Pith. sign in

REVIEW 4 major objections 8 minor 54 references

Exploring Query Efficient Data Generation towards Data-free Model Stealing in Hard Label Setting

T0 review · 4 major / 8 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Data-free model stealing can be made far more query-efficient by generating synthetic samples on the decision boundary of the substitute model and reusing each query's label through light augmentations.

desk verdict Solid empirical stealing method with a new loss pair and metric, but the proof assumes repeated queries the algorithm never makes. read the letter →

arxiv 2412.15276 v1 pith:QRBNWHDD submitted 2024-12-18 cs.CR cs.AIcs.LG

Gaozheng Pei , Shaojie lyu , Ke Ma , Pinci Yang , Qianqian Xu , Yingfei Sun This is my paper · ORCID
classification cs.CRcs.AIcs.LG
keywords data-freemodelstealinghardlabelsettingqueryefficiencydecisionboundaryextractionquery-freeaugmentationconsistencyrateadversarialtransferability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that data-free model stealing—cloning a black-box classifier that only returns top-1 labels—can be made dramatically more query-efficient. It proposes QEDG, which generates synthetic samples on and spread around the substitute model's decision boundary, and recycles each query's label through light augmentations that preserve the label. The claim is that this yields a substitute model with higher accuracy, higher consistency with the target, and higher transfer attack success than existing methods, using a fraction of the queries—typically one quarter to one tenth of the strongest baselines' budgets. If true, deployed MLaaS models are cheaper to clone and attack, weakening the protection offered by hard-label APIs.

What carries the argument

The generator objective is $L_G = L_{clf} + \alpha\, \mathrm{Var}(S(x)) - \beta\, d(x_i,x_j)$, where $\mathrm{Var}(S(x))$ is the variance of the substitute's output scores across classes (the harmony loss) and $d$ is cosine dissimilarity (the diversity loss). Minimizing the variance pushes synthetic samples toward the substitute's decision boundary; maximizing pairwise distance spreads them uniformly along it. The query-free augmentation completes the machinery: non-disputed samples are given light flips or rotations, their target labels are kept, and the augmented pairs are used to train the substitute at zero additional query cost. The paper's theorem supplies a query-complexity bound for stealing with imperfect feedback, $Q = \frac{8}{(1-2\max_x \phi)^2} q(\epsilon,\delta) \ln\frac{q(\epsilon,\delta)}{\delta}$, which motivates the consistency-rate evaluation metric.

What would settle it

A direct test would count, during training, the fraction of generated samples for which the substitute and target disagree; if decision-boundary generation does not raise this disputed-sample rate well above the plain classification-loss baseline, the proposed losses are not the source of the query savings. A second test would replace the harmony and diversity losses with uniform sampling from the substitute's decision boundary and compare accuracy, consistency, and attack success at the same query budget.

Watch

Extended reading notes

Core claim

The central discovery is that the generator's objective is the bottleneck: minimizing the substitute's classification loss on synthetic samples produces overconfident samples on which the substitute and target already agree, so queries are wasted. QEDG replaces that objective with a combined loss: a harmony loss that minimizes the variance of the substitute's class scores to drive samples onto its decision boundary, and a diversity loss that maximizes inter-sample distance to cover the boundary uniformly. Queries to the target are then made on these boundary samples, so many land in the disputed area where the substitute and target differ; the resulting 'pessimistic' samples give strong learning signal. Query-free augmentation multiplies this signal: non-disputed samples are lightly transformed and their target labels reused, adding supervised information at zero query cost. The paper also gives a theorem bounding the query complexity of stealing with imperfect feedback, showing only a logarithmic overhead over clean active learning, and introduces consistency rate/Cohen's kappa as a more faithful evaluation metric.

Load-bearing premise

The proof of the query-complexity bound assumes the attacker queries each synthetic sample several times and takes a majority vote, while Algorithm 1 queries every generated sample exactly once, so the theoretical guarantee does not follow from the argument as written and the claimed efficiency rests on the empirical comparisons.

