{"id":"a25af20a-ea1d-4e19-814e-469a8761b102","arxiv_id":"2506.02362","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"MISLEADER trains an ensemble of distilled models that stay accurate for benign users but output misleading predictions on augmented inputs, reducing clone model accuracy in model extraction attacks.","lead":"This paper proposes MISLEADER, a defense that trains an ensemble of distilled models to give accurate answers to normal users but misleading answers to attackers trying to copy the model. It claims to work without assuming attacker queries are out of distribution, but the mechanism still depends on distributional differences between normal and attacker inputs.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Under exact in-distribution queries Q=P, Eq. (5) trains the defense to stay faithful on P and only deceive on augmented tilde P, so an attacker querying P receives the true model; Theorem 1's Q=P analysis uses a different objective, leaving the no-OOD claim untested.","rationale":"Reader identified the same load-bearing weakness: the augmented distribution tilde P = A_aug(P) is a proxy for Q, and Eq. (5) optimizes against that proxy. I agree and would emphasize one sharper internal inconsistency: Section 4.1 says it analyzes the case Q=P, but the algorithm's loss is not the risk function being bounded. The fidelity term is on P and the attacker term is on tilde P; the Rademacher bound in Theorem 1 is derived for an ERM objective whose samples all come from P. Therefore the theorem neither analyzes the algorithm nor establishes any guarantee for Q=P. The empirical results (Tables 1, 4, 5, Figure 3) do show large clone accuracy reductions under the tested DFME/DBME attacks, and the code is provided, so the method may be useful against attackers whose queries are distributionally shifted or synthetically generated. But those results do not support the headline claim of defense 'without relying on OOD assumptions,' because the only mechanism distinguishing attacker queries from benign queries is the augmentation pipeline, which is itself an assumption that attacker queries will resemble A_aug(P). The baseline comparison also handicaps perturbative defenses with an ell-1 budget of 1.0 while MISLEADER has no budget, but the decisive issue is the structural gap between Eq. (5) and the claimed threat model. I keep the reader's REJECT verdict: the central claim is not established as written.","tokens_in":18212,"tokens_out":4908,"duration_ms":46240,"concrete_test":"Use the released repository to run a data-based extraction attack with the attacker's query set set to the exact CIFAR-10 training split P (or a held-out split from the same distribution), querying the trained MISLEADER ensemble for soft labels and training a ResNet18_8x clone on those pairs. Compare clone test accuracy against the undefended target's 87.36% and against Table 5's DBME numbers. If clone accuracy is close to 87%, the defense fails under Q=P. In parallel, recompute the generalization bound in Theorem 1 for the actual objective in Eq. (5), with the fidelity term estimated from P and the deception term from tilde P; verify whether a uniform bound over that composite empirical risk still holds. If the bound requires the deception term to be sampled from P as well, the paper's theory does not apply to its own algorithm.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Central claim: MISLEADER defends against model extraction without relying on OOD assumptions. For this to hold, the defense must work when the attacker's query distribution Q equals the defender's training distribution P. The unified objective in Eq. (5) maximizes fidelity on P through the first term and penalizes clone alignment only on the augmented distribution tilde P = A_aug(P). Consequently, on inputs drawn from P, the defense model is trained to output approximately ft(x), so a clone trained on (x, d(x)) with x ~ P can recover the target's behavior. The augmentation operator does not remove this: crop, flip, color jitter, and grayscale are fixed transforms chosen by the defender, not the attacker, and there is no guarantee that tilde P covers P or that optimizing over tilde P reduces extraction risk on P. The theory in Section 4.1 makes the mismatch explicit: it states that it analyzes 'a simplified setting where the surrogate data distribution aligns with the true query distribution (i.e., Q=P)', but the risk functions in Definition 4 and the bound in Theorem 1 are evaluated over samples from P for both terms, whereas Algorithm 1 and Eq. (5) draw the deception term from tilde P. The proof in Appendix B.1 confirms the bound is for that P-based ERM objective, not for the actual training loss. Thus no theoretical result covers the claimed setting, and the empirical DBME evaluation (Table 5) uses Knockoff Nets with a surrogate only described as 'similar' to the training set, which is not the same as Q=P. The central claim is therefore unsupported; what remains is a plausible defense against distributionally shifted queries, which is a weaker claim.