PaperlayerView exact revision on arXiv

Source-linked AI summary

Extraction meets Distillation - cryptanalytic techniques to recover parameters from a Deep Neural Network

Biprarshi Biswas, Arya Anshuman Ojha, Yubaraj Das, Devansh Khosla, Kamran Rais, Saankhya Samanta, Subhamoy Maitra, Pantelimon Stanica

arXiv:2610.33671v1cs.LGcs.AIcs.CR

TL;DR

The paper studies how to assemble partially recovered neural-network directions into a classifier while retaining those directions. It combines assisted direction extraction with label-based reconstruction; results favor assisted reconstruction over distillation on the two CIFAR comparisons, but do not show a uniform synthetic-data advantage or exact parameter recovery.

  • Problem

    The paper asks how to assemble partially recovered weight directions into a complete network, since prediction agreement and parameter recovery are distinct objectives.

    Source: §1 · p. 2

  • Method

    The authors combine assisted weight-direction extraction with bias estimation, sign search, output-layer fitting, and gradient-masked refinement.

    Source: §8 · p. 36

  • Results

    The two CIFAR comparisons favor assisted reconstruction on all three reported functional metrics, while synthetic comparisons show no uniform advantage over distillation.

    Source: §8 · p. 36

  • Takeaways & Limitations

    The results support studying reconstruction from partial directions, but do not establish exact parameter recovery or uniformly reliable sign recovery.

    Source: §8 · p. 36

    A label-based output-layer fit yields a classifier, not a unique recovery of the victim’s output weights.

    Source: §2 · p. 5

Abstract

from arXiv · show

We study fully connected neural-network reconstruction by combining cryptanalytic weight-direction extraction with learning from predicted labels. We adapt a ReLU extraction implementation to Leaky ReLU, compare sign-search methods, and estimate biases and output layers. We prove conditional bounds for direction recovery with approximate prefixes, preservation of local distance votes, prediction changes from aligned parameter errors, and sign selection with independent scoring data. We also specify exact row restoration and distinguish its guarantee from that of gradient masking. The experiments evaluate assisted extraction, with privileged access to gradients, hidden activations, and victim parameters, followed by label-based reconstruction. Across eight search seeds on the largest synthetic architecture, Leaky ReLU recovers 51--57 neurons in the deepest hidden layer, while ReLU recovers none. This advantage does not hold uniformly across architectures and layers. Removing victim-weight access from the sign walk gives less accurate signs, despite high final prediction agreement. Across 40 seeded runs on the two smallest synthetic victims, agreement on 5,000 inputs excluded from fitting and selection ranges from $0.9890$ to $0.9992$. On two CIFAR-10 victims, the reconstructed models achieve $56.40\%$ and $58.29\%$ agreement and exceed the distillation baseline on three functional metrics. We report label requests separately from privileged access and explain why prediction agreement does not identify network parameters.

1 Introduction

The paper studies how to assemble partially recovered weight directions into a classifier without confusing prediction agreement with parameter recovery. It combines adapted extraction, sign search, and label-based reconstruction, while disclosing privileged accesses in the evaluated implementation.

1 Introduction

  • A model may agree with a classifier on a test set without recovering its weights, while accurate directions alone need not yield a useful classifier.The study asks how to assemble partial directions into a complete network while retaining them during subsequent training.Source: §1 · p. 2
  • Prior work includes cryptanalytic extraction from numerical outputs and label-based extraction, while decision-based attacks seek prediction changes rather than model parameters.The paper does not claim that extending extraction beyond ReLU is itself new.Source: §1 · p. 2
  • The intended oracle returns predicted labels, but evaluated extraction stages also use gradients, hidden activations, and true prefix weights.The later learning stages use cached victim labels, which does not remove the privileged information used to initialize them.Source: §1 · pp. 2–3
  • The work combines Leaky ReLU slope adaptation, sign-search comparisons, bias and output-layer estimation, and gradient-masked refinement while separately specifying exact row restoration.It also batches dual-point search and streams clustering data.Source: §1 · p. 3
  • The paper reports direction coverage separately from functional agreement because agreement alone does not establish parameter recovery.Its experiments are presented as assisted extraction and reconstruction, not as a label-only end-to-end attack.Source: §1 · p. 3

2 Preliminaries and Notation

The preliminaries define the hard-label setting, the network's piecewise-affine regions, and the geometric objects used for extraction. They also explain why hard-label agreement cannot uniquely identify the victim's parameters.