Editorial extensions

If this is right

  • With a few thousand to a few hundred thousand hard-label queries, an attacker can train a substitute that matches the target's accuracy on five datasets and exceeds the accuracy of baselines that use up to ten times more queries.
  • Adversarial examples transferred from the substitute achieve higher or comparable attack success rates at much lower query budgets, so the stolen model is a better weapon.
  • Substitute fidelity measured by consistency rate and Cohen's kappa tracks the query-efficiency gains better than accuracy alone, which should change how model-stealing defenses are evaluated.
  • Because the method needs so few queries, existing query-based defenses and anomaly detectors that raise alarms after many queries give less protection than assumed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The theorem's repeated-query assumption does not match the single-query algorithm, so an interesting next question is whether a single-query variant can be analyzed under a different feedback model; the empirical results suggest it can still work, but the guarantee is not yet proven.
  • The decision-boundary sampling idea transfers naturally to other label-only problems—such as query-efficient adversarial example search or model inversion—where hitting the disputed region is exactly what reveals useful information.
  • The query-free augmentation relies on the stability of hard labels under light transforms for non-disputed samples; on high-resolution or fine-grained classification tasks this stability may weaken, which would shrink the method's advantage over stronger augmentation pipelines.
  • Because the generator only ever sees the substitute model's boundary, the method's efficiency may depend on the substitute architecture being rich enough to represent the target's decision surface; a wider capacity gap could lower the disputed-sample hit rate.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 8 minor

Summary. The paper proposes QEDG, a data-free model stealing method for hard-label black-box classifiers. The method trains a generator with a classification loss, a harmony loss based on the variance of the substitute model's prediction vector, and a diversity loss, then queries the target model once per generated sample and stores the pair in a memory bank. For samples on which the substitute already agrees with the target, QEDG applies augmentations and reuses the target label without additional queries. The paper also introduces a consistency-rate metric and presents a theoretical query-complexity theorem based on active learning with imperfect feedback. Experiments compare QEDG with HEE, DaST, DFME, IDEAL, and DFTA on MNIST, FMNIST, SVHN, CIFAR-10, CIFAR-100, and a Microsoft Azure MLaaS scenario, reporting accuracy, consistency, and transfer attack success rates.

Significance. If the empirical results are reproducible, QEDG would be a useful contribution to query-efficient hard-label model stealing: it reports reducing the query budget by a factor of 4-10 relative to IDEAL/DFTA while matching or exceeding accuracy, consistency, and attack transfer rates, and it includes a real MLaaS evaluation. The evaluation uses external test sets and standard metrics, so the reported gains are not an artifact of a fitted-value-as-prediction loop. The main weakness is that the theoretical guarantee does not match the algorithm as written, and the empirical claims lack variance reporting and a controlled baseline comparison. Because the theorem is presented as the formal justification for query efficiency, the gap between the proof and Algorithm 1 is load-bearing and needs to be resolved before the paper's central claims can be accepted.

