Deep neural networks, costly to train and rich in intellectual property value, are increasingly threatened by model extraction attacks that compromise their confidentiality. Previous attacks have succeeded in reverse-engineering model parameters up to a precision of float64 for models trained on random data with at most three hidden layers using cryptanalytical techniques. However, the process was identified to be very time consuming and not feasible for larger and deeper models trained on standard benchmarks. Our study evaluates the feasibility of parameter extraction methods of Carlini et al. [1] further enhanced by Canales-Mart\'inez et al. [2] for models trained on standard benchmarks. We introduce a unified codebase that integrates previous methods and reveal that computational tools can significantly influence performance. We develop further optimisations to the end-to-end attack and improve the efficiency of extracting weight signs by up to 14.8 times compared to former methods through the identification of easier and harder to extract neurons. Contrary to prior assumptions, we identify extraction of weights, not extraction of weight signs, as the critical bottleneck. With our improvements, a 16,721 parameter model with 2 hidden layers trained on MNIST is extracted within only 98 minutes compared to at least 150 minutes previously. Finally, addressing methodological deficiencies observed in previous studies, we propose new ways of robust benchmarking for future model extraction attacks.

该研究评估了对于在标准基准上训练的模型使用Carlini等人[1]进一步加强的参数提取方法的可行性，引入了统一的代码库并发现计算工具可以显著影响性能；通过识别更容易和更难提取的神经元，开发了进一步的优化方案，将提取权重值的效率提高了14.8倍；改进后，在只有98分钟的时间内，成功地提取了一个在MNIST数据集上训练的具有16,721个参数和2个隐藏层的模型，相较于之前至少需要150分钟的时间，同时针对先前研究中观察到的方法论缺陷，提出了未来模型提取攻击的新型健壮基准测试方法。

高保真模型提取中超越缓慢标志