2 Preliminaries and Notation

  • The intended oracle returns the predicted class under a fixed tie rule, and the attacker is assumed to know the architecture and activation but not the parameters.The paper distinguishes label-only access from interfaces returning probabilities or logits.Source: §2 · p. 4
  • For Leaky ReLU, negative inputs have slope α, while ReLU is the α = 0 case; both activations are 1-Lipschitz for 0 ≤ α < 1.The restriction α < 1 is essential for the slope change used by the attack.Source: §2 · p. 4
  • The critical set is where a neuron's pre-activation is zero, and deeper-layer pieces are defined within fixed prefix regions.A critical crossing need not create a visible decision-boundary bend.Source: §2 · p. 4
  • On a region with a fixed activation pattern, the network is affine, and a dual point lies at the local intersection of a neuron's critical set and a class decision boundary.The geometric procedure assumes that only the target neuron changes state, the same two classes remain relevant, and the intersection is transverse; its tangent space has codimension two.Source: §2 · pp. 4–5
  • Hard labels do not identify a unique parameter tuple because hidden-neuron permutations and positive rescalings can preserve the network function.An output-layer fit from labels is a classifier reconstruction, not unique recovery of the victim's output weights.Source: §2 · p. 5

3 The Extraction Pipeline

The extraction pipeline reconstructs network parameters by finding boundary dual points, recovering hidden weight directions, assigning signs from distance-to-toggle votes, and estimating biases and remaining parameters. Its sign-recovery assumptions may not hold in actual walks, and the implementation relies on privileged information unavailable through labels; low-information signs serve as initialization rather than calibrated confidence.

3.1 Dual Point Discovery

  • Under a regular two-class boundary and isolated crossing, bisection and boundary walks locate candidate dual points; the implementation reads exact gradients and logit gaps.Orientation changes can also arise from class changes, simultaneous crossings, or numerical error, while crossings with no downstream effect may remain invisible.Source: §3.1 · pp. 5–6

3.2 Signature Recovery

  • Two distinct tangent spaces from one first-layer neuron recover its weight direction when their span has dimension d−1; one point generally does not determine it.The two-point argument requires d≥3, and the rank test also requires diversity among boundary normals.Source: §3.2 · p. 6
  • For deeper layers, transported tangent vectors recover the direction when their matrix has rank d_(i−1)−1; point locations add affine constraints that can help when tangents alone fail.The error bound for approximate recovery requires the exact rank condition, justified error budget, and accurate local prefix Jacobians; it does not determine row magnitude or bias.Source: §3.2 · pp. 7–8

3.3 Sign Recovery

  • Distance-to-toggle votes select the hypothesized positive side with shorter distance; a majority-error guarantee requires independent votes each correct with probability at least 1/2+γ.For 0<ϵ<1, L≥log(1/ϵ)/(2γ^2) suffices for error probability at most ϵ, but the lemma does not establish positive γ for any particular neuron.Source: §3.3 · pp. 9–10
  • A local distance ordering survives perturbation when the exact gap exceeds twice the distance-error bound, provided the affine continuations and path directions are controlled.Applying this certificate to actual walks requires accounting for intervening activation changes and omitted coordinates; identifying the ordering with the true neuron sign still needs a separate sign-signal assumption.Source: §3.3 · pp. 10–11
  • Under a controlled Gaussian affine-continuation model, the positive-side event probability exceeds the negative-side probability, but this does not guarantee ordered first-event distances or sign correctness for trained networks.The vote’s orientation must also be converted between victim and recovered frames; computing the scale sign from the victim row uses privileged victim parameters.Source: §3.3 · pp. 11–12
  • The sign-vote bounds assume an unchanged local map before H and an independent Gaussian downstream response with controlled velocities, conditions actual walks may violate.Logged local rates and intervening events can test these assumptions; positive µ should not be equated with measured sign advantage without those checks.Source: §3.3 · p. 13
  • The implementation modifies the runner to use along_decision_boundary in every layer, bounds inner bisection iterations, and saves per-neuron signs and vote summaries.Capping negative-side distance at three times positive-side distance preserves an existing strict comparison but does not alone establish universal positive-vote bias; censoring, unsuccessful walks, and default decisions also matter.Source: §3.3 · p. 13

