Normal-Jet Masking: A Retraining-Free Defense Against Cryptanalytic Extraction of Neural Networks

What it claims

Normal-Jet Masking (NJM) is a post-training wrapper against cryptanalytic extraction (CEA) of piecewise-linear networks. It is positioned against Train to Defend (TTD), which hardens models through extraction-aware training but cannot protect an already-trained checkpoint. NJM leaves the source model's weights unchanged. The authors frame it as a complement to training-time hardening, not a replacement. The paper is a preprint by Chun Li, Liping Zhuang, Di Li, Yufeng Tang, Ming Duan and Zheng Gong, approved on the IACR ePrint Archive on 4 November 2026 under the "Attacks and cryptanalysis" category.

How it works

CEA recovers hidden signatures and parameters by finding critical points (soft-label, raw-logit attacks) or hard-label dual points that expose off-manifold geometry. NJM does not target one attack implementation. It targets the evidence-acquisition stage that both attack families share, before any signature or parameter recovery. This is why one wrapper covers both soft-label and hard-label attacks.

flowchart LR
  Q[Query x] --> T{Inside calibrated<br/>tangent-normal tube?}
  T -- yes --> S[Source model output<br/>mask channels inactive]
  T -- no --> M[Source output mixed with<br/>private normal-direction<br/>mask activations]
  M --> E[Spurious critical points<br/>and dual points]

The method has three steps:

1. Calibrate a tangent-normal tube around the protected data.
2. Add private mask channels aligned to normal directions. These stay inactive inside the tube, so served outputs on in-distribution inputs match the source model.
3. Outside the tube, mix the masks' piecewise-linear activations into the served outputs. Their activation events then contaminate the attacker's critical-point and dual-point search.

Evidence

• Seven MLPs: raw-logit evidence F1 drops by 53.8% to 93.1%, and attacker query cost rises 1.4 to 9.3 times. No pure hard-label duals remain.
• CNNs: output agreement with the source model stays at 0.9993 or higher, while the attacker's source precision falls.
• Against TTD: the abstract gives no head-to-head numbers.

Limits

The page carries only the abstract. It does not name the seven MLPs, the CNN architectures or the datasets, and it does not identify the attack implementations used. It gives no compute cost for calibration and no inference overhead from the added mask channels. No code release is mentioned. For CNNs, the abstract reports agreement and a lower source precision but no F1 or query-cost figures. The paper is licensed CC BY.