{"id":"24b4fad3-2ddc-4326-9653-ad5e3c3853b4","arxiv_id":"2505.19364","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"RADEP stacks existing defenses (adversarial training, uncertainty-based query detection, output perturbation, watermarking) to reduce the accuracy of extracted models, with experiments on MNIST, F-MNIST, CIFAR-10, and ImageNette.","lead":"A new security framework called RADEP combines several known defenses to stop attackers from copying machine learning models sold through cloud APIs. It adds adversarial training, detection of suspicious queries, and degraded outputs for likely attackers, and reports lower extraction success on four image datasets.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 1 adds zero-mean Gaussian noise to soft outputs; such noise cannot produce the large substitute-accuracy drops in Table III, so the central defense mechanism is underspecified or ineffective.","rationale":"The paper's headline result is the large reduction in substitute-model accuracy under JBDA-TR, Cloudleak, and KnockoffNet (Table III), supported by low-overhead claims (Table IV). The inference-time mechanism supposed to produce this reduction is the adaptive query response of Algorithm 1. The only mathematical operation specified there is addition of zero-mean Gaussian noise to the softmax output. Since E[delta] = 0, the expected perturbed response equals the original output; the attacker's objective is asymptotically unchanged, and duplicate queries average out the noise. Thus the claimed drops (e.g., MNIST JBDA-TR hard-label from 91.23% to 65.17%) are not explainable by the specified response. They could in principle come from progressive adversarial training, but Table I shows that component alone yields only a few points of reduction. They could come from an unspecified stronger perturbation (label flipping or adaptive scaling), but Algorithm 1 does not implement that, and no ablation attributes the Table III effect across layers. The paper also reports no epsilon values and no accuracy of the defended model on legitimate queries, despite the abstract's promise of minimal impact. The reader's weakest_assumption concerned calibration of suspicion weights and thresholds; that is related but secondary. Even a perfectly calibrated detector cannot help if the response it triggers is mathematically incapable of degrading the extracted model. Therefore the acceptance condition should be a precise specification of the response mechanism plus an ablation that isolates it and measures clean-query utility.","tokens_in":9335,"tokens_out":7007,"duration_ms":58349,"concrete_test":"Run a controlled ablation: train a victim without RADEP adversarial training or watermarking and apply only Algorithm 1 (with the paper's reported tau1, tau2, eps_low, eps_medium, eps_high) against the KnockoffNet soft-label MNIST attack using the same 60,000-query budget. Measure both substitute test accuracy and victim accuracy on the clean test set. If substitute accuracy stays within a few points of the no-defense baseline while victim accuracy remains high, Algorithm 1 as specified cannot explain Table III; if substitute accuracy collapses instead, the epsilon values must be disclosed and their effect on legitimate queries must be shown.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The load-bearing step is the adaptive response in Algorithm 1 (Sec. III-C): P_pert(y|q_i) = P(y|q_i) + delta, with delta ~ N(0, epsilon). Since delta has zero mean, the perturbed response is an unbiased estimate of the victim's true soft output. A substitute model trained on such labels over the reported query budgets (10^4-10^5 queries, Sec. IV-A2) minimizes an objective whose expectation is essentially the clean-label objective plus a variance term, so the minimizer remains close to the undefended victim function; repeated queries average away the noise. Therefore the large drops in Table III (e.g., MNIST JBDA-TR hard-label from 91.23% to 65.17%) cannot be attributed to Algorithm 1 unless epsilon is extreme, in which case legitimate users' outputs are also destroyed. No legitimate-user accuracy or utility table is reported, and the text's mention of label flipping and adaptive label scaling is not present in Algorithm 1, so the implemented defense is not the described defense. Without reported epsilon values, an ablation isolating this component, and clean-query accuracy, the central claim is unverified.