3.4 Privileged Information in the Implementation

  • Table 1 separates runtime information unavailable through labels (type A) from direct parameter reads (type W), both of which assist the attack rather than evaluate it.The reference code includes operations that depart from the intended hard-label oracle; D1–D6 identifiers are retained for comparison with the code.Source: Table 1 · p. 13, §3.4 · p. 13
  • D4 and D6 use true parameters to avoid reconstructed-prefix error propagation, while D5 uses true-row comparisons to accept candidates, so label-based fitting does not make extraction label-only.Removing these accesses requires a separate end-to-end evaluation.Source: §3.4 · p. 14

4 Leaky ReLU Adaptation

The adaptation replaces ReLU's zero negative-side slope with a fixed positive Leaky ReLU slope and transfers local extraction calculations with qualifications. Its local rank property does not guarantee well-conditioned recovery or uniform coverage gains.

4 Leaky ReLU Adaptation

  • The implementation replaces the zero negative-side slope with fixed α in (0, 1) and applies the change to activation functions, prefix linearization, and sign-walk simulations.The coordinate-hit buffer uses the prefix output dimension to correct a shape error on nonuniform architectures.Source: §4 · p. 14, §4.2 · p. 14

4.1 Local Geometry

  • For a fixed first-layer weight and bias, ReLU and Leaky ReLU share the same critical hyperplane, but changing earlier activations can alter deeper critical sets and decision boundaries.The local bend calculation transfers only with the prefix and other local activation states fixed; a visible bend also requires nonparallel boundary normals and unchanged competing classes.Source: §4.1 · p. 14

4.2 Slope Calculations and Candidate Acceptance

  • The ReLU path uses a numerical singular-value gate, while the Leaky ReLU path retains candidates that agree sufficiently with the true neuron under privileged evaluation.Thus higher Leaky ReLU coverage measures assisted candidate acceptance, not coverage selectable from labels alone; the downstream response can also alter sign-statistic strength, with no universal accuracy bound from small α.Source: §4.2 · p. 15

4.3 Rank and Inactive Coordinates

  • For a fixed pre-activation matrix, multiplying by a diagonal matrix with entries in [α, 1] preserves its kernel and rank, unlike ReLU's {0, 1} slopes, which can reduce rank.This local result does not imply equality of network Jacobians or guarantee a unique, well-conditioned SVD solution; later weight products can remain rank deficient and small slopes can worsen conditioning.Source: §4.3 · p. 15

5 Metaheuristic Sign Search

Sign search scores candidate assignments against cached victim labels, using agreement or reconstructed-model margins to guide exploration. The section compares search heuristics and gives conditional guarantees for selecting among fixed candidate families with independent scoring data.

5.1 Sign Assignments

  • Exhaustive search evaluates all 2^k assignments but is practical only for modest k and optimizes finite-set agreement, which need not identify the true signs.The searched variables encode orientations of recovered rows; negating a row also negates or recomputes its bias to preserve its current-prefix zero set.Source: §5.1 · p. 16

5.2 Single-Flip Search

  • Mean sign accuracy was 0.666 for parallel tempering with the margin, versus 0.639 for simulated annealing with the margin, 0.569 for simulated annealing with agreement, and 0.557 for greedy search.These results correct half-corrupted signs in a privileged initialization; parallel tempering used six seeds, while the other means used eight.Source: §5.2 · p. 16
  • Greedy search retains improving single-sign flips, but plateaus and local optima motivate methods that sometimes accept worse scores.Several simultaneous flips can improve agreement even when no individual flip does.Source: §5.2 · p. 16

5.3 Agreement and Margin Objectives

  • The margin uses victim labels and reconstructed-model logits, can distinguish equal-agreement assignments, and may increase without increasing agreement because it is a scale-dependent surrogate.Agreement selects the saved candidate, while the margin guides exploration; retaining the initial state guarantees no lower training-set agreement at return, not better held-out agreement or more correct signs.Source: §5.3 · pp. 16–17

