The Geometry of Last-Layer Model Stealing

A new preprint maps the geometric conditions under which the final layer of a transformer network can be perfectly copied using an existing model-stealing method, while also defining hard limits on deeper reverse engineering [1][2]. The paper, posted to the arXiv preprint server on 5 June 2026 by Snigdha Chandan Khilar, uses geometry to explain how a machine learning model can be stolen with a technique already known in the research community [1][2]. The author identifies the exact conditions required to perfectly copy the final layer of a transformer network [1][2]. Transformers are the dominant architecture behind modern large language models, which are trained on vast amounts of text for tasks such as generation, summarization, and translation [11]. When the analysis moves deeper into the hidden layers, clear limits emerge [1][2]. The research demonstrates that a hidden network cannot be fully reverse engineered solely by inspecting the final results [1][2]. The work maps out what can and cannot be extracted from a model, offering a boundary line for security researchers and model developers [2]. The preprint appeared on arXiv, an open-access repository of electronic preprints that are moderated but not peer reviewed [9]. Founded in 1991, the repository passed the two-million-article milestone by the end of 2021 and now receives roughly 24,000 submissions per month [9]. The paper is accompanied by experimental community tools under the arXivLabs framework, a program launched in 2020 that lets third-party collaborators build features directly on article pages while adhering to arXiv’s values of openness and user-data privacy [8]. Model theft has drawn attention as neural networks underpin a growing range of commercial systems. Self-driving cars, for instance, combine neural networks with sensors such as LiDAR and cameras, yet the software remains unable to handle all driving conditions and has been involved in accidents and fatalities [4]. Public trust remains low; a 2022 survey found only 27 percent of the global population would feel safe in an autonomous vehicle [4]. The new geometric analysis does not claim to break transformer security entirely. Instead, it quantifies the gap between copying a final output layer and reconstructing the hidden computations that precede it [1][2]. The paper’s submission history lists only the single version posted on 5 June 2026 [1].