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes RADEP, a multi-layered defense framework for MLaaS against model extraction attacks. RADEP combines progressive adversarial training, malicious-query detection via uncertainty quantification and behavioral analysis, an adaptive query-response mechanism that perturbs suspicious outputs based on a suspicion score, ownership verification via backdoor triggers and watermarking, and a periodic evaluation/adjustment loop. The central claim is that, under JBDA-TR, Cloudleak, and KnockoffNet attacks, RADEP substantially reduces the substitute model's test accuracy compared with no defense and with baseline defenses, while keeping detection below 0.01 ms per query and response times between 15 and 60 ms, with minimal impact on legitimate queries.","tokens_in":9635,"tokens_out":4625,"duration_ms":44050,"significance":"If the reported results are substantiated, RADEP would be a practically relevant contribution: it combines several defense ideas into one framework, evaluates against multiple modern extraction attacks, and reports low per-query overhead. The paper also usefully distinguishes hard-label and soft-label attack scenarios. However, the current manuscript does not provide enough detail to verify the central mechanism, and several load-bearing experimental claims are not backed by reproducible evidence: the perturbation algorithm is underspecified, no legitimate-user utility is measured, and all quantitative tables are point estimates without variance.","major_comments":[{"comment":"The adaptive response mechanism is the load-bearing component, but as specified it cannot produce the reported substitute-accuracy drops. Algorithm 1 (line 4) sets P_pert(y|q_i) = P(y|q_i) + delta with delta ~ N(0, epsilon), so the perturbed response is an unbiased estimate of the clean soft output. A substitute trained on 10^4 to 10^5 such queries (Section IV.A.2) minimizes an objective whose expectation is close to the clean-label objective plus a variance term, so the minimizer is close to the undefended victim function and repeated queries average away the noise. The surrounding text mentions label flipping and adaptive label scaling, but these are not implemented in Algorithm 1. The paper must specify the actual deterministic perturbation or label-scaling rule, report the epsilon values used, and provide an ablation that isolates this component; otherwise the large drops in Table III (e.g., MNIST JBDA-TR hard label from 91.23% to 65.17%) remain unexplained.","section":"Section III.C, Algorithm 1"},{"comment":"The paper claims 'minimal impact on legitimate queries' in the abstract and Section III.C, but no table or experiment reports utility for legitimate users, such as clean test accuracy of the protected model after applying detection and response. Since the response strength depends on suspicion thresholds tau1 and tau2 and the perturbation scales epsilon_low/medium/high, false positives can degrade benign outputs. A utility-versus-security curve or a clean-query accuracy table is necessary to support the trade-off claim.","section":"Abstract and Section III.C"},{"comment":"The central free parameters are not reported or released: the suspicion-score weights alpha_1..alpha_4, the detection threshold tau, the response thresholds tau1 and tau2, the perturbation schedule epsilon_low/medium/high, and the watermark perturbation in Eq. (4). Section III.B says alpha_i are calibrated on validation data and Section III.E says thresholds are adjusted periodically, but the calibration procedure, the resulting values, and the adjustment rule are absent. Without these, the experiments cannot be reproduced or checked for circularity, and the comparison in Tables II and III is not independently verifiable.","section":"Section III.B and Section III.E"},{"comment":"All experimental tables report single point estimates with no standard deviations, confidence intervals, or number of independent runs, and the baseline implementations (PRADA, OOD detection, DAWN, deceptive perturbation, AMAO, adaptive misinformation) are only named, not described in terms of hyperparameters or code. Given that some reported numbers differ by only a few points (e.g., Table I CIFAR-10 soft label 43.97 vs 43.14), statistical variation could change the ranking. The authors should report repeated-run statistics, seeds, and baseline configuration details, or release code.","section":"Section IV.A.4 and Tables I-III"}],"minor_comments":[{"comment":"Section IV.D states 'DAWN [16]' and 'Adaptive Misinformation [20]', but in the reference list [16] is Kariyappa and Qureshi (adaptive misinformation), [20] is Szyller et al. (DAWN), and [21] is Lee et