MER-Inspector: Model Extraction Risk Framework

• MER-Inspector is a framework for assessing model extraction risk that combines an NTK-based theoretical metric (MRC) with victim model accuracy (VMA).
• It employs an attack-agnostic approach by leveraging worst-case threat modeling, kernel-based analysis, and a lightweight comparator to rank models.
• The framework demonstrates robust performance across various architectures and datasets, emphasizing practical insights for both pre-attack risk assessment and operational monitoring.

Model Extraction Risk Inspector (MER-Inspector) denotes a family of mechanisms for assessing or monitoring model extraction risk in machine learning services. In its primary and most formalized sense, MER-Inspector is an attack-agnostic framework for comparing how vulnerable trained models are to model extraction attacks (MEAs) by combining an NTK-based theoretical metric, Model Recovery Complexity (MRC), with an empirical metric, victim model accuracy (VMA), without committing to any specific extraction algorithm (Zhang et al., 23 Sep 2025). The term has also been used in adjacent operational settings, including benign-calibrated traffic-window detection for LLM APIs and extraction-warning monitors for decision-tree MLaaS deployments, which emphasizes that the name spans both ex ante risk assessment and online attack monitoring rather than a single implementation (Liu et al., 4 Jun 2026, Kesarwani et al., 2017).

1. Conceptual basis and problem setting

MER-Inspector, in the 2025 formulation, is designed for the problem of model function leakage: an adversary reproduces a victim model’s decision function through black-box access. The underlying concern differs from data privacy leakage such as membership inference or reconstruction. MEAs copy the victim by querying it with labels or posteriors and training a surrogate to match either ground truth, measured as attack accuracy, or the victim’s outputs, measured as fidelity (Zhang et al., 23 Sep 2025).

The central design choice is attack agnosticism. Attack-empirical risk estimates are costly, specific to the attack in vogue, and quickly outdated; moreover, model owners do not control the attacker’s data, query budget, or strategy. MER-Inspector therefore adopts a worst-case threat model defined as the union of capabilities across MEAs and seeks risk metrics that depend on the victim’s model and data rather than on a particular attack implementation (Zhang et al., 23 Sep 2025).

The formal setting is a $K$-class classification task with training data

$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$

A deep model $f_\theta(x)\in\mathbb{R}^K$ outputs logits, with prediction

$y(x)=\arg\max_k f_\theta^k(x).$

The victim parameters are $\theta_v$, the surrogate parameters are $\theta_s$, and the initialization is $\theta_0$ (Zhang et al., 23 Sep 2025).

A common misconception is that MER-Inspector is itself an MEA or a benchmark suite. In the 2025 formulation it is neither: it is a framework for comparing extraction risk between trained models without executing an attack, although attack-empirical fidelity is used as ground truth to train and evaluate its comparator model (Zhang et al., 23 Sep 2025).

2. NTK-based theoretical formulation

The theoretical foundation of MER-Inspector is Neural Tangent Kernel (NTK) theory. For wide networks, the model output is linearized around initialization through the first-order Taylor expansion

$$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$

where $\Delta\theta=\theta-\theta_0$. The corresponding output change is

$$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$

The NTK is defined as

$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$0

Over training samples, the empirical NTK matrix $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$1 has blocks $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$2. In the infinite-width limit and under mild non-parallel input assumptions, $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$3 is positive definite and remains stationary during training (Zhang et al., 23 Sep 2025).

Under the worst-case threat model, linearized model extraction becomes a regularized kernel classification problem in the RKHS induced by $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$4:

$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$5

By the representer theorem,

$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$6

For squared loss, the unique minimizer has the closed form

$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$7

and

$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$8

where $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$9 concatenates $f_\theta(x)\in\mathbb{R}^K$0 across training points, and $f_\theta(x)\in\mathbb{R}^K$1 collects kernels $f_\theta(x)\in\mathbb{R}^K$2 (Zhang et al., 23 Sep 2025).

The same NTK regime yields a projection form for parameter dynamics:

$f_\theta(x)\in\mathbb{R}^K$3

where

$f_\theta(x)\in\mathbb{R}^K$4

is a projection onto the span of the Jacobians at the chosen inputs. As the attacker’s sample set expands, $f_\theta(x)\in\mathbb{R}^K$5 approaches identity on the subspace spanned by training gradients, so $f_\theta(x)\in\mathbb{R}^K$6 tends toward $f_\theta(x)\in\mathbb{R}^K$7 (Zhang et al., 23 Sep 2025).