major comments (4)
  1. [Theoretical Analysis, Eqs. (25)-(33) vs. Algorithm 1] The query-complexity theorem is not established for the algorithm as written. Eq. (25) sets the collected labeled set size to R times q(epsilon, delta); Eqs. (26)-(29) define tau_g as the sum of R independent noisy observations of the same x_g; and Eq. (31) chooses R via a Chernoff majority-vote argument. Algorithm 1, however, queries each generated x_g exactly once, stores (x_g, yhat_g) in the memory bank, and never re-queries that x_g. The query-free augmentation creates new samples x'_g and assigns them the original label yhat_g without asking the target, so these are not independent repeated observations of f*(x_g). Consequently, the R appearing in Eq. (31) has no counterpart in the algorithm, and the probability bound in Eq. (30) cannot be instantiated for QEDG as described. This is load-bearing because the theorem is offered as the theoretical justification for the query efficiency and for the consistency-rate metric; either the proof must be adapted to a single-query protocol, or the algorithm must be changed to re-query samples R times with the query budget increased accordingly.
  2. [Experiments, Tables 1-3] The central empirical claim 'better performance with fewer queries' is not yet statistically supported. Tables 1-3 report single-run results without standard deviations or the number of seeds, and several differences are small, for example MNIST FGSM untargeted: Ours 41.37 vs. HEE 40.09, and CIFAR-10 PGD untargeted: Ours 78.64 vs. DFTA 78.16. In addition, the baseline numbers appear to be taken from earlier papers at different query budgets and possibly different training protocols; for example, Table 2 compares Ours at 30K queries with DFTA/IDEAL at 50K and HEE at 1000K on SVHN, and similar asymmetries appear on the other datasets. The authors should report mean and standard deviation over multiple seeds and rerun or clearly mark baselines under an identical target/substitute architecture and training protocol before claiming a consistent advantage.
  3. [Algorithm 1, Eq. (14)] The formal loss in Eq. (14) does not match Algorithm 1. Eq. (14) assigns weight gamma to any sample for which S(x_g, theta_S^(t-1)) != yhat_g, but Algorithm 1 applies the weighted update only in the else branch for the original stored sample; for a non-disputed sample, the algorithm augments x_g and trains on (x'_g, yhat_g) with an unweighted loss L(x'_g, yhat_g). It is not specified whether the condition in Eq. (14) is evaluated on x_g or on x'_g, and the augmentation branch is not reflected in the equation. Please state the exact loss for each branch or modify Eq. (14) so that it corresponds to the pseudocode.
  4. [Theoretical Analysis, Eqs. (21)-(23)] Even apart from the repeated-query issue, the theorem's formal setting does not match the hard-label model-stealing problem. In the threat model, the target's feedback yhat = T(x) is deterministic, so if f* is defined as the target's decision function then phi(f*, x) = 0 for every x and the noise condition max_x phi < 1/2 is vacuous; if f* is instead a ground-truth function, then the adversary wants to match T, not f*, and feedback errors relative to f* are irrelevant. The theorem should be stated as a generic active-learning-with-noise bound, or the model should be reformulated so that the noise models a concrete defense mechanism while f* remains the target function. In its current form the theorem does not explain the query-efficiency mechanism of QEDG.
minor comments (8)
  1. [Paper structure] The 'Theoretical Analysis' section appears twice with essentially the same theorem text; the proof in Eqs. (24)-(33) appears after Related Work rather than as a clearly labeled appendix. Consolidate or label the sections to avoid duplication.
  2. [Algorithm 1] Algorithm 1 says 'while q <= Q' with q initialized to 0, so the loop runs Q+1 times; additionally, the pseudocode uses xg as a single sample while Eqs. (10)-(11) operate on a batch of N synthetic features. Clarify whether one query or one batch is spent per iteration and how q is incremented.
  3. [Eq. (20) and surrounding text] Eq. (20) defines Cohen's kappa correctly, but the adjacent text swaps the roles: po is the observed agreement and pe is the expected agreement, not 'accidental consistency'.
  4. [Implementation details] The implementation details state 'For both MNIST and FMNIST, the perturbation bound is respectively set to 0.3, 0.2, and 0.1'; since there are two datasets, specify which bound is used for each dataset.
  5. [Ablation study, Table 4] The ablation in Table 4 is performed on CIFAR-10 only; given that the loss-scale hyper-parameters alpha and beta are dataset-dependent and Table 2 shows different gains per dataset, please state whether the component contributions are qualitatively consistent on at least one additional dataset.
  6. [Introduction and Proposed Framework] The claim that the generated samples 'closely and uniformly align with the target model's decision boundary' is stronger than what L_harm and L_div implement: these losses use the substitute model's prediction variance, not the target model's boundary. Please rephrase the claim or provide evidence that substitute-boundary closeness translates to target-boundary closeness.
  7. [Threat model, Eq. (1)] Eq. (1) writes T and S as real-valued functions with one-dimensional output, whereas Eq. (2) and the experiments treat them as classifiers returning labels. Use consistent notation for K-class outputs.
  8. [Related Work] The related-work text says 'we used more queries on both datasets' when three datasets (SVHN, CIFAR-10, CIFAR-100) are introduced at that point; fix the wording.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: empirical evaluation is external and the query-complexity theorem is a conditional active-learning bound, not an input-output loop.

