Beyond Scalar Probes: Exploiting Vector-Valued Outputs in ReLU Networks For Signature Extraction

1 Introduction

• The attacker is assumed to choose queries and observe the network’s raw vector-valued outputs, and the analysis uses affine maps from adjacent linear cells.Earlier approaches examine transitions across cell boundaries to recover weights and biases; this work considers the complete affine maps associated with two adjacent cells.Source: §1 · p. 2
• Because nonzero rows of the Jacobian difference are scaled copies of one direction, its dominant right singular vector estimates the common signature by combining output components.For a noisy observation S = ∆ + E, the dominant singular component gives the best rank-one approximation in Frobenius norm.Source: §1 · p. 2
• Two query-costly refinements maximize Jacobian-estimation intervals or probe approximate tangent directions, but can degrade at lower precision when cell-membership tests accept boundary-crossing intervals.They can improve estimation when the cell-membership test is reliable.Source: §1 · p. 2
• At last-hidden-layer transitions, the Jacobian difference also exposes column signatures of the final weight matrix, a structural leakage channel that does not directly strengthen end-to-end extraction.The paper presents this as information discarded by scalar-output methods, complementary to forward recovery of row signatures.Source: §1 · p. 2
• A single-neuron activation change between adjacent linear cells induces a rank-one Jacobian difference whose factors encode row-side and complementary column-side information.The paper characterizes when column signatures correspond to layer weights and discusses limits on recovering column-side biases and signs.Source: §1 · pp. 2–3
• Full-vector SVD pooling improves signature recovery under finite precision, particularly in float32, without increasing oracle-query counts.The experiments compare the estimator with a Carlini-style single-output baseline across float64, float32, and float16; the cell-membership test is the main limitation of adaptive refinements.Source: §1 · p. 3

2.1 Notation

• The notation section treats vectors as columns by default, uses transposes for row vectors, and indexes matrix rows and columns explicitly.It also specifies real vector spaces and function composition.Source: §2.1 · p. 3

2.2 Deep Neural Networks

• The network is a composition of affine layers and component-wise activations, with raw output taken before softmax or argmax and ReLU used in the analysis.The input layer is not counted among the layers.Source: §2.2 · pp. 3–4

2.3 Invariant Transformation of Neural Network

• Permuting hidden units or positively rescaling a hidden layer’s rows and biases while inversely rescaling the next layer’s columns preserves the represented function.The reciprocal-rescaling transformation does not apply to the output layer, which has no subsequent layer to compensate.Source: §2.3 · p. 5

2.4 Signatures

• Row and column signatures normalize weight directions, with modified definitions that accommodate vectors beginning with zero and avoid numerical issues when initial entries are near zero.A row signature determines a critical hyperplane’s unit normal but not its offset or active-side orientation; the analogous missing column sign determines the direction of a neuron’s contribution to the next layer.Source: §2.4 · pp. 5–6
• Positive rescaling supports canonical signature normalization, but a row signature alone does not identify the hyperplane offset or which side is active.The corresponding bias affects the offset, and reversing both weight and bias exchanges the active side while preserving the hyperplane.Source: §2.4 · p. 6

3 Related Work

• Earlier attacks used synthetic queries to train surrogates, while later work improved fidelity and cryptanalytic methods used critical points and derivative discontinuities to recover signatures [6].Carlini et al. [6] reported 220 times more accurate results with 100 times fewer queries than, but sign identification and query demands remained practical challenges.Source: §3 · p. 7
• Other lines include neuron wiggling to identify hidden-neuron signs, polynomial-query hard-label extraction, and signature extraction for deeper networks.The cited raw-output attacks assume access to raw model output.Source: §3 · p. 7
• Rather than restricting analysis to one output component near a critical point, this work studies the full vector-valued affine behavior across adjacent cells, revealing rank-one Jacobian differences and column-side information.The motivation also includes potential stability gains from redundant observations of a row direction under finite-precision evaluation.Source: §3 · pp. 7–8

4 Two-Side Signature Recovery

• For Δ(C0, C1), every row has the same row-signature and every column the same column-signature; each column is a scalar multiple of c*,j.Source: §4 · p. 10

4.1 Finding adjacent linear cells

• A change in vector-valued finite differences along an input sequence detects cell transitions, whereas restricting detection to one output component can miss transitions when that component remains unchanged.The scalar failure has measure zero, but near-equal scalar values may also be difficult to distinguish reliably.Source: §4.1 · pp. 11–12

4.2 Extracting a row signature

• For a first-layer neuron flip, the rows of the Jacobian difference are scalar multiples of that neuron's weight row, and the cell Jacobians can be estimated from queries along linearly independent directions.The query points must remain in the same linear cell; the method uses output differences from a point and its directional neighbors to compute the Jacobian.Source: §4.2 · p. 13

