End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery

This paper presents the first fully black-box, end-to-end extraction of trained deep ReLU multilayer perceptrons using only hard labels, meaning the attacker sees class predictions but not logits or gradients. Its central innovation is the cosine sign-recovery method, especially signature-weighted cosine, which reuses intersection spaces already collected during signature recovery, applies pseudoinverse projection and whitening against competing neuron signatures, and requires no dedicated sign-recovery queries. With 50 intersection spaces per neuron, it correctly recovered 506 of 510 evaluated signs in an MNIST-trained 784-128(5)-10 model, while the prior boundary-walking approach produced far fewer correct signs at the same sample count. The complete pipeline addresses deeper-layer failures through decision-boundary validation, active-weighted cosine correction, projection-based sign recovery, adaptive searches for missing coordinates, and cross-layer extraction of unreachable weights. On trained MNIST and Fashion-MNIST models with 784 inputs, 4 or 6 hidden layers of width 16, and 10 outputs, it recovered every active neuron and achieved label agreements of 98.477% and 99.948% for MNIST, and 100.000% and 99.744% for Fashion-MNIST, evaluated on 100,000 standard-Gaussian inputs. The work targets model confidentiality risks relevant to deployed systems such as OpenAI services, although its experiments use compact ReLU classifiers; OpenAI Codex (GPT-5.6) was used only for implementation assistance, debugging, and code review.