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes MISLEADER, a defense against model extraction attacks that claims not to rely on OOD assumptions. The defense trains an ensemble of distilled models using the bilevel objective in Eq. (5), which enforces agreement with the target model on the defender's training distribution P and penalizes agreement between a simulated clone and the defense on an augmented distribution tilde P = A_aug(P). The paper derives Rademacher-complexity and Wasserstein generalization bounds in Section 4 and reports experiments on MNIST, CIFAR-10, and CIFAR-100 showing lower clone accuracy and preserved utility compared with several baselines. The central claim is that the defense works when attacker queries are in-distribution, but the method and evaluation do not actually instantiate or test this setting.","tokens_in":18412,"tokens_out":5541,"duration_ms":52113,"significance":"An effective no-OOD defense would be a valuable contribution because existing defenses largely rely on detecting OOD queries. The empirical study is thorough in some respects: code is released, runs are repeated five times with standard deviations, and utility is preserved or improved. However, the load-bearing premise that the augmented distribution tilde P approximates the attacker's query distribution Q is not established, and Theorem 1 analyzes a different objective from the one optimized in Algorithm 1. The paper's main claim therefore remains unsupported, so the significance is conditional on a conceptual gap that is central to the paper.","major_comments":[{"comment":"The unified objective optimizes fidelity on P in the first term and deception only on the augmented distribution tilde P in the second term. For an attacker whose query distribution is exactly P, the defense model is trained to satisfy d(x) approx f_t(x) on every queried input, so a clone trained on (x, d(x)) with x ~ P recovers the target's behavior. This is precisely the regime the paper claims to handle ('does not rely on OOD assumptions'), but the objective gives the defender no mechanism to degrade extraction on P. The augmentation operator A_aug is a fixed set of defender-chosen transforms; no argument or experiment shows that optimizing on tilde P reduces extraction risk on P.","section":"Section 3.2, Eq. (5); Algorithm 1"},{"comment":"Theorem 1 is stated for a simplified setting with Q = P, and both terms in the population and empirical risks are expectations over P. Algorithm 1 and Eq. (5), however, train the attacker term on samples from tilde P. The bound therefore applies to a different ERM objective from the one actually optimized, as the proof in Appendix B.1 confirms. Thus the paper provides no theoretical guarantee for the no-OOD setting it claims to address.","section":"Section 4.1, Definition 4, Theorem 1"},{"comment":"The only data-based extraction experiments use Knockoff Nets with a surrogate distribution described only as 'similar' to the training set. There is no experiment in which the attacker queries exactly from P, and the similarity is not quantified. The main tables report DFME attacks, whose queries are generator-induced and hence not a test of the Q = P regime. The empirical evaluation therefore does not validate the central no-OOD claim.","section":"Appendix C.2, Table 5; Section 5.2"},{"comment":"The Wasserstein bound in Theorem 2 is a generic Lipschitz-stability result: it bounds the gap between expectations over P and P_g but does not relate the MISLEADER objective to the extraction loss E_{x~P} L(f_t(x), f_s(x)). The subsequent claim that ensembling 'amplifies the distribution shift' and thereby increases W_1(P, P_g) is not proven, and Figure 2 measures architecture mismatch rather than this Wasserstein effect.","section":"Section 4.2, Theorem 2"}],"minor_comments":[{"comment":"The sentence 'We further further strengthen this result' contains a duplicated word and should read 'We further strengthen this result.'","section":"Section 4.1"},{"comment":"The text says 'real-world graph datasets' but the datasets used are image datasets; this should be corrected to 'image datasets.'","section":"Appendix A.1"},{"comment":"The header for the MNIST DFME experiments reads 'Attack Defense CIFAR-10 Clone Model Architecture' and should instead say 'MNIST Clone Model Architecture.'","section":"Table 4"},{"comment":"The statement that MISLEADER reduces clone accuracy by '42% to 47%' should clarify that these are percentage-point reductions relative to the undefended baseline, not relative percentage decreases.","section":"Section 5.2"},{"comment":"The first term of Eq. (5) is written as L(f_t(x), d(x)), but Eq. (6) defines L_defense as a combination of cross-entropy and KL divergence; the notation should be aligned to make clear that the fidelity term in Eq. (5) is the distillation loss from Eq. (6).","section":"Section 3.3, Eq. (6)"}],"recommendation":"reject","confidential_remarks":"The reader's strongest claim is correct: the paper's no-OOD claim is structurally unsupported because the method only deceives on the augmented distribution while remaining faithful on P. The empirical results may show that the defense is effective against generator-based and surrogate-based attackers, but the paper frames its contribution around a stronger claim than the method and evidence support. I recommend rejection; a resubmission that reframes the contribution as defense against distribution shift in attacker queries, and that adds experiments with Q = P, would be a different paper."