This formulation is significant because it links MEA performance to kernel geometry and training dynamics rather than to any particular attack heuristic. A plausible implication is that the framework is meant to remain informative even when the attack surface changes, provided the NTK approximation continues to capture the relevant function-space structure.

3. Fidelity bounds, generalization, and Model Recovery Complexity

The theoretical analysis centers on fidelity, defined as the probability that victim and surrogate predictions agree:

$f_\theta(x)\in\mathbb{R}^K$8

Using the fidelity margin

$f_\theta(x)\in\mathbb{R}^K$9

the fidelity gap is

$y(x)=\arg\max_k f_\theta^k(x).$0

MER-Inspector derives a bound on this disagreement probability in terms of three components: empirical margin loss on training samples, a complexity term involving $y(x)=\arg\max_k f_\theta^k(x).$1 and the NTK-induced quadratic form $y(x)=\arg\max_k f_\theta^k(x).$2, and a sample-complexity term depending on $y(x)=\arg\max_k f_\theta^k(x).$3 and $y(x)=\arg\max_k f_\theta^k(x).$4 (Zhang et al., 23 Sep 2025).

The generalization error of the surrogate is bounded by the fidelity gap and the victim’s own error:

$y(x)=\arg\max_k f_\theta^k(x).$5

where

$y(x)=\arg\max_k f_\theta^k(x).$6

This gives an explicit route from victim properties and NTK geometry to an upper bound on surrogate generalization error (Zhang et al., 23 Sep 2025).

MER-Inspector’s principal theoretical metric is Model Recovery Complexity:

$y(x)=\arg\max_k f_\theta^k(x).$7

This quantity is the RKHS norm of the optimal kernel solution when empirical loss is zero, so it measures the “size” of the victim’s output change in the NTK-induced feature space. Using the projection dynamics, it can also be rewritten as

$y(x)=\arg\max_k f_\theta^k(x).$8

The interpretation given in the paper is operational: a small MRC implies that the surrogate can closely recover the victim’s weight change, increasing extraction risk, whereas a large MRC indicates harder recovery and thus lower risk. No additional normalization is required because the quadratic form is already an intrinsic NTK-RKHS norm (Zhang et al., 23 Sep 2025).

This is the most distinctive feature of the framework. Prior attack benchmarking typically reports fidelity or agreement after running a concrete attack; MRC instead attempts to quantify extractability from the victim model’s geometry before an attack is instantiated.

4. Integration with victim model accuracy and the comparison framework

MER-Inspector does not rely on MRC alone. The paper reports that victim model accuracy has a strong positive correlation with extraction risk, measured by fidelity. Across models and datasets, the Pearson correlation coefficient between VMA and attack fidelity reaches $y(x)=\arg\max_k f_\theta^k(x).$9, and Kendall rank correlation is $\theta_v$0. At the same time, VMA saturates when models have similar accuracies, for example when accuracies cluster near $\theta_v$1, which limits its discriminative power for fine-grained comparisons within an architecture family (Zhang et al., 23 Sep 2025).

The framework therefore integrates a theoretical metric and an empirical metric. For each model, MER-Inspector computes a two-dimensional risk vector

$\theta_v$2

To increase separability, a pair $\theta_v$3 is augmented with the difference $\theta_v$4, yielding the feature vector

$\theta_v$5

A lightweight fully connected comparator is then trained on labeled pairs indicating which model has higher measured attack fidelity. The comparator has three hidden layers of sizes $\theta_v$6, $\theta_v$7, and $\theta_v$8, uses ReLU activations, and has a sigmoid output. Its output is a binary decision indicating whether $\theta_v$9 (Zhang et al., 23 Sep 2025).

The comparator is trained using attack fidelity ground truth from an MEA validation protocol in which the attacker uses the same architecture and hyperparameters as the victim, queries all training samples with full posteriors, trains the surrogate for $\theta_s$0 epochs, and records maximum fidelity on the test set. This empirical attack is used only to label pairs for training and evaluation, not as the deployed risk measure (Zhang et al., 23 Sep 2025).

