Pith. sign in

REVIEW 3 major objections 4 minor 47 references

Caliber: Cross-Architecture Extraction-Cost Control for Score-Returning APIs

T0 review · 3 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Caliber maps any utility target to the right noise within about 1% per model.

desk verdict A solid, honestly-scoped output-perturbation defense with a useful margin-normalized calibration law; the cross-architecture transfer claim is an empirical regularity with mean-masked tails, but the paper deserves a serious peer review. read the letter →

arxiv 2608.01023 v1 pith:RTMMVGKH submitted 2026-08-02 cs.LG cs.AI

Chi Wang , Hanwen Wang , Yu Xia , Zihan Wang , Guangdong Bai This is my paper · ORCID
classification cs.LGcs.AI
keywords modelextractiondefenseoutputperturbationknowledgedistillationlogitnoisecalibrationmarginnormalizationlogisticcurveminimaxquerycost
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Caliber is a defense for score-returning APIs that adds i.i.d. Gaussian noise to a model's logits before the softmax, letting a provider cap how much a distillation-based attacker can learn from the returned scores. The paper's central claim is that this intervention becomes precisely controllable: once the noise variance is divided by the squared median top-two logit margin of the served model, the drop in normalized utility follows one logistic curve across CNNs, vision transformers, LLMs, and VLMs, and the curve can be inverted in closed form to hit any target utility. Per-model calibration lands on target with mean absolute relative errors of 0.6 to 1.4 percent, and a shared per-task curve transfers to unseen architectures with single-digit held-out error. The paper also proves strict monotone agreement degradation and a minimax lower bound on the repeated queries needed to average out the noise on a single input. The authors are explicit that the transferable law is an empirical regularity, not a theorem, and that accuracy control holds only up to a computable corridor plus their empirical fit.

What carries the argument

The central object is the margin-normalized logistic law: $\tilde{A}(v) = c + (1-c)/(1+(v/v_{50})^p)$, where $v = \sigma^2/S^2$, $S$ is the median top-two logit margin, $v_{50}$ is the half-degradation scale, $p$ is the steepness, and $c$ is a residual floor. It is fit by bounded least squares on a single noise-free sweep and inverted in closed form, $v^* = v_{50}((1-\tilde{A}^*)/(\tilde{A}^* - c))^{1/p}$, then scaled back to $\sigma^2 = v^* S^2$. This machinery converts an abstract utility target into an actual noise level without retraining or per-point search, and its strict monotonicity makes the inversion unique and well-defined for every target above the residual floor.

What would settle it

Numerically integrate the label-preservation probability $\pi(\sigma)$ of Equation (5) for a fixed input with a unique clean maximizer across increasing $\sigma$: any rise in the curve would falsify Proposition 1. Separately, hold out an architecture whose top-two margins are heavy-tailed or class-imbalanced, calibrate it from the shared per-task curve, and measure accuracy at the 75 percent retention target: a mean absolute relative error far above the reported single-digit range would falsify the transferable law.

Watch

Extended reading notes

Core claim

The discovery is a normalization that makes logit-noise attacks tunable. Within one architecture, adding Gaussian noise of variance $\sigma^2$ to logits strictly decreases the probability that the perturbed prediction agrees with the clean prediction, from 1 down to chance level $1/K$, and the exact agreement probability is a closed integral over the top-class noise (Proposition 1). The operative scale is not $\sigma$ itself but the normalized intensity $v = \sigma^2/S^2$, where $S$ is the median top-two logit margin on a validation set. Plotted against $v$, the normalized utility (accuracy minus the chance level, rescaled by the clean baseline) collapses onto a monotone logistic curve with a flat head, a sharp transition, and a small residual floor, across more than thirty model-dataset combinations. Fitting that curve once, per model or shared per task, and inverting it in closed form gives the $\sigma$ that reaches any target utility; the paper reports about 1 percent per-model error and single-digit shared-curve error. For a single input, averaging $M$ repeated fresh-noise queries can at best reduce the effective noise intensity from $v$ to $v/M$, and any estimator is bounded below by this minimax risk, so recovering clean logits costs at least $v/v_{\mathrm{use}}$ queries (Proposition 2).

Load-bearing premise

The load-bearing premise is empirical: after dividing noise variance by the squared median top-two logit margin, every architecture is assumed to follow the same logistic utility curve, so if a new architecture's falloff diverges from that curve, the shared-curve calibration fails and only per-model fitting remains.

Editorial extensions

If this is right

  • A provider can set any accuracy retention target on a served model from a single noise-free validation pass, with no per-model tuning when using the shared per-task curve.
  • Distilled surrogates inherit the calibrated degradation: at the 75 percent retention setting the vision surrogates fell 8.6 to 10.8 points below their undefended ceiling, and two LLM students lost their entire distillation gain.
  • An attacker who averages repeated fresh-noise queries on one input cannot push the effective noise below $v/M$, so recovering usable logits costs at least $v/v_{\mathrm{use}}$ queries per input, and deterministic per-input seeding removes the free repeats entirely.
  • Composing the perturbation with a query-volume monitor that caps $M$ makes the defense a cost-amplification mechanism rather than a denial mechanism, so flagged accounts can be throttled instead of banned.
  • The same internal noise injection works for hard-label APIs by flipping a controlled fraction of labels, and majority voting recovers them only at a similar multiplicative query cost.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, a provider could tighten the shared per-task curve by using a higher-order margin statistic or the full gap distribution, since the paper's own ablation