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper has a genuine method and the experiments back it, but the headline claim doesn't survive contact with the actual objective. The defense is a combination of augmentation-driven bilevel training and an ensemble of heterogeneous distilled models. That specific combination is new relative to the cited baselines, and the empirical work is solid: clone accuracy drops substantially on MNIST, CIFAR-10, and CIFAR-100, utility is preserved or even slightly improved, and the code is available. I'd credit that as a real contribution to extraction defense.\n\nThe soft spot is load-bearing. The unified objective in Eq. (5) penalizes alignment between the defense and the clone only on the augmented distribution tilde P, while the first term forces the defense to be faithful on the true distribution P. If an attacker queries with data drawn from P, the defense model will output approximately the target's true predictions on those inputs, and a clone trained on those queries will succeed. The augmentation pipeline is a fixed set of transforms chosen by the defender; there is no mechanism that makes tilde P cover P or that transfers deception from tilde P to P. The paper's own theory section acknowledges a simplified Q=P setting, but the risk functions in Definition 4 are evaluated over P for both terms, which is not the same as the actual Algorithm 1 loss. So the theoretical results do not cover the claimed no-OOD setting. The DBME experiments use Knockoff Nets with a surrogate only described as 'similar' to the training set, not identical to P, which leaves the critical scenario untested. The baseline comparison is also uneven: MISLEADER has no perturbation budget while the baselines are constrained to l1 distance <= 1.0. That's fixable, but it needs disclosure.\n\nWhat holds up: the architecture-matching result (same architecture gives higher clone accuracy) is real and the ensemble design is a reasonable response. The defense does work against distributionally shifted queries. That is a weaker claim than advertised, but it's still useful for MLaaS providers facing attackers with only approximate or synthetic data.\n\nThis paper deserves a serious referee, not a desk reject. The core idea has merit and the experiments are reproducible, but the central claim needs either an explicit Q=P test or a reframing of the contribution. I'd send it to review and expect major revision.\n\nFor your reading group, it's a maybe — good for a discussion of how easily 'no OOD assumption' claims can overstate what augmentation actually buys you.","headline":"A real empirical defense, but the central 'no OOD assumption' claim is unsupported because the training objective only deceives on augmented inputs, not on the training distribution itself.","tokens_in":19073,"tokens_out":1863,"would_cite":false,"duration_ms":20837,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A black-box ML service can resist cloning even when attackers send ordinary in-distribution queries, claims MISLEADER, by ensembling distilled models that stay faithful on benign inputs yet mislead imitators.","keywords":["model extraction attacks","model extraction defense","knowledge distillation","ensemble learning","bilevel optimization","data augmentation","MLaaS security","intellectual property protection"],"falsifier":"Run an extraction attack whose query set is drawn directly from the defender's training distribution $P$, using clean, un-augmented, in-distribution samples with soft labels, and measure the clone's test accuracy. If clone accuracy rises to near the undefended target's level, the claim that MISLEADER defends without any OOD assumption fails in exactly the in-distribution regime it is meant to cover, since the objective in Eq. (5) only penalizes the clone on the augmented proxy $\\tilde{P}$, not on $P$ itself.","tokens_in":17878,"feed_emoji":"🛡️","tokens_out":13514,"duration_ms":100361,"temperature":0.7,"pith_summary":"This paper argues that a deployed machine-learning model can be protected from being cloned through its public API even when attackers query with ordinary, in-distribution data, the case where most existing defenses fail because they rely on spotting out-of-distribution (OOD) queries. The defense, MISLEADER, is built on a bilevel optimization that trains the deployed model to stay faithful to the defender's data while simultaneously minimizing the success of a simulated clone model trained on its outputs. To make that tractable without knowing the attacker's query distribution, the defender generates proxy queries by aggressively augmenting its own training data, and deploys an ensemble of heterogeneous distilled models so that no single architecture gives a would-be cloner an easy match. The paper backs the approach with generalization bounds from Rademacher complexity and a Wasserstein-distance analysis of distribution shift, and reports that clone accuracy falls substantially on