Algebraic Attack on Convolutional Neural Networks with Max Pooling

Computer Science > Cryptography and Security [Submitted on 8 Aug 2026] Algebraic Attack on Convolutional Neural Networks with Max Pooling Zirui Chen, Shi Tang, Zhengchao Gao, Yongjia Su, Lingyue Qin, Xiaoyang Dong Recovering the weights and biases of deep neural networks (DNNs) via black-box input-output queries, known as parameter extraction attacks, has been extensively studied for ReLU-based fully connected neural networks (FCNNs), but remains unexplored for convolutional neural networks (CNNs) with the max pooling function, a core architecture for computer vision and multimedia processing. The key challenge lies in the CNN max pooling layer, which introduces an additional non-linearity and hides ReLU critical points, rendering existing FCNN extraction methods inapplicable. To address this gap, we propose the first cryptanalytic extraction attack tailored for CNNs with the max pooling function. First, we establish an algebraic representation of CNNs, formally proving that CNNs are piecewise linear functions enabling the extension of linearity-based extraction principles. We then identify two novel types of critical points in CNNs: ReLU-Pooling Critical Points (RPCPs) and Pooling Switching Points (PSPs). We design complementary extraction techniques: a pattern matching method for RPCPs to recover partial signatures and signs, and an internal differential extraction attack for PSPs, inspired by cryptographic internal differential analysis, to recover high-accuracy signatures. Given that PSPs are far more abundant than RPCPs and yield a highly efficient extraction method, and that RPCPs are indispensable for bias recovery, we integrate both methods: the PSP method enables efficient signature extraction, while a single RPCP recovers the sign and bias. We evaluate our attack on multiple CNN architectures, including modern adaptations of LeNet-5, trained on random data, MNIST, and CIFAR-10. Experimental results demonstrate that our approach achieves high extraction accuracy with polynomial query complexity and runtime, even for deep CNN layers. This work fills a research gap in CNN security. Subjects: Cryptography and Security (cs.CR) Cite as: arXiv:2608.08030 [cs.CR]   (or arXiv:2608.08030v1 [cs.CR] for this version)   https://doi.org/10.48550/arXiv.2608.08030 Focus to learn more Submission history From: Zirui Chen [view email] [v1] Sat, 8 Aug 2026 09:36:35 UTC (1,384 KB) Access Paper: HTML (experimental) view license Current browse context: cs.CR < prev   |   next > new | recent | 2026-08 Change to browse by: cs References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)