Abstract:Model stealing (MS) involves querying and observing the output of a machine learning model to steal its capabilities. The quality of queried data is crucial, yet obtaining a large amount of real data for MS is often challenging. Recent works have reduced reliance on real data by using generative models. However, when high-dimensional query data is required, these methods are impractical due to the high costs of querying and the risk of model collapse. In this work, we propose using sample gradients (SG) to enhance the utility of each real sample, as SG provides crucial guidance on the decision boundaries of the victim model. However, utilizing SG in the model stealing scenario faces two challenges: 1. Pixel-level gradient estimation requires extensive query volume and is susceptible to defenses. 2. The estimation of sample gradients has a significant variance. This paper proposes Superpixel Sample Gradient stealing (SPSG) for model stealing under the constraint of limited real samples. With the basic idea of imitating the victim model's low-variance patch-level gradients instead of pixel-level gradients, SPSG achieves efficient sample gradient estimation through two steps. First, we perform patch-wise perturbations on query images to estimate the average gradient in different regions of the image. Then, we filter the gradients through a threshold strategy to reduce variance. Exhaustive experiments demonstrate that, with the same number of real samples, SPSG achieves accuracy, agreements, and adversarial success rate significantly surpassing the current state-of-the-art MS methods. Codes are available at <a class="link-external link-https" href="https://github.com/zyl123456aB/SPSG_attack" rel="external noopener nofollow">this https URL</a>.

Model Stealing Attack Based on Sampling and Weighting

Towards Efficient Data Free Blackbox Adversarial Attack

Extracting Robust Models with Uncertain Examples

Fully Exploiting Every Real Sample: Super-Pixel Sample Gradient Model Stealing

Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealing

Data-Free Model Stealing Attack Based on Denoising Diffusion Probabilistic Model

Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networks

Exploring Query Efficient Data Generation towards Data-free Model Stealing in Hard Label Setting

DivTheft: an Ensemble Model Stealing Attack by Divide-and-Conquer

Making models more secure: An efficient model stealing detection method

Model Stealing Attack against Multi-Exit Networks

Efficient Model Stealing Defense with Noise Transition Matrix

GNMS: A Novel Method for Model Stealing Based on GAN

Model Stealing Attack against Recommender System

Defending Against Model Stealing Via Verifying Embedded External Features

Efficient Data-Free Model Stealing with Label Diversity

ML-Stealer: Stealing Prediction Functionality of Machine Learning Models with Mere Black-Box Access

Model Weight Theft With Just Noise Inputs: The Curious Case of the Petulant Attacker

Model Stealing Attack against Graph Classification with Authenticity, Uncertainty and Diversity

SwiftTheft: A Time-Efficient Model Extraction Attack Framework Against Cloud-Based Deep Neural Networks

Inversion-guided Defense: Detecting Model Stealing Attacks by Output Inverting