Delving into Cryptanalytic Extraction of PReLU Neural Networks

2025-09-20

AI Summary

This work addresses model extraction attacks against PReLU neural networks—a class of nonlinear models with greater expressiveness than ReLU but lacking systematic security analysis. We propose a novel parameter inversion method based on raw model outputs, integrating output-space analysis with end-to-end empirical validation. Our approach achieves high-fidelity recovery of both architecture and parameters across three realistic attack settings: full-output access, top-m class probability scores, and query-limited black-box access. On benchmark datasets including MNIST, our method attains over 99% accuracy in both structural identification and parameter reconstruction for diverse PReLU models. This study bridges a critical gap in model extraction research—extending it from fixed activation functions (e.g., ReLU) to learnable ones—and establishes a new paradigm for security evaluation of deep neural networks, backed by rigorous experimental evidence.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Information Extraction

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Large pretrained models with web data
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

The machine learning problem of model extraction was first introduced in 1991 and gained prominence as a cryptanalytic challenge starting with Crypto 2020. For over three decades, research in this field has primarily focused on ReLU-based neural networks. In this work, we take the first step towards the cryptanalytic extraction of PReLU neural networks, which employ more complex nonlinear activation functions than their ReLU counterparts. We propose a raw output-based parameter recovery attack for PReLU networks and extend it to more restrictive scenarios where only the top-m probability scores are accessible. Our attacks are rigorously evaluated through end-to-end experiments on diverse PReLU neural networks, including models trained on the MNIST dataset. To the best of our knowledge, this is the first practical demonstration of PReLU neural network extraction across three distinct attack scenarios.

Problem

• Extracting PReLU neural network parameters using cryptanalytic methods
• Developing attacks for scenarios with limited output information access
• Evaluating extraction feasibility across three distinct attack scenarios

Innovation

• Parameter recovery attack for PReLU networks
• Extending attack to top-m probability scores
• End-to-end experiments on MNIST dataset