The reported experimental scope includes five datasets—CIFAR-10, CIFAR-100, FashionMNIST, STL-10, and CelebA—and sixteen victim architectures from four groups: ResNet20, ResNet32, ResNet44; WRN22-2, WRN22-4, WRN22-8, WRN28-2, WRN34-2, WRN40-2; DenseNet121, DenseNet169, DenseNet201; and LeViT-128, LeViT-192, LeViT-256, LeViT-384 (Zhang et al., 23 Sep 2025).

The most cited performance summary is comparative accuracy (CAcc). In intra-group comparisons, MRC alone achieves $\theta_s$1, VMA alone $\theta_s$2, and combined VMA+MRC $\theta_s$3. In inter-group comparisons, VMA alone achieves $\theta_s$4, MRC alone $\theta_s$5, and combined VMA+MRC $\theta_s$6. Across all pairs, VMA+MRC reaches $\theta_s$7 CAcc with feature augmentation, outperforming VMA alone at $\theta_s$8 and MRC alone at $\theta_s$9; without feature augmentation, combined performance drops to $\theta_0$0 (Zhang et al., 23 Sep 2025).

These results motivate the framework’s basic division of labor: MRC is strongest within architecture groups, whereas VMA is strongest across more heterogeneous architecture families. This suggests that neither metric is sufficient in isolation across the full model-selection problem.

5. Practical computation, hyperparameters, and limitations

Finite-width implementation requires several engineering choices. Because the empirical NTK is not perfectly stationary at initialization in finite-width networks, the paper recommends computing $\theta_0$1 after training for stability. Since $\theta_0$2 may be nearly singular, its eigenvalues are floored at $\theta_0$3 before inversion, with $\theta_0$4 used as the default. Exact NTK computation scales as $\theta_0$5 and is infeasible at full scale, so MER-Inspector samples a small set of $\theta_0$6 inputs to construct $\theta_0$7 (Zhang et al., 23 Sep 2025).

Sample selection is based on prediction-margin extremes. For each sample,

$\theta_0$8

The method selects $\theta_0$9 samples with largest margins as simple points and $$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$0 with smallest margins as hard points, using the difficulty ratio $$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$1. The approximate MRC computation then proceeds in five steps: select $$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$2 samples by difficulty ratio $$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$3; compute gradients and assemble the NTK; floor eigenvalues below $$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$4 and reconstruct $$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$5; compute the victim’s output probability change vector on the same set; and return

$$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$6

The default hyperparameters are $$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$7, $$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$8, and $$f_\theta(x)\approx f_{\theta_0}(x)+\Delta\theta^\top \nabla_\theta f_{\theta_0}(x),$$9 (Zhang et al., 23 Sep 2025).

Sensitivity studies clarify the operational regime. Larger $\Delta\theta=\theta-\theta_0$0 improves MRC-fidelity correlation; for the LeViT group, PCC improves from approximately $\Delta\theta=\theta-\theta_0$1 at $\Delta\theta=\theta-\theta_0$2 to approximately $\Delta\theta=\theta-\theta_0$3 at $\Delta\theta=\theta-\theta_0$4. A balanced difficulty ratio $\Delta\theta=\theta-\theta_0$5 is reported as robust across groups. Hard samples carry more weight for less generalizable models such as ResNet and LeViT, whereas simple samples matter more for better-generalizing models such as WideResNet. For the NTK eigenvalue floor, $\Delta\theta=\theta-\theta_0$6 gives the best trade-off by ensuring most $\Delta\theta=\theta-\theta_0$7 are positive definite, approximately $\Delta\theta=\theta-\theta_0$8, while preserving fine-grained NTK information; smaller $\Delta\theta=\theta-\theta_0$9 or larger $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$0 harms performance (Zhang et al., 23 Sep 2025).

The cost advantage over explicit attack execution is substantial. Computing MRC with $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$1 samples for a model with approximately $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$2 million parameters takes approximately $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$3 seconds, whereas executing even a simple MEA with a surrogate trained for $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$4 epochs takes approximately $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$5 seconds (Zhang et al., 23 Sep 2025).