5.4 Simulated Annealing and Parallel Tempering

  • Simulated annealing accepts symmetric-proposal moves with probability min(1, exp((S(s′) − S(s))/T)); parallel tempering exchanges states across chains at different temperatures, but neither guarantees the best assignment within a fixed budget.The default annealing schedule decreases temperature geometrically; the paper uses it by default and compares parallel tempering on selected victims.Source: §5.4 · p. 17

5.5 Selection with Independent Scoring Data

  • For a fixed family of M candidates with an independent scoring set, a unique best candidate separated by gap ∆ has sufficient sample count n ≥ 2 log((M − 1)/β)/∆^2 for selection error at most β.For k = 8, ∆ = 0.05, and β = 0.05, the bound gives 6,830 inputs; ∆ is assumed, and prediction-equivalent assignments have no positive gap.Source: §5.5 · pp. 17–18

6 Learning-Assisted Reconstruction

The reconstruction pipeline combines accepted directions with bias estimates, an output-layer fit, sign search, and refinement. Its guarantees are conditional: parameter-error bounds can imply label preservation, while gradient masking alone does not ensure exact row values.

6 Learning-Assisted Reconstruction

  • Reconstruction estimates biases, fits and refits an output layer, searches signs, then trains remaining parameters while masking recovered-row gradients; exact row restoration is a separate update rule.The stages use stored dual points and cached labels, but retain the privileged accesses used to initialize the model.Source: §6 · p. 19

6.1 Incomplete Parameters and Sign Errors

  • A single row-and-bias sign flip changes a neuron’s activation by (1 + α)|z(x)|, so a downstream Lipschitz bound and margin µ(x) > 2(1 + α)Li|z(x)| suffice to preserve its label.For aligned parameter errors across layers, Proposition 9 bounds logit error by V and preserves the victim label when its unique-class margin exceeds 2V; the bound does not itself establish small errors for missing rows.Source: §6.1 · pp. 19–21

6.2 Bias Estimates from Dual Points

  • The median of bias estimates lies within ϵ of the compatible bias when more than half the estimates satisfy that error bound, tolerating a minority of arbitrary outliers.This does not remove common prefix error or critical-point residual, and later training can reduce prediction loss without correcting the true bias.Source: §6.2 · p. 22

6.3 Output-Layer Fitting

  • The output layer is fitted as multinomial logistic regression on reconstructed features and cached labels, yielding a decoder rather than uniquely identifying the victim’s output weights.The fit uses weak regularization; absent classes require a coverage check or explicit restriction because zero output rows can still win the reconstructed argmax.Source: §6.3 · p. 22

6.4 Gradient Masking and Exact Row Preservation

  • With masked gradients, zero initial Adam moments, and decoupled weight decay satisfying 0 ≤ ηtλt < 1, a recovered row keeps its signed direction; exact value requires zero decay or restoring the saved row after each update.Nonzero inherited moments and unmasked updates need separate handling; direction preservation does not preserve the original hidden feature map.Source: §6.4 · p. 23
  • Restoring selected rows after each proposed update enforces exact coordinates, while retaining the best checked checkpoint including the entry state guarantees no worse agreement on the stopping sample—not on an independent test sample.In 906 nonempty layer comparisons, masked AdamW without restoration changed every recovered-row group; separate restoration configurations report exact preservation.Source: §6.4 · p. 24

7 Experimental Results

The experiments compare assisted reconstruction protocols and define functional metrics for evaluating agreement with the victim. Their data slices and reuse in selection constrain how the reported agreement should be interpreted.

7 Experimental Results

  • The comparison measures assisted extraction, not a strict hard-label attack at equal information access.Direction coverage uses privileged checks, and extraction also uses gradients, hidden activations, and victim parameters.Source: §7 · p. 24
  • Joint-fit and split-fit protocols assign different roles to fitting, sign scoring, and evaluation slices.In the split-fit protocol, the evaluation slice is also used for early stopping, so it is not an untouched test set.Source: §7 · pp. 24–25, Table 2 · p. 25

7.1 Evaluation Metric

  • C1 reports agreement on the evaluation and selection slice, while C2 averages agreement on uniform and Gaussian probe pools.Interpolation-path agreement is reported separately and is excluded from C2.Source: §7.1 · p. 26
  • C3 is a label-based search-radius proxy, not the exact distance to the nearest decision boundary.High C2 also does not prove structural recovery; direct parameter comparisons are needed to assess that.Source: §7.1 · pp. 26–27

7.2 Per-Victim Extraction Results

The per-victim results show that high prediction agreement can coexist with incomplete direction recovery, and extensive direction coverage can coexist with modest agreement. The reported metrics therefore describe different aspects of reconstruction.