al. (deceptive perturbation); the in-text citation numbers are inconsistent.","section":"Section IV.D"},{"comment":"Section IV.D references 'Table??' with an unresolved placeholder; the referenced table number should be Table III.","section":"Section IV.D"},{"comment":"Table I caption contains a typo: 'most effecgive results' should be 'most effective results'.","section":"Table I caption"},{"comment":"Section IV.A.4 lists PRADA as a comparison defense, but no PRADA results appear in Tables II or III; clarify whether PRADA was evaluated or remove it from the list.","section":"Section IV.A.4"}],"recommendation":"major_revision","confidential_remarks":"The manuscript appears to be an early-stage arXiv preprint with substantial presentation and citation inconsistencies. The core concern is that the described perturbation mechanism cannot plausibly account for the reported defense gains, so the authors need to provide a rigorous description of the actual algorithm and an ablation study. I would not recommend acceptance until the central mechanism is clarified and the experimental claims are made reproducible."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: RADEP is a sensible layering of existing defenses—adversarial training, uncertainty-based query scoring, response perturbation, watermarking/backdoors—and the paper evaluates it across three attacks and four datasets. That breadth is real work, and the overhead figures (sub-0.01 ms detection, 15–60 ms response) are useful if they hold. But the contribution is incremental: each component traces to prior work, and no single piece is new.\n\nThe soft spots are not tiny. Algorithm 1, the load-bearing adaptive response, adds zero-mean Gaussian noise to the soft output. As written, that noise is unbiased; a substitute model trained on enough queries would average it out, so it cannot explain the large accuracy drops in Table III. The prose mentions label flipping and adaptive label scaling, but neither appears in the algorithm. Either the implemented defense is different from the described one, or epsilon values large enough to explain the drops would also destroy utility for legitimate users—and no clean-query accuracy table is reported. Without an ablation isolating this component, the central claim is unverified.\n\nThe experimental reporting is also thin: no standard deviations or confidence intervals, no code, no fitted alpha_i values, no thresholds, no epsilon schedule, and only vague descriptions of baselines. The writing has defects: a Table?? placeholder, mismatched reference numbers (DAWN/adaptive misinformation confusion), and Table III's \"Baseline Defense\" is not identified clearly. These are fixable, but they make the paper hard to check.\n\nThe citation pattern is mostly standard; the self-citations are to the authors' own prior ML security work, which is not a problem here.\n\nWho gets value: readers working on MLaaS defenses will find the framework a useful checklist and the overhead data a data point. But the paper as submitted does not demonstrate that RADEP works as claimed.\n\nMy recommendation: send to peer review rather than desk reject—the topic is timely and the flaws are correctable—but the referee should require code and hyperparameters, an ablation of the response mechanism, and a legitimate-user utility table. Without those, the empirical claims should not stand.","headline":"An incremental but well-scoped MLaaS defense framework with extensive experiments; the empirical story is undercut by an underspecified response mechanism and missing artifacts.","tokens_in":10171,"tokens_out":2790,"would_cite":false,"duration_ms":28641,"reading_group":"maybe","serious_thinker":"unclear","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"RADEP, a four-layer MLaaS defense, claims to substantially cut substitute-model accuracy under JBDA-TR, Cloudleak, and KnockoffNet attacks while adding less than 0.01 ms per-query detection","keywords":["model extraction attack","Machine-Learning-as-a-Service","deep learning security","malicious query detection","adversarial training","adaptive response","watermarking","backdoor triggers"],"falsifier":"Run RADEP against a KnockoffNet-style attack whose surrogate query stream matches the frequency and variance of legitimate user traffic, and measure both the false-positive rate and the substitute model's final test accuracy; if the substitute accuracy approaches the no-defense level while false positives stay low, the suspicion-score separation is not carrying the