attacks: Does Valuable Data Pose Greater Harm?cited by 5
2021A Review of Confidentiality Threats Against Embedded Neural Network Modelscited by 4
2022Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directionscited by 4
2023TT-TFHE: a Torus Fully Homomorphic Encryption-Friendly Neural Network Architecturecited by 4
2023A Plot is Worth a Thousand Words: Model Information Stealing Attacks via Scientific Plotscited by 4
2023Beyond Labeling Oracles: What does it mean to steal ML models?cited by 4
2023SecurityNet: Assessing Machine Learning Vulnerabilities on Public Modelscited by 4
2025Navigating the Deep: End-to-End Extraction on Deep Neural Networkscited by 3
2023Dash: Accelerating Distributed Private Convolutional Neural Network Inference with Arithmetic Garbled Circuitscited by 2
2023Pareto-Secure Machine Learning (PSML): Fingerprinting and Securing Inference Serving Systemscited by 2
2023Like an Open Book? Read Neural Network Architecture with Simple Power Analysis on 32-bit Microcontrollerscited by 2
2025Examining the Threat Landscape: Foundation Models and Model Stealingcited by 2
2025Is the Hard-Label Cryptanalytic Model Extraction Really Polynomial?cited by 2
2025AttackPilot: Autonomous Inference Attacks Against ML Services With LLM-Based Agentscited by 2
2021Power-Based Attacks on Spatial DNN Acceleratorscited by 1
2022Stealing and Evading Malware Classifiers and Antivirus at Low False Positive Conditionscited by 1
2025Cryptographic Backdoor for Neural Networks: Boon and Banecited by 1

50 most cited of 65 All 65 (JSON)