MNIST, CIFAR-10, and CIFAR-100 while benign-user accuracy is preserved or even improved.","feed_headline":"Model theft defense works even on in-distribution queries","feed_subtitle":"An ensemble of distilled models keeps real users' answers accurate while clone accuracy drops by up to 47 points.","key_machinery":"The load-bearing object is the unified bilevel objective of Eq. (5), $\\min_{d\\in\\mathcal{D}}\\max_{f_s\\in\\mathcal{F}_s}\\,[\\mathbb{E}_{x\\sim P}L(f_t(x),d(x)) - \\lambda\\,\\mathbb{E}_{x\\sim \\tilde{P}}L(f_s(x),d(x))]$, where the augmented distribution $\\tilde{P} = A_{\\mathrm{aug}}(P)$, produced by random resized cropping, flipping, affine transforms, color jittering, and grayscale conversion, stands in for the attacker's unknown query distribution $Q$. The inner maximization trains a simulated clone against the defense model (the attacker-update loop of Algorithm 1), and the outer minimization keeps the defense model faithful to the target on clean data while poisoning the clone's learning signal on augmented data. On top of this sits the ensemble: several defense models of different architectures are distilled separately and their predictions averaged by soft voting at inference, which the paper argues amplifies output variance and breaks the architectural alignment clone models rely on. The supporting theory consists of a Rademacher-complexity uniform-convergence bound (Theorem 1) and a Wasserstein-1 bound on the data-free attacker's generalization gap (Theorem 2), the latter justifying the ensemble by showing that larger distributional shift $W_1(P, P_g)$ directly enlarges the extraction loss an attacker must suffer.","core_discovery":"MISLEADER's central claim is that model extraction can be defended against without any assumption that attacker queries are out-of-distribution, by solving one unified bilevel problem: choose a defense model $d$ that maximizes agreement with the target model $f_t$ on the benign distribution $P$, while an inner maximization trains the strongest possible clone $f_s$ against $d$ on an augmented proxy distribution $\\tilde{P} = A_{\\mathrm{aug}}(P)$. The objective, Eq. (5), is $\\min_{d\\in\\mathcal{D}}\\max_{f_s\\in\\mathcal{F}_s}\\,[\\mathbb{E}_{x\\sim P}L(f_t(x),d(x)) - \\lambda\\,\\mathbb{E}_{x\\sim \\tilde{P}}L(f_s(x),d(x))]$: the first term preserves fidelity for benign users, the second degrades extractability. The defense treats the attacker's unknown query distribution $Q$ as unobservable and replaces it with the augmented version of the defender's own data, using standard image transformations to expand the support of $P$ in directions likely to overlap with real attacker queries. A second layer of protection replaces the single defense model with an ensemble of heterogeneous distilled models whose outputs are combined by soft voting, so that architectural mismatch alone raises the cost of cloning. The paper also states two formal guarantees: a Rademacher-complexity bound showing the empirical minimax risk converges to its population counterpart at $O(1/\\sqrt{n})$, and a Wasserstein bound showing the data-free attacker's generalization gap is controlled by $W_1(P, P_g)$ times the Lipschitz constants of the models and loss.","pith_inferences":["The defense's protection is conditional on the augmentation operator covering the attacker's query support: nothing in Eq. (5) punishes the model for being accurate on the un-augmented training distribution itself, so a realistic strengthening would fold observed attack queries back into $\\tilde{P}$ over time, an adaptive loop the paper does not explore.","The same bilevel template, fidelity on $P$ plus deception on an augmented proxy, transfers to other theft-prone API surfaces such as graph-neural-network services or language-model APIs wherever a suitable augmentation operator exists for the input space.","Because the distilled ensemble reportedly matches or exceeds the target model's own accuracy, the training recipe could plausibly be adopted outside security as a general accuracy-boosting procedure, with extraction resistance as a side benefit rather than the headline.","An attacker who knows the defender's training distribution and queries exactly from it would receive correct predictions; testing this precise case would separate the paper's empirical strength against surrogate and synthetic queries from its claimed coverage of fully in-distribution attacks."],"forward_implications":["MLaaS providers could deploy a defended model without first deciding which queries are suspicious; every query receives the same treatment, so a failure to detect an attack no longer opens the door to extraction.","A would-be cloner using surrogate or synthetic data would face sharply lower clone accuracy, with the paper reporting drops of roughly 42 to 47 percentage points on CIFAR-10 under a soft-label data-free attack while the service stays usable.","Because the ensemble members are trained separately by architecture and combined by soft voting, the defense can be deployed in parallel and extended by adding new member architectures rather than retraining from scratch.","The Rademacher bound implies the defense's empirical training objective