defense.","tokens_in":9183,"feed_emoji":"🛡️","tokens_out":5993,"duration_ms":54019,"temperature":0.7,"pith_summary":"RADEP is a four-layer defense for machine-learning-as-a-service APIs that tries to make model extraction attacks fail without punishing legitimate users. The paper's central claim is that combining progressive adversarial training, a hybrid malicious-query detector, an adaptive response that perturbs suspicious outputs, and ownership verification reduces a substitute model's test accuracy substantially under JBDA-TR, Cloudleak, and KnockoffNet attacks, compared with no defense and with several baselines. The reported overhead is less than 0.01 ms per query for detection and 15 to 60 ms for response, which is what would make the defense practical in real-time serving. A sympathetic reader would take the paper as evidence that layered, adaptive defenses can beat static defenses against extraction while keeping latency low.","feed_headline":"Defense framework cuts extracted-model accuracy on three attack types","feed_subtitle":"Suspicious queries get stronger perturbation, and detection costs under 0.01 ms, keeping the defense inline in MLaaS APIs.","key_machinery":"The load-bearing object is the composite suspicion score of Eq. (2), $S(q) = \\alpha_1 (1-P_{\\max}(q)) + \\alpha_2 H(q) + \\alpha_3 (1-M(q)) + \\alpha_4 \\sigma(q)$, with entropy $H$ defined by Eq. (3) and Bayesian uncertainty $\\sigma$ from Monte Carlo dropout. Algorithm 1 maps $S(q)$ to three perturbation levels via thresholds $\\tau_1$ and $\\tau_2$ and outputs $P_{\\text{pert}} = P + \\delta$ with $\\delta \\sim \\mathcal{N}(0,\\epsilon)$. The mechanism works by making the perturbation a continuous function of how anomalous a query looks, so normal traffic is lightly touched while extraction queries receive noise that degrades the labels used to train a substitute model.","core_discovery":"On the paper's own terms, RADEP establishes that each layer contributes to the same end: adversarial training raises the cost of imitation, the composite suspicion score $S(q)$ (a weighted sum of max-softmax, entropy, margin, and Bayesian uncertainty) flags extraction queries, the adaptive response adds Gaussian perturbation with strength chosen by $S(q)$, and backdoor triggers plus watermarking identify stolen models. The reported numbers show substitute accuracy falling, for instance, from 91.23% to 65.17% under JBDA-TR hard-label on MNIST and from 83.72% to 65.51% under Cloudleak hard-label on the same dataset, while malicious-query detection accuracy reaches 95.86% on a KnockoffNet attack on MNIST.","pith_inferences":["Editorial inference: The suspicion score's weights and thresholds are the fragile part; a practical deployment would need continuous recalibration against new query patterns, and the paper does not provide a guarantee that the calibration procedure itself is adaptive.","Editorial inference: An attacker who mimics the query-frequency and variance statistics of legitimate users could in principle bypass the behavioral half of detection, leaving only the uncertainty metrics; a direct test would be to run KnockoffNet with a surrogate dataset whose query timing matches benign traffic.","Editorial inference: The framework could be combined with rate limiting or per-user query budgets, since the adaptive response degrades utility gradually; one testable extension is whether a query budget plus RADEP's perturbation yields strictly lower extraction accuracy than either alone.","Editorial inference: The reported resilience to adaptive adversaries might be tested by an attacker who trains a substitute on the perturbed responses themselves, effectively absorbing the noise; measuring substitute accuracy after such a noise-aware extraction would clarify the limits of the defense."],"forward_implications":["If RADEP works as reported, an attacker needs substantially more queries or a fundamentally different strategy to reach the same substitute accuracy, because the adaptive response degrades the labels used for training.","Legitimate users should see little change, since queries with low suspicion scores receive the smallest perturbations.","Ownership verification gives an MLaaS provider a way to trace unauthorized copies back to the original model, even after pruning or fine-tuning, via backdoor triggers and watermarks.","The reported per-query overhead means the defense can run inline in real-time API serving rather than as an offline audit."],"supporting_citations":[{"why":"Defines the JBDA-TR attack and the PRADA detection baseline that RADEP builds against.","marker":"[1]"},{"why":"Defines