7.2 Per-Victim Extraction Results

  • Reported sign accuracy is the unweighted mean across nonempty hidden layers, not the pooled neuron fraction.Task accuracy compares predictions with dataset labels, whereas agreement compares them with victim predictions.Source: §7.2 · pp. 27–28
  • At least 99.30% agreement was reached on each of the six synthetic victims.tiny_relu reached 100% agreement with 139 of 256 directions accepted.Source: §7.2 · p. 27, Table 6 · p. 27
  • For cifar_leakyrelu, 807 of 832 directions were accepted, but agreement was only 58.29%, showing that high direction coverage was not sufficient for high functional agreement.Source: §7.2 · p. 28

7.3 ReLU versus Leaky ReLU Recovery

Leaky ReLU has more accepted directions than ReLU in each reported architecture, but the size and depth pattern of the advantage varies. Repeated extractions also show that deepest-layer coverage need not decline with depth.

7.3 ReLU versus Leaky ReLU Recovery

  • Leaky ReLU has 5, 6, 87, and 308 more accepted directions across the four architectures, respectively.These counts do not isolate the negative-side slope because trained parameters, sampled geometry, and the acceptance rule also affect the comparison.Source: §7.3 · p. 28, Table 7 · p. 28

7.4 Depth and the Deepest Hidden Layer

  • In 40 tiniest_relu extractions, fc4 had at least as many accepted directions as fc3 in all runs and more in 35.These sampled counts do not imply monotonic coverage with depth.Source: §7.4 · p. 28, Table 8 · p. 28
  • Under ReLU, inactive coordinates can create zero columns in the local tangent matrix; a stronger kernel bound requires an additional independence condition.With Leaky ReLU, a strictly negative coordinate has nonzero slope α, so this particular zero-column argument does not apply.Source: §7.4 · p. 29
  • For the three ReLU synthetic architectures, reported inactive-coordinate counts were 0, 1, and 2, while fc4 coverage was 5/8, 0/8, and 0/64.The pattern is consistent with inactive coordinates reducing available constraints, but does not prove they caused rejection.Source: §7.4 · pp. 28–29

7.5 Two-Arm Metric Comparison

The two-arm comparison finds no uniform synthetic-data advantage for assisted reconstruction, while it favors assisted reconstruction on all three reported functional metrics for both CIFAR victims. The additive ablation shows output-layer fitting drives the largest agreement increase, with later changes constrained by saturation and separate scoring.

7.5 Two-Arm Metric Comparison

  • The baseline is described as using the same label-query budget, but a complete cost comparison must also count extraction and evaluation requests and disclose privileged access.Matching cached labels does not match the information used to construct the assisted arm’s initial parameters.Source: §7.5 · p. 29
  • All three reported metrics favor assisted reconstruction on both CIFAR victims, although the reported differences are score differences rather than proof of broader superiority.The scorecards also report paired discordant counts against the victim reference; their evaluation-slice selection limits independent-test significance.Source: Table 9 · p. 29, §7.5 · p. 30
  • Distillation exceeds assisted reconstruction on C2 by 0.1138 for tiniest_relu and 0.0906 for tiny_leakyrelu, so synthetic comparisons show no uniform advantage.On five of nine rows, C1 and C3 are both 1.0000 in both arms, leaving C2 as the differentiating metric.Source: Table 9 · p. 29, §7.5 · p. 30
  • The optimizer comparison is limited by reused extraction artifacts, single-run results, and possible immediate termination once scoring agreement saturates.On tiny_relu, the sign mean changes from 0.502756 to 0.518381 while C1 and C3 remain 1; the off-distribution score changes from 0.4335 to 0.4900.Source: §7.5 · p. 30
  • The composite score’s structural term assigns distillation zero for lacking extraction records, an accounting convention that builds in an advantage for extraction.A fair structural comparison would independently match distillation weights while allowing permutation and scale ambiguities.Source: §7.5 · p. 30

