We lifted 9 functions out of this paper's own repositories and ran 7 of them in a sandbox. "Ran" means the function executed on a synthesized input and returned a value. It is not a reproduction of the paper's results.
| Repository | Role | Ran |
|---|---|---|
| google-research/cryptanalytic-model-extraction | canonical | 7 of 9 |
| Function | Status | Where it lives |
|---|---|---|
| matmul | Ran | google-research/cryptanalytic-model-extraction/train_models.py code served (permissive licence) · get_code("83767ebe8bbf02d3") |
| nvar | Ran | google-research/cryptanalytic-model-extraction/check_solution_milp.py code served (permissive licence) · get_code("7549a8a251d27f7b") |
| ratio_normalize | Ran | google-research/cryptanalytic-model-extraction/src/layer_recovery.py code served (permissive licence) · get_code("746044d1eb80c673") |
| relu | Ran | google-research/cryptanalytic-model-extraction/check_solution_svd.py code served (permissive licence) · get_code("5af8fa537914ff3d") |
| run | Ran | google-research/cryptanalytic-model-extraction/check_solution_svd.py code served (permissive licence) · get_code("7458d02178e447be") |
| sign_to_int | Ran | google-research/cryptanalytic-model-extraction/src/sign_recovery.py code served (permissive licence) · get_code("7626bcf00b1570d5") |
| trim | Ran | google-research/cryptanalytic-model-extraction/src/refine_precision.py code served (permissive licence) · get_code("3ce9a785569f8808") |
| dump_net | Not yet run | google-research/cryptanalytic-model-extraction/check_solution_milp.py code served (permissive licence) · get_code("db8cb0043d1f9945") |
| process_block | Not yet run | google-research/cryptanalytic-model-extraction/src/layer_recovery.py code served (permissive licence) · get_code("8b0ead0e58fdbab4") |
Some links come from the archived Papers with Code dataset (CC BY-SA 4.0): attribution and licence.
We argue that the machine learning problem of model extraction is actually a cryptanalytic problem in disguise, and should be studied as such. Given oracle access to a neural network, we introduce a differential attack that can efficiently steal the parameters of the remote model up to floating point precision. Our attack relies on the fact that ReLU neural networks are piecewise linear functions, and thus queries at the critical points reveal information about the model parameters. We evaluate our attack on multiple neural network models and extract models that are 2^20 times more precise and require 100x fewer queries than prior work. For example, we extract a 100,000 parameter neural network trained on the MNIST digit recognition task with 2^21.5 queries in under an hour, such that the extracted model agrees with the oracle on all inputs up to a worst-case error of 2^-25, or a model with 4,000 parameters in 2^18.5 queries with worst-case error of 2^-40.4. Code is available at https://github.com/google-research/cryptanalytic-model-extraction.
The same record, over MCP at https://syntology.ai/mcp:
get_harvested_code_for_paper("2003.04884")
get_code_for_paper("2003.04884")
have("2003.04884")
Connect an agent — have() is free.