Distill and Conquer: Cryptanalytic Extraction of Local Rules in the Hard-Label Setting

What it is

Distill–Probe–Extract is a hard-label model-extraction method from Chun Li, Di Li, Liping Zhuang, Siqi Zhu, Yufeng Tang, Xingfu Yan and Zheng Gong (IACR ePrint 2026/2723, approved 4 November 2026, preprint). It recovers explicit local class-pair rules, meaning class-switching conditions that predict nearby labels under a specified sampling law. It does not return a substitute model, and it does not need to identify the victim architecture first.

How it works

Verified boundary events guide the training of a student network. The student's gradients propose directions at boundary anchors, and queries to the victim refine those directions. Fresh hard-label queries then test each proposed rule. For every accepted rule, the method keeps the validation inputs and the victim's labels, so the rule's local agreement can be audited.

Results beyond the summary

• Victims tested were a digits multilayer perceptron and pooling convolutional networks. Fixed-candidate comparisons isolate the saving from replacing victim-normal estimation with student gradients.
• The 246 to 118 median queries per attempt is the recorded online cost after student preparation. The Fashion-MNIST ratio of 2.03 to 2.23 times Direct's accepted rules counts preparation and failures, uses the original validation gate, and caps sessions at 320,000 calls.
• A separate student-level test on trained Blended watermarks, also at 320,000 calls, reached 99.99% trigger agreement and 91.79% clean agreement. All three seeds passed joint verification.

Caveats

• The page gives only the abstract. Dataset scale beyond digits and Fashion-MNIST, the victim architectures in detail, and any code release are not stated.
• The 118-query figure excludes student preparation cost. The Fashion-MNIST comparison is the one that includes it.