full rationale

The paper's central claims are not circularly derived. Accuracy, Cohen's kappa, consistency rate, and attack success rate are evaluated on held-out test sets and on Microsoft Azure's external API, not on quantities fitted by QEDG and then re-reported as predictions. The query-free augmentation relabels augmented copies with the original queried label; that is a modeling heuristic, not a fitted parameter renamed as a prediction. The theoretical section states a conditional active-learning result: given any clean-label active learner A with query complexity q(epsilon,delta), a noisy learner can achieve the same error with Q = O(q log q) queries (Eqs. 21-23, 25-33). This is a standard repetition/majority-vote reduction, and the conclusion is not identical to the premise, so it is not circular. The proof does contain a rigor gap: Eq. (25) defines the labeled-set size as R times q and Eq. (31) sets R via a Chernoff bound, where R is described as repeated interactions 'arising from data augmentation and imperfect feedback,' but Algorithm 1 queries each generated x_g exactly once and never re-queries it, and augmented samples are not queried against the target. This means the theorem as stated is not instantiated by Algorithm 1; however, that is an unsupported application of a known bound, not a reduction of the claimed result to its own input. Self-citations (Ma et al. 2021, 2022, 2024) occur only in the related-work survey and are not load-bearing. No specific circular step can be quoted, so the circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on three tuned hyperparameters and on the assumption that non-disputed samples survive augmentation without label changes. The theoretical section additionally assumes a repeated-query protocol that Algorithm 1 does not implement. No new physical or model entities are invented.

free parameters (3)
  • alpha = 5.0
    Weight for the harmony loss in Eq. (12), tuned in the sensitivity analysis on MNIST.
  • beta = 0.7
    Weight for the diversity loss in Eq. (12), tuned in the sensitivity analysis on MNIST.
  • gamma = 5.0
    Weight for disputed-sample loss in Eq. (14), tuned in the sensitivity analysis on MNIST.
assumptions (4)
  • domain assumption Non-disputed samples keep their target labels under horizontal flip, vertical flip, and rotation.
    Used by query-free augmentation; the paper cites Figure 3 but gives no quantitative consistency rates or dataset coverage, and in a hard-label setting the substitute never receives corrected labels for augmented samples.
  • domain assumption Synthetic samples near the substitute's decision boundary are likely to lie in the disputed region where substitute and target disagree when the substitute is imperfect.
    This motivates Lharm and Ldiv; it is stated as intuition around Figure 2 rather than proven.
  • ad hoc to paper An active learning oracle with bounded label noise max_x phi < 1/2 can be simulated by QEDG's generator and single-query protocol.
    The theorem's proof requires R repeated query interactions per feature (Eqs. 25-31), but Algorithm 1 queries once; the reduction to the active learner is not established.
  • standard math Standard probabilistic inequalities (Boole's and Chernoff) and the active-learning query complexity q(epsilon, delta) apply.
    Invoked in the proof of Eq. (23); standard, but the mismatch with Algorithm 1 remains unresolved.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Exploring Query Efficient Data Generation towards Data-free Model Stealing in Hard Label Setting." pith.science (2026). https://pith.science/paper/QRBNWHDD

@misc{pith2026241215276,
  author       = {Pith},
  title        = {Pith review of: Exploring Query Efficient Data Generation towards Data-free Model Stealing in Hard Label Setting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QRBNWHDD}},
  note         = {Machine review of arXiv:2412.15276}
}
read the original abstract

Data-free model stealing involves replicating the functionality of a target model into a substitute model without accessing the target model's structure, parameters, or training data. The adversary can only access the target model's predictions for generated samples. Once the substitute model closely approximates the behavior of the target model, attackers can exploit its white-box characteristics for subsequent malicious activities, such as adversarial attacks. Existing methods within cooperative game frameworks often produce samples with high confidence for the prediction of the substitute model, which makes it difficult for the substitute model to replicate the behavior of the target model. This paper presents a new data-free model stealing approach called Query Efficient Data Generation (\textbf{QEDG}). We introduce two distinct loss functions to ensure the generation of sufficient samples that closely and uniformly align with the target model's decision boundary across multiple classes. Building on the limitation of current methods, which typically yield only one piece of supervised information per query, we propose the query-free sample augmentation that enables the acquisition of additional supervised information without increasing the number of queries. Motivated by theoretical analysis, we adopt the consistency rate metric, which more accurately evaluates the similarity between the substitute and target models. We conducted extensive experiments to verify the effectiveness of our proposed method, which achieved better performance with fewer queries compared to the state-of-the-art methods on the real \textbf{MLaaS} scenario and five datasets.

Figures

Figures reproduced from arXiv: 2412.15276 by the authors.

