Accuracy cost of fresh-head sampling for extraction resistance

Determine the accuracy cost of drawing a fresh classifier head from a distribution for each query in HE-OFT while using this mechanism to limit model extraction through label-only answers.

Background

The paper considers randomized response as a defense against extracting the encrypted shared head through repeated label queries, but observes that label noise degrades both extraction fidelity and the served model’s task accuracy. It then identifies an alternative in which a fresh head is sampled for each query, avoiding direct access to the query and affecting only predictions near decision boundaries.

Although this alternative has a known break at a higher query cost, its effect on accuracy in the HE-OFT arrangement is not evaluated. Quantifying that tradeoff would clarify whether fresh-head sampling can provide meaningful extraction resistance without undermining the utility of the served model.

References

One mechanism satisfies both restrictions, and we have not measured it. Drawing a fresh head from a distribution for each query needs no access to the query and changes only answers near a boundary. It has a known break at a higher query cost, and its accuracy cost under our arrangement is open.

— HE-OFT: Privacy-Preserving One-Shot Federated Fine-Tuning under Homomorphic Encryption  (2610.08255 - Kanpak et al., 6 Oct 2026) in Section VII, subsection “Extraction and Membership at Test Time,” paragraph “Noise on the returned label” (Section VII-A)