7.6 Additive Reconstruction Ablation

  • For tiny_relu, output-layer fitting raises agreement from 14.34% after bias estimation to 100.00%, the largest increase in the ablation.The 3.00% raw score precedes both steps; a successful fit shows the reconstructed features separate these labeled samples, not that they equal the victim’s features.Source: §7.6 · pp. 30–31, Table 10 · p. 31
  • For tinier and tiny, post-fit agreement is at least 99.92%; on tiniest, sign search changes agreement by +7.00 points under ReLU and −0.10 under Leaky ReLU.Refinement adds +0.30 and +1.00 points, respectively; the Leaky ReLU decrease can occur because selection uses a separate cached scoring set.Source: §7.6 · p. 31
  • Reconstruction and distillation tie on tinier and tiny, while reconstruction exceeds distillation by 3.70 and 0.30 percentage points on the two tiniest rows.Before output-layer fitting, bias estimation can lower agreement while the decoder remains randomly initialized, making that score unreliable for judging the bias estimates.Source: §7.6 · p. 31

7.7 Shortcut and Reconstruction Comparisons

The shortcut and reconstruction comparisons use separate fitting, scoring, and reporting protocols, with recorded access and query-cost checks. Results include agreement and accepted-row comparisons, while finite block tests support only limited separation of candidate construction from scoring.

7.7 Shortcut and Reconstruction Comparisons

  • The split-fit protocol fits on Xtest, scores on Xtest2, and reserves Xtest3 for reporting, whereas joint-fit uses a union pool and reporting slice for early stopping.The split-fit phase-3 logs show no requests outside their phase-specific input contract and no identical rows across slices, but this does not establish statistical independence.Source: §7.7 · pp. 31–32
  • The 48-run batch varies four shortcuts individually while retaining true-prefix and true-walk assistance, and compares joint-fit with split-fit phase-3 protocols.The input guard returns logits even though inspected consumers reduce them to labels; a strict label-only interface must restrict the return value itself.Source: §7.7 · pp. 31–32
  • Across 1,344 models, all 4,032 prediction vectors and all 576 stage-agreement values match recomputation from numeric checkpoint parameters.Table 11’s comparison uses gradient masking without row restoration.Source: §7.7 · p. 32, Table 11 · p. 32
  • On tiny ReLU, D1 accepts 142/256 rows with assistance and 24/256 without; on tiny Leaky ReLU, the corresponding counts are 231/256 and 88/256.These counts come from distinct search realizations; across the batch, 2,063 of 3,002 decided rows have correct recovered-frame votes.Source: §7.7 · p. 32, Table 11 · p. 32
  • Finite tests over 27 sign blocks support candidate/scoring separation for those block procedures, but the union-fitted decoder does not satisfy the proposition’s fixed-family condition.The block tests do not establish global parameter identification or optimization accuracy of the full adaptive search.Source: §7.7 · pp. 32–33
  • The phase-3 ledger records 3,537,152 input evaluations across 48 runs, while the harness’s constant 20,000 budget does not equal those totals.A phase-3 ledger omits phases 1 and 2, and cost comparisons must distinguish repeated evaluations, distinct inputs, and privileged reads.Source: §7.7 · p. 33

7.8 Row restoration, victim-free walks, and seeded repetitions

Row restoration enforces exact preservation at recorded optimizer steps, unlike gradient masking alone. The victim-free sign walk has lower sign accuracy despite high final agreement, and the seeded results delimit both held-out performance and recovery-depth claims.