is a reliable proxy for its true performance once the sample size is large, so defensive training does not need a separate security-specific tuning stage.","The Wasserstein bound formalizes the design intuition that heterogeneity is itself the defense: pushing the generator's synthetic distribution further from $P$ directly enlarges the attacker's generalization gap and makes cloning harder."],"supporting_citations":[{"why":"Supplies the soft-label data-free extraction attack (DFME) that MISLEADER is primarily tested against, including the query budgets the experiments adopt.","marker":"[57]"},{"why":"Supplies the hard-label data-free extraction attack (DFMS-HL) used to evaluate the defense under label-only APIs with GAN-generated queries.","marker":"[52]"},{"why":"Supplies the Knockoff Nets data-based extraction attack used to test the defense when attackers query with a surrogate dataset.","marker":"[43]"},{"why":"Provides the RandP and prediction-poisoning baseline defenses and the normalized agreement-utility definition that the defense objective builds on.","marker":"[44]"},{"why":"Provides the MeCo distributionally robust defensive-training baseline and the ResNet implementation conventions the experiments follow.","marker":"[58]"},{"why":"Motivates the ensemble-of-diverse-models design by showing that architectural heterogeneity increases extraction difficulty.","marker":"[23]"},{"why":"Supplies the knowledge-distillation loss with temperature-softened KL divergence that forms the fidelity term of the defense objective.","marker":"[16]"},{"why":"Provides the GRAD gradient-redirection baseline whose output-perturbation mechanism MISLEADER's bilevel objective is compared against.","marker":"[38]"},{"why":"Supplies the Rademacher-complexity uniform-convergence theorem used to prove the generalization bound in Theorem 1.","marker":"[41]"}],"fun_headline_variants":["Ensemble of distilled models foils extraction without OOD","Bilevel defense: preserve fidelity, sabotage clones","MISLEADER: robust model protection, no OOD crutch","Clone model fails while real users get accurate answers","Extraction attack resistant via heterogeneous ensemble"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole defense rests on the assumption that augmenting the defender's own training data produces a query distribution $\\tilde{P}$ that covers what a real attacker will actually send; if an attacker queries with the un-augmented training distribution itself, the defense model will answer correctly and the clone can learn unimpeded.","fun_headline_variants_meta":{"raw":{"variants":["Ensemble of distilled models foils extraction without OOD","Bilevel defense: preserve fidelity, sabotage clones","MISLEADER: robust model protection, no OOD crutch","Clone model fails while real users get accurate answers","Extraction attack resistant via heterogeneous ensemble"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000282,"raw_usage":{"total_tokens":1769,"prompt_tokens":1146,"completion_tokens":623,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":762,"completion_tokens_details":{"reasoning_tokens":546}},"tokens_in":762,"tokens_out":623,"duration_ms":5828,"temperature":1.0,"reasoning_tokens":546,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T11:25:13.633629+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an extraction attack whose query set is drawn directly from the defender's training distribution $P$, using clean, un-augmented, in-distribution samples with soft labels, and measure the clone's test accuracy. If clone accuracy rises to near the undefended target's level, the claim that MISLEADER defends without any OOD assumption fails in exactly the in-distribution regime it is meant to cover, since the objective in Eq. (5) only penalizes the clone on the augmented proxy $\\tilde{P}$, not on $P$ itself.","supporting_citations":[{"cited_title":"Data-free model extraction","cited_arxiv_id":null,"evidence_quote":"Supplies the soft-label data-free extraction attack (DFME) that MISLEADER is primarily tested against, including the query budgets the experiments adopt."},{"cited_title":"Towards data-free model stealing in a hard label setting","cited_arxiv_id":null,"evidence_quote":"Supplies the hard-label data-free extraction attack (DFMS-HL) used to evaluate the defense under label-only APIs with GAN-generated queries."},{"cited_title":"Defending against data-free model extraction by distributionally robust defensive training.Advances in Neural Information Processing Systems, 36:624–637, 2023","cited_arxiv_id":null,"evidence_quote":"Provides the MeCo distributionally robust defensive-training baseline and the ResNet implementation conventions the experiments follow."},{"cited_title":"Protecting dnns from theft using an ensemble of diverse models","cited_arxiv_id":null,"evidence_quote":"Motivates the ensemble-of-diverse-models design by showing that architectural heterogeneity increases extraction difficulty."},{"cited_title":"The MIT Press, 2nd edition, 2018","cited_arxiv_id":null,"evidence_quote":"Supplies the Rademacher-complexity uniform-convergence theorem used to prove the generalization bound in Theorem 1."}],"review_version":1}