Extraction meets Distillation - cryptanalytic techniques to recover parameters from a Deep Neural Network

What it is

"Extraction meets Distillation" (IACR ePrint 2026/2628, received 24 October 2026, CSCML 2026) is a paper on reconstructing fully connected neural networks. It first recovers weight directions with cryptanalytic extraction, then fits the rest of the model from the victim's predicted labels. The authors adapt an existing ReLU extraction implementation to Leaky ReLU. They also estimate biases and output layers, and compare methods for searching the sign of each neuron's weights.

How it works

The page is an abstract, so the mechanism is only outlined. The authors prove conditional bounds for four things: direction recovery from approximate prefixes, preservation of local distance votes, prediction changes caused by aligned parameter errors, and sign selection with independent scoring data. They also specify exact row restoration and say its guarantee differs from that of gradient masking.

Preconditions / Affected

The extraction stage is "assisted". It uses privileged access to gradients, hidden activations and victim parameters. The paper reports label requests separately from this privileged access. The targets are fully connected networks. A defender cannot treat label-only exposure as the whole risk, because the strongest results depend on the privileged signals.

Results

• On the largest synthetic architecture, across eight search seeds, Leaky ReLU recovers 51 to 57 neurons in the deepest hidden layer. ReLU recovers none. The paper says this advantage does not hold uniformly across architectures and layers.
• Removing victim-weight access from the sign walk gives less accurate signs, yet final prediction agreement stays high.
• Across 40 seeded runs on the two smallest synthetic victims, agreement on 5,000 inputs held out from fitting and selection is 0.9890 to 0.9992.
• On two CIFAR-10 victims, reconstructed models reach 56.40% and 58.29% agreement. They exceed the distillation baseline on three functional metrics.

Caveats

The authors state that prediction agreement does not identify network parameters. High agreement therefore does not show that the weights were recovered. The CIFAR-10 agreement is far below the synthetic results. The page gives no code link, attack query counts or defence evaluation beyond the row-restoration versus gradient-masking distinction.