The framework nonetheless has explicit assumptions and failure modes. The NTK analysis assumes wide, over-parameterized networks and identical initialization; finite-width models, especially transformers such as LeViT, can deviate from NTK idealizations, weakening absolute correlations across architecture families. MRC depends on $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$6 and sample selection, and too few samples can under-represent the Jacobian span. VMA saturates when accuracies are similar. The fidelity and generalization bounds depend on RKHS margin analysis with margin $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$7, confidence $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$8, and the data-distribution quantity $$\Delta f_\theta(x):=\Delta\theta^\top \nabla_\theta f_{\theta_0}(x).$$9, so bound tightness is not uniform across settings (Zhang et al., 23 Sep 2025).

The paper also reports robustness under several practical threat variations. For an “Only Label” attacker, overall CAcc with VMA+MRC is $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$00; for “CIFAR100 $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$01 CIFAR10,” overall CAcc is $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$02; under budgeted queries with uncertainty-based or K-center active querying, VMA+MRC achieves $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$03 to $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$04 CAcc across inter-group pairs (Zhang et al., 23 Sep 2025).

6. Related formulations, prior work, and broader uses of the name

The 2025 MER-Inspector is situated against attack-execution-based assessment. Prior risk assessments are described as relying on MEAs such as Knockoff Nets, ActiveThief, and MAZE, or on holistic attack benchmarking such as ML-DOCTOR and SecurityNet; these approaches are characterized as expensive, attack-specific, and not future-proof (Zhang et al., 23 Sep 2025). The motivation is reinforced by query-efficient attacks such as Marich, which uses public data and label-only APIs, and experimentally extracts models that achieve approximately $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$05–$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$06 of the target’s accuracy using approximately $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$07–$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$08 queries, while producing predictive distributions approximately $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$09–$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$10 closer to the target than prior active-sampling attacks (Karmakar et al., 2023).

The name “MER-Inspector” is also used for operational detection in LLM APIs. In that setting, the objective is not architecture comparison but benign-calibrated traffic-window distribution testing. Incoming windows of queries are embedded with a fixed encoder, and a detector flags the window when its distribution differs from historical benign traffic. The instantiated method uses Maximum Mean Discrepancy with benign-only threshold calibration, Gaussian RBF kernels, multi-kernel averaging over scales $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$11, reference averaging with $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$12, and a benign null distribution built from $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$13 benign-only comparisons. With window size $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$14, the reported averages are $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$15 benign FPR, $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$16 pure-attacker TPR, $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$17 average TPR over attacker fractions, and $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$18 balanced accuracy (Liu et al., 4 Jun 2026).

A still earlier monitoring line appears in the MLaaS literature on decision trees. “Model Extraction Warning in MLaaS Paradigm” defines extraction status using either information gain or coverage of the input feature space. The information-gain monitor computes

$$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$19

while the coverage-based monitor maintains per-leaf per-feature min-max summaries and computes a weighted overall extraction status from leaf hypervolumes and class priors. The paper studies both single-user and colluding adversaries on BigML decision-tree APIs and reports monotone increases in extraction status for colluding groups, including an example on GSS Survey with approximately $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$20 at $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$21, approximately $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$22 at $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$23, and approximately $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$24 at $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$25 under Tramer attack with $$D=\{(x^{(i)},y^{(i)})\}_{i=1}^N,\qquad x\in\mathbb{R}^d,\quad y\in\{1,\dots,K\}.$$26 queries per user (Kesarwani et al., 2017).

Formulation of MER-Inspector	Core mechanism	Reported scope
Attack-agnostic risk comparison	NTK theory, MRC, VMA, pairwise comparator	16 architectures, 5 datasets (Zhang et al., 23 Sep 2025)
LLM API traffic monitoring	Benign-calibrated MMD on query windows	14 attacker-normal pairs, mixed multi-user traffic (Liu et al., 4 Jun 2026)
MLaaS extraction warning	Information gain and query-summary coverage	Decision-tree models on BigML (Kesarwani et al., 2017)

Taken together, these uses indicate that “MER-Inspector” has become a broader label for systems that quantify extraction risk either structurally, through model-and-data geometry before an attack, or operationally, through observed query streams during an attack. The primary technical distinction is that the 2025 framework compares the relative extractability of models without running an MEA, whereas the LLM and MLaaS variants are monitors for suspicious extraction behavior in deployed services (Zhang et al., 23 Sep 2025, Liu et al., 4 Jun 2026, Kesarwani et al., 2017).