Figure 1
Figure 1. Compared to previous methods (top), our proposed approach (bottom) guides the generator to produce samples that [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The confidence vectors of the points in the shaded area are displayed above. Our goal is to ensure that the generated [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The consistency rate of predicted labels by the tar [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The accuracy of our method and other methods [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Sensitivity analysis about hyperparameters [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 48 canonical work pages

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    M.; Gao, X.; and Zhang, X

    Alabdulmohsin, I. M.; Gao, X.; and Zhang, X. 2015. Efficient Active Learning of Halfspaces via Query Synthesis. In AAAI Conference on Artificial Intelligence, 2483--2489

    work page 2015

  4. [4]

    Andriushchenko, M.; Croce, F.; Flammarion, N.; and Hein, M. 2020. Square attack: a query-efficient black-box adversarial attack via random search. In European Conference on Computer Vision, 484--501

    work page 2020

  5. [5]

    T.; Leman, K.; and Mitra, T

    Binici, K.; Aggarwal, S.; Pham, N. T.; Leman, K.; and Mitra, T. 2022. Robust and resource-efficient data-free knowledge distillation by generative pseudo replay. In AAAI Conference on Artificial Intelligence, 6089--6096

    work page 2022

  6. [6]

    Borra, P. 2024. A Survey of Google Cloud Platform (GCP): Features, Services, and Applications. International Journal of Advanced Research in Science, Communication and Technology, 191--199

    work page 2024

  7. [7]

    Brendel, W.; Rauber, J.; and Bethge, M. 2018. Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models. In International Conference on Learning Representations

    work page 2018

  8. [8]

    Chandrasekaran, V.; Chaudhuri, K.; Giacomelli, I.; Jha, S.; and Yan, S. 2020. Exploring Connections between Active Learning and Model Extraction. In USENIX Security Symposium, 1309--1326

    work page 2020

Show all 54 references
  1. [9]

    H.; and Karbasi, A

    Chen, L.; Hassani, S. H.; and Karbasi, A. 2017. Near-Optimal Active Learning of Halfspaces via Query Synthesis in the Noisy Setting. In AAAI Conference on Artificial Intelligence, 1798--1804

    2017

  2. [10]

    Chen, P.-Y.; Zhang, H.; Sharma, Y.; Yi, J.; and Hsieh, C.-J. 2017. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. In ACM Workshop on Artificial Intelligence and Security, 15--26

    2017

  3. [11]

    Chen, S.; Huang, Z.; Tao, Q.; Wu, Y.; Xie, C.; and Huang, X. 2022. Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attacks. In Annual Conference on Neural Information Processing Systems, 14929--14943

    2022

  4. [12]

    H.; Nguyen, D.; Nguyen, D.; Harikumar, H.; Tran, T.; Rana, S.; and Venkatesh, S

    Do, K.; Le, T. H.; Nguyen, D.; Nguyen, D.; Harikumar, H.; Tran, T.; Rana, S.; and Venkatesh, S. 2022. Momentum adversarial distillation: Handling large distribution shifts in data-free knowledge distillation. In Annual Conference on Neural Information Processing Systems, 10055--10067

    2022

  5. [13]

    Gao, S.; Jia, X.; Ren, X.; Tsang, I.; and Guo, Q. 2025. Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory. In European Conference on Computer Vision, 442--460. Springer

    2025

  6. [14]

    Goodfellow, I.; Pouget-Abadie, J.; Mirza, M.; Xu, B.; Warde-Farley, D.; Ozair, S.; Courville, A.; and Bengio, Y. 2020. Generative adversarial networks. Communications of the ACM, 63(11): 139--144

    2020

  7. [15]

    J.; Shlens, J.; and Szegedy, C

    Goodfellow, I. J.; Shlens, J.; and Szegedy, C. 2014. Explaining and harnessing adversarial examples. arXiv

    2014

  8. [16]

    Gu, J.; Jia, X.; de Jorge, P.; Yu, W.; Liu, X.; Ma, A.; Xun, Y.; Hu, A.; Khakzar, A.; Li, Z.; et al. 2023. A survey on transferability of adversarial examples across deep neural networks. arXiv preprint arXiv:2310.17626

    2023 arXiv

  9. [17]

