未知架构与无反馈条件下的卷积神经网络提取

中文摘要 AI 辅助

本文研究了对卷积神经网络（CNNs）的密码分析提取问题。现有的针对CNN的密码分析提取攻击假设网络架构已知，并试图恢复模型参数。本文首次证明，对于包含最大池化和平均池化的CNN，可以去除架构假设。我们的核心发现是，现有参数恢复攻击所恢复的权重向量的空间几何结构自然地泄露了架构信息。我们形式化了这种几何结构，并建立了其与卷积层架构知识的对应关系：（1）与卷积感受野的稀疏一致性揭示了层类型、卷积核大小和步长；（2）与卷积核参数的数值一致性揭示了填充模式和输出通道数；（3）与池化操作的结构一致性揭示了池化类型、窗口大小和步长。尽管在原始输出和硬标签设置下，恢复的向量是通过不同方法获得的，但它们的空间几何结构保持不变。因此，我们的架构恢复是反馈无关的：与参数恢复攻击相结合，它构成了一个完整的密码分析提取框架，能够在黑盒设置下同时恢复架构和参数。大量的实验，包括逐层和端到端的实验，在广泛的CNN上证明了同时恢复网络架构和模型参数是可行的。

英文摘要

This paper studies the cryptanalytic extraction of convolutional neural networks (CNNs). Existing cryptanalytic extraction attacks on CNNs assume that the network architecture is known, and try to recover model parameters.In this paper, we prove for the first time that the architecture assumption can be removed for CNNs with both max and average pooling. Our core finding is that the spatial geometry of the weight vectors recovered by existing parameter-recovery attacks naturally leaks the architecture. We formalize this geometry and establish its correspondence with the architectural knowledge of a convolutional layer: (1) The sparsity consistency with the convolution receptive field reveals the layer type, the kernel size, and the stride; (2) The numerical consistency with the kernel parameters reveals the padding mode and the output-channel number; (3) The structural consistency with the pooling operation reveals the pooling type, the window size, and the stride. Although the recovered vectors are obtained using different methods in the raw-output and hard label settings, their spatial geometry remains the same. Therefore, our architecture recovery is feedback-agnostic: combined with a parameter-recovery attack, it yields a complete cryptanalytic extraction framework that recovers both the architecture and the parameters in the black-box setting. Extensive experiments, including both layer-wise and end-to-end ones, on a wide range of CNNs demonstrate that simultaneously recovering the network architecture and the model parameters is practical.

发表机构

• Information Engineering University（信息工程大学）
• Tsinghua University（清华大学）

机构由 AI 辅助整理，请以论文原文为准。