the Cloudleak feature-based extraction attack used in the evaluation.","marker":"[4]"},{"why":"Defines the KnockoffNet surrogate-data extraction attack used in the evaluation.","marker":"[5]"},{"why":"Provides the AMAO end-to-end defense baseline and the threat-model language for extraction attacks.","marker":"[7]"},{"why":"Supplies FGSM, the primary adversarial perturbation used in progressive adversarial training.","marker":"[13]"},{"why":"Supplies PGD for iterative adversarial training.","marker":"[14]"},{"why":"Supplies adaptive misinformation and out-of-distribution detection, baselines for detection accuracy and substitute accuracy.","marker":"[16]"},{"why":"Supplies the Bayesian uncertainty estimate (Monte Carlo dropout) used in the suspicion score.","marker":"[17]"},{"why":"Supplies DAWN, a baseline defense and the backdoor/watermarking ideas for ownership verification.","marker":"[20]"},{"why":"Supplies deceptive perturbation, a baseline defense that alters probability vectors.","marker":"[21]"}],"fun_headline_variants":["RADEP reduces stolen-model accuracy to 65% on hard-label attacks","Adaptive response adds perturbation to foil model extraction in MLaaS","Multi-layer defense: training, query detection, adaptive response, watermark","RADEP detects malicious queries at 95.86% accuracy, under 0.01 ms","Cut substitute accuracy by 26 points: RADEP's adaptive defense"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The suspicion score separates malicious from benign queries using weights and thresholds calibrated on validation data; if that calibration does not transfer to a new attack or a new data distribution, the adaptive response will either perturb legitimate answers or leave attackers effectively unperturbed.","fun_headline_variants_meta":{"raw":{"variants":["RADEP reduces stolen-model accuracy to 65% on hard-label attacks","Adaptive response adds perturbation to foil model extraction in MLaaS","Multi-layer defense: training, query detection, adaptive response, watermark","RADEP detects malicious queries at 95.86% accuracy, under 0.01 ms","Cut substitute accuracy by 26 points: RADEP's adaptive defense"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000539,"raw_usage":{"total_tokens":2587,"prompt_tokens":950,"completion_tokens":1637,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":566,"completion_tokens_details":{"reasoning_tokens":1538}},"tokens_in":566,"tokens_out":1637,"duration_ms":13318,"temperature":1.0,"reasoning_tokens":1538,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T14:14:43.043118+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run RADEP against a KnockoffNet-style attack whose surrogate query stream matches the frequency and variance of legitimate user traffic, and measure both the false-positive rate and the substitute model's final test accuracy; if the substitute accuracy approaches the no-defense level while false positives stay low, the suspicion-score separation is not carrying the defense.","supporting_citations":[{"cited_title":"Prada: protecting against dnn model stealing attacks,","cited_arxiv_id":null,"evidence_quote":"Defines the JBDA-TR attack and the PRADA detection baseline that RADEP builds against."},{"cited_title":"Cloudleak: Large-scale deep learning models stealing through adversarial exam- ples","cited_arxiv_id":null,"evidence_quote":"Defines the Cloudleak feature-based extraction attack used in the evaluation."},{"cited_title":"Knockoff nets: Stealing functionality of black-box models,","cited_arxiv_id":null,"evidence_quote":"Defines the KnockoffNet surrogate-data extraction attack used in the evaluation."},{"cited_title":"A comprehensive defense framework against model extraction attacks,","cited_arxiv_id":null,"evidence_quote":"Provides the AMAO end-to-end defense baseline and the threat-model language for extraction attacks."},{"cited_title":"Defending against model stealing attacks with adaptive misinformation,","cited_arxiv_id":null,"evidence_quote":"Supplies adaptive misinformation and out-of-distribution detection, baselines for detection accuracy and substitute accuracy."},{"cited_title":"Dawn: Dynamic adversarial watermarking of neural networks,","cited_arxiv_id":null,"evidence_quote":"Supplies DAWN, a baseline defense and the backdoor/watermarking ideas for ownership verification."},{"cited_title":"Defending against neural network model stealing attacks using deceptive perturbations,","cited_arxiv_id":null,"evidence_quote":"Supplies deceptive perturbation, a baseline defense that alters probability vectors."}],"review_version":1}