    G.; and Weinberger, K

    Guo, C.; Gardner, J.; You, Y.; Wilson, A. G.; and Weinberger, K. 2019. Simple black-box adversarial attacks. In International Conference on Machine Learning, 2484--2493

    2019

  10. [18]

    He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep residual learning for image recognition. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 770--778

    2016

  11. [19]

    S.; and Fan, D

    He, Z.; Rakin, A. S.; and Fan, D. 2019. Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness Against Adversarial Attack. In IEEE/CVF Conference on Computer Vision and Pattern Recognition

    2019

  12. [20]

    Jia, X.; Gu, J.; Huang, Y.; Qin, S.; Guo, Q.; Liu, Y.; and Cao, X. 2023. TranSegPGD: Improving Transferability of Adversarial Examples on Semantic Segmentation. arXiv preprint arXiv:2312.02207

    2023 arXiv

  13. [21]

    Jia, X.; Zhang, Y.; Wu, B.; Ma, K.; Wang, J.; and Cao, X. 2022. LAS-AT: adversarial training with learnable attack strategy. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 13398--13408

    2022

  14. [22]

    Juuti, M.; Szyller, S.; Marchal, S.; and Asokan, N. 2019. PRADA: protecting against DNN model stealing attacks. In European Symposium on Security and Privacy, 512--527

    2019

  15. [23]

    S.; Park, S

    Kang, M. S.; Park, S. Y.; Chung, M.-A.; and Han, D.-h. 2024. Microsoft Azure. In NO-CODE AI: Concepts and Applications in Machine Learning, Visualization, and Cloud Platforms, 255--262. World Scientific

    2024

  16. [24]

    Kariyappa, S.; Prakash, A.; and Qureshi, M. K. 2021. Maze: Data-free model stealing attack using zeroth-order gradient estimation. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 13814--13823

    2021

  17. [25]

    Karras, T.; Laine, S.; and Aila, T. 2019. A style-based generator architecture for generative adversarial networks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 4401--4410

    2019

  18. [26]

    P.; and Ba, J

    Kingma, D. P.; and Ba, J. 2015. Adam: A Method for Stochastic Optimization. In International Conference on Learning Representations

    2015

  19. [27]

    J.; and Bengio, S

    Kurakin, A.; Goodfellow, I. J.; and Bengio, S. 2017. Adversarial Machine Learning at Scale. In International Conference on Learning Representations

    2017

  20. [28]

    Liang, S.; Li, L.; Fan, Y.; Jia, X.; Li, J.; Wu, B.; and Cao, X. 2022 a . A large-scale multiple-objective method for black-box attack against object detection. In European Conference on Computer Vision, 619--636. Springer

    2022

  21. [29]

    Liang, S.; Liu, A.; Liang, J.; Li, L.; Bai, Y.; and Cao, X. 2022 b . Imitated detectors: Stealing knowledge of black-box object detectors. In 30th ACM International Conference on Multimedia, 4839--4847

    2022

  22. [30]

    Liang, S.; Wu, B.; Fan, Y.; Wei, X.; and Cao, X. 2021. Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detection. In 2021 IEEE/CVF International Conference on Computer Vision, 7677--7687. IEEE Computer Society

    2021

  23. [31]

    Liang, S.; Zhu, M.; Liu, A.; Wu, B.; Cao, X.; and Chang, E.-C. 2024. Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 24645--24654

    2024

  24. [32]

    Liu, X.; Jia, X.; Gu, J.; Xun, Y.; Liang, S.; and Cao, X. 2024. Does few-shot learning suffer from backdoor attacks? In AAAI Conference on Artificial Intelligence, volume 38, 19893--19901

    2024

  25. [33]

    Ma, K.; Xu, Q.; Zeng, J.; Cao, X.; and Huang, Q. 2021. Poisoning attack against estimating from pairwise comparisons. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(10): 6393--6408

    2021

  26. [34]

    Ma, K.; Xu, Q.; Zeng, J.; Li, G.; Cao, X.; and Huang, Q. 2022. A tale of hodgerank and spectral method: Target attack against rank aggregation is the fixed point of adversarial game. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(4): 4090--4108

    2022

  27. [35]

    Ma, K.; Xu, Q.; Zeng, J.; Liu, W.; Cao, X.; Sun, Y.; and Huang, Q. 2024. Sequential manipulation against rank aggregation: theory and algorithm. IEEE Transactions on Pattern Analysis and Machine Intelligence

