CopyCNN: Reverse Engineering Based
Extraction of Convolutional Neural Networks

Neural network extraction attacks pose a significant threat to the security and intellectual property of AI systems, enabling adversaries to replicate proprietary models, compromise their confidentiality, or exploit their functionality. In this paper, we present CopyCNN, a novel attack that extracts the exact weights and architecture of black-box, deep, ReLU-based convolutional neural networks (CNNs) using only query access. To the best of our knowledge, CopyCNN is the first method capable of recovering precise weights from black-box CNNs. It effectively reverse engineers key components—including fully connected, convolutional, residual, pooling, and batch normalization layers—enabling the extraction of architectures such as AlexNet, LeNet-5, and variants of VGG and ResNet. We establish the theoretical basis for CopyCNN and demonstrate its effectiveness through the successful extraction of several architectures. Our results highlight the practicality of CopyCNN for convolutional neural network extraction and its implications on AI security and computer vision applications.

Convolutional neural networks, model extraction attack, reverse engineering

1. W. Samek, G. Montavon, S. Lapuschkin, C. J. Anders, and K.-R. Müller, “Explaining deep neural networks and beyond: A review of methods and applications,” Proceedings of the IEEE, vol. 109, no. 3, pp. 247–278, 2021.

2. J. Zhang, Z. Gu, J. Jang, H. Wu, M. P. Stoecklin, H. Huang, and I. Molloy, “Protecting intellectual property of deep neural networks with watermarking,” in Proceedings of the 2018 on Asia conference on computer and communications security, 2018, pp. 159–172.

3. J. Ebrahimi, A. Rao, D. Lowd, and D. Dou, “Hotflip: White box adversarial examples for text classification,” arXiv preprint arXiv:1712.06751, 2017.

4. C. Xiao, B. Li, J.-Y. Zhu, W. He, M. Liu, and D. Song, “Generating adversarial examples with adversarial networks,” arXiv preprint arXiv:1801.02610, 2018.

5. M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20), 2020, pp. 1605–1622.

6. N. Haim, G. Vardi, G. Yehudai, O. Shamir, and M. Irani, “Reconstructing training data from trained neural networks,” Advances in Neural Information Processing Systems, vol. 35, pp. 22 911–22 924, 2022.

7. N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security, 2017, pp. 506–519.

8. F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction {APIs},” in 25th USENIX security symposium (USENIX Security 16), 2016, pp. 601–618.

9. T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4954–4963.

10. M. Juuti, S. Szyller, S. Marchal, and N. Asokan, “Prada: protecting against dnn model stealing attacks,” in 2019 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2019, pp. 512–527.

...