7.8 Row restoration, victim-free walks, and seeded repetitions

  • Across 48 restoration runs per protocol, accepted row coordinates show zero recorded change at all 672 checked checkpoints; masking alone changes coordinates by up to approximately 1.54 × 10^-4 or 1.23 × 10^-4.The restoration reference resets at each refinement call, so intentional sign changes between calls remain possible; small agreement differences do not establish statistical equivalence.Source: §7.8 · p. 33
  • The victim-free replacement has 836/1,810 correct sign votes (46.19%), versus 1,255/1,819 (68.99%) for the canonical walk, yet its final agreement averages 0.99658 across 24 runs.The denominators differ, the walks exhaust available dual points, and their artifacts still originate from assisted extraction.Source: §7.8 · p. 34
  • The 40-run study evaluates four phase-3 protocols on the same 5,000-input held-out pool, disjoint from fitting, scoring, and stopping data.The separate-stopping-pool variant changes restoration and checkpoint selection together, so their individual effects are not isolated.Source: §7.8 · p. 34, Table 12 · p. 34
  • The 0.9890 minimum applies to the 40 seeded runs in Table 12; a separate D1 ON tiniest Leaky ReLU model scores 0.9882 on the 5,000-input pool.The table minimum is specific to its configuration and seed set, and stopping-sample scores are not independent test estimates.Source: Table 12 · p. 34, §7.8 · p. 35
  • Including the entering checkpoint prevents deterioration on the stopping sample, but the restoration-plus-separate-stopping variant improves held-out agreement over split-fit by only 0.000425 on average, with mixed run outcomes.There are 22 runs improving, 14 worsening, and four unchanged; held-out benefit is smaller and not uniform.Source: §7.8 · p. 34
  • The eight-seed recovery-depth experiment covers six synthetic victims, and its repeated tiniest cases are not additional independent repetitions.The seeded setup fixes machine, library versions, and thread settings; reproducibility across other configurations is not established.Source: Table 13 · p. 35, §7.8 · p. 35
  • Leaky ReLU has more accepted directions in the largest architecture, including its deepest layer, but the deepest-layer ordering reverses on average for tiniest.The comparison concerns fixed trained victims and does not isolate activation choice from training or learned-parameter differences; full agreement on finite reporting inputs is not equality on every input.Source: §7.8 · p. 35

8 Conclusion

The paper combines assisted direction extraction with label-based reconstruction and proves conditional guarantees for several recovery and preservation steps. Experiments show bounded, nonuniform advantages and do not establish an end-to-end label-only attack or exact parameter recovery.

8 Conclusion

  • The method combines assisted weight-direction extraction with bias estimation, sign search, output-layer fitting, and gradient-masked refinement.The paper proves conditional bounds for approximate-prefix direction estimation, local distance-vote preservation, aligned parameter-error effects on predictions, and sign selection with independent scoring data.Source: §8 · p. 36
  • Leaky ReLU yields substantially more accepted directions on the largest synthetic architecture, but no uniform deepest-layer advantage on the smallest.Synthetic comparisons show no uniform advantage over distillation; both CIFAR comparisons favor assisted reconstruction on three functional metrics, with agreement below 60%.Source: §8 · p. 36
  • Privileged extraction accesses prevent these experiments from establishing a label-only end-to-end attack, and prediction agreement does not establish exact parameter recovery.A strict-oracle evaluation would need to replace true prefixes and ground-truth acceptance checks, account for queries per input, and reserve a final test slice unused for early stopping.Source: §8 · p. 37

A Mathematical Results and Implementation

This section maps mathematical results to implementation routines and clarifies the conditions attached to their guarantees. It distinguishes guarantees for intermediate recovery steps from the separate evaluation procedures.

A Mathematical Results and Implementation

  • The paper presents sufficient conditions for its mathematical conclusions and evaluates the implemented procedures under Section 7 configurations.Source: A Mathematical Results and… · p. 39
  • Propositions 1 and 2 correspond to signature-recovery routines that compute tangent-space constraints and transport them through the prefix, with Proposition 2 bounding transport error.The routines are intersect, is_consistent, and extract_weights; forward_around and relu_around transport the constraints.Source: A Mathematical Results and… · p. 39
  • Proposition 4 and Lemma 3 impose separate conditions: approximate affine calculations must preserve distance ordering, while independent votes need positive correctness advantage for a majority-error bound.Stable distance ordering alone does not establish that the sign interpretation is correct.Source: A Mathematical Results and… · p. 39
  • Propositions 7 and 9 respectively concern sign selection with a candidate family fixed independently of scoring data and prediction changes from aligned parameter errors.Bias recovery uses Eq. (7), sign search scores candidates and flips a neuron’s row jointly with its bias, and the output layer is fitted to labels.Source: A Mathematical Results and… · p. 39
  • Equation (8) specifies exact row restoration, whereas Proposition 10 describes masked AdamW; checkpoint selection guarantees apply to its fixed stopping sample, not separately evaluated held-out agreement.The entering model remains a checkpoint candidate.Source: A Mathematical Results and… · p. 39
Loading 2610.33671v1…