4.3 Attacking deeper layers

• Deeper-layer recovery uses the reconstructed preceding layers, but insufficient rank in R^(k−1) or inactive preceding-layer neurons can prevent full signatures and produce partial signatures.Partial signatures from the same neuron can be matched by comparing ratios on overlapping nonzero coordinates, then merged by filling missing entries from the other signature.Source: §4.3 · p. 14
• When R^(k−1) has insufficient rank, distinct adjacent-cell pairs involving the same neuron yield rank-one Jacobian differences that can be combined into linear equations for its weight row.This addresses the rank-deficiency case that can otherwise prevent recovery of a deeper-layer signature.Source: §4.3 · p. 15
• Intersecting solution spaces from deeper-layer transitions can recover partial signatures, while a one-dimensional intersection can identify a likely shared signature even when the systems are rank deficient.The method removes shared zero columns before intersecting kernels; a trivial remaining kernel allows partial signature recovery.Source: §4.3 · p. 15

4.4 Extracting bias

• A recovered signature determines the normalized bias only up to the selected sign, not the physical bias; finite-precision boundary estimates use a least-squares solution across output coordinates.Coordinates with larger |a_r| contribute more, while those with near-zero |a_r| are downweighted because perturbations in y_r are amplified in y_r/a_r.Source: §4.4 · pp. 16–17

4.5 Numerical precision

• SVD of a Jacobian difference combines information across output components to estimate a shared signature direction; multiple significant singular values indicate the cells may not be adjacent.This contrasts with estimating row signatures independently.Source: §4.5 · p. 17
• Adaptive, asymmetric finite-difference intervals improve vector-valued Jacobian estimates, but cell-consistency checks are heuristic and do not certify cell membership.The method enlarges intervals while testing consistency against a baseline Jacobian; it may retry from other points and discard a cell if intervals remain too short.Source: §4.5 · p. 18
• Directional probes along approximate tangent directions can correct an initial row-signature estimate, recovering its direction up to global sign in exact arithmetic.In finite precision, the correction may fail when the Jacobian jump or the small tangential components are obscured by noise.Source: §4.5 · pp. 18–20

4.6 Layer determination for two-side signatures

• The method expects last-layer column signatures to recur more often than intermediate-layer signatures, but frequency cannot guarantee correct layer attribution.First-layer signatures remain consistent across measurements, whereas deeper-node signatures can be distorted by different first-layer activation patterns.Source: §4.6 · pp. 20–21

4.7 Limits of column signatures

• Column signatures alone generally leave bias recovery ambiguous and do not determine the correct signs; sign recovery is easier under the stated no-bias and full-column-rank conditions.When Rank(W^(ℓ)) < n_(ℓ−1), the bias may remain indeterminate up to a component in the column span of the signature matrix; the sign condition assumes the bias is absent or known and W^(ℓ) has full column rank.Source: §4.7 · pp. 21–22
• ReLU outputs require the solution y to be non-negative, so negative components identify column signatures whose signs should be flipped; inactive neurons or a rank-deficient W^(ℓ) can leave signs unresolved.Several inputs may be needed when a neuron is inactive, and non-negativity alone may not determine signs if W^(ℓ) lacks full column rank.Source: §4.7 · p. 22
• Column signatures add structural information but do not enable backward extraction alone, and adaptive refinements rely on heuristic cell-consistency tests that become less reliable at low precision.The work evaluates a signature-estimation primitive rather than presenting a new end-to-end extraction attack; the vector estimator assumes access to raw multidimensional outputs.Source: §4.7 · p. 22

5.1 Setup

• The evaluation isolates estimation from critical-point search on 784-dimensional, single-hidden-layer networks, comparing Gaussian and MNIST-trained weights at float64, float32, and float16.The networks use hidden widths 8 and 32; each query returns the full output vector.Source: §5 · p. 22, §5.1 · pp. 22–23

5.2 Results

• At float32, J-vector-fixed beats C-band-adaptive by nearly two orders on random weights and over three orders on trained weights, using 4–12× fewer queries.The reported accuracy comparison is median angular error, averaged over widths 8 and 32.Source: §5.2 · pp. 23, 25, Table 1 · p. 24
• Accepted adaptive intervals crossed cell boundaries in 55%/44% of float32 cases and 15%/3.5% of float16 cases; overshooting can contaminate ∆.The float16 consistency threshold is more conservative, rejecting more intervals and ending the search earlier.Source: §5.2 · pp. 24–25
• At float64, all methods achieve essentially exact recovery, with dangle < 10^-15.Source: §5.2 · p. 25
• SVD pooling reduces dangle by approximately 13× (random) and 18× (trained) at float32, and 8× (random) at float16; trained float16 slightly favors J-first-row.The pooling comparison uses identical query cost; the trained float16 errors are 3.4 × 10^-1 for J-first-row and 3.8 × 10^-1 for J-vector-fixed.Source: §5.2 · p. 25
• At float64, adaptive and rotating vector methods reach normalized bias error around 10^-15 versus about 10^-10 for Carlini methods; their advantage shrinks at lower precision.The bias metric is normalized hyperplane offset, not the physical parameter b.Source: Bias recovery · pp. 25–26, Table 2 · p. 26

• A single-neuron activation change across adjacent linear cells induces a rank-one Jacobian difference with row-side and complementary column-side information.Source: §6 · p. 26
• SVD of the full Jacobian difference combines output components to improve signature recovery under finite precision, particularly float32, without increasing oracle queries.Source: §6 · p. 26
• Adaptive interval refinements are limited by unreliable cell-membership tests at reduced precision, and using column-side information beyond the last layer or in a complete bidirectional procedure remains open.Source: §6 · p. 26