    2024

  28. [36]

    Madry, A.; Makelov, A.; Schmidt, L.; Tsipras, D.; and Vladu, A. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In International Conference on Learning Representations

    2018

  29. [37]

    McHugh, M. L. 2012. Interrater reliability: the kappa statistic. Biochemia Medica, 22(3): 276--282

    2012

  30. [38]

    Pal, S.; Gupta, Y.; Shukla, A.; Kanade, A.; Shevade, S.; and Ganapathy, V. 2020. Activethief: Model extraction using active learning and unannotated public data. In AAAI Conference on Artificial Intelligence, 865--872

    2020

  31. [39]

    Ribeiro, M.; Grolinger, K.; and Capretz, M. A. M. 2015. MLaaS: Machine Learning as a Service. In IEEE International Conference on Machine Learning and Applications , 896--902

    2015

  32. [40]

    Sanyal, S.; Addepalli, S.; and Babu, R. V. 2022. Towards data-free model stealing in a hard label setting. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 15284--15293

    2022

  33. [41]

    Simonyan, K.; and Zisserman, A. 2015. Very Deep Convolutional Networks for Large-Scale Image Recognition. In Bengio, Y.; and LeCun, Y., eds., International Conference on Learning Representations

    2015

  34. [42]

    Sun, X.; Cheng, G.; Li, H.; Pei, L.; and Han, J. 2022. Exploring effective data for surrogate training towards black-box attack. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 15355--15364

    2022

  35. [43]

    K.; and Ristenpart, T

    Tram \`e r, F.; Zhang, F.; Juels, A.; Reiter, M. K.; and Ristenpart, T. 2016. Stealing Machine Learning Models via Prediction APIs . In USENIX Security Symposium, 601--618

    2016

  36. [44]

    J.; and Papernot, N

    Truong, J.-B.; Maini, P.; Walls, R. J.; and Papernot, N. 2021. Data-free model extraction. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 4771--4780

    2021

  37. [45]

    Wang, W.; Yin, B.; Yao, T.; Zhang, L.; Fu, Y.; Ding, S.; Li, J.; Huang, F.; and Xue, X. 2021 a . Delving into data: Effectively substitute training for black-box attack. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 4761--4770

    2021

  38. [46]

    Wang, X.; and He, K. 2021. Enhancing the transferability of adversarial attacks through variance tuning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 1924--1933

    2021

  39. [47]

    Wang, X.; He, X.; Wang, J.; and He, K. 2021 b . Admix: Enhancing the transferability of adversarial attacks. In IEEE/CVF International Conference on Computer Vision, 16158--16167

    2021

  40. [48]

    Wittig, A.; and Wittig, M. 2023. Amazon Web Services in Action: An in-depth guide to AWS. Simon and Schuster

    2023

  41. [49]

    Xie, C.; Zhang, Z.; Zhou, Y.; Bai, S.; Wang, J.; Ren, Z.; and Yuille, A. L. 2019. Improving transferability of adversarial examples with input diversity. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2730--2739

    2019

  42. [50]

    Yuan, X.; Chen, K.; Huang, W.; Zhang, J.; Zhang, W.; and Yu, N. 2024. Data-free hard-label robustness stealing attack. In AAAI Conference on Artificial Intelligence, 6853--6861

    2024

  43. [51]

    Zhang, C.; Shen, J.; and Awasthi, P. 2020. Efficient active learning of sparse halfspaces with arbitrary bounded noise. In Annual Conference on Neural Information Processing Systems, 7184--7197

    2020

  44. [52]

    Zhang, J.; Chen, C.; and Lyu, L. 2022. Ideal: Query-efficient data-free learning from black-box models. In International Conference on Learning Representations

    2022

  45. [53]

    Zhang, J.; Li, B.; Xu, J.; Wu, S.; Ding, S.; Zhang, L.; and Wu, C. 2022. Towards efficient data free black-box adversarial attack. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 15115--15125

    2022

  46. [54]

    Zhou, M.; Wu, J.; Liu, Y.; Liu, S.; and Zhu, C. 2020. Dast: Data-free substitute training for adversarial attacks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 234--243

    2020

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.