Tag
The paper provides a geometric interpretation of last-layer model stealing attacks on transformers using exterior differential systems, showing that recovery of the projection matrix is governed by the polar space of a quadric. It also characterizes an identifiability wall below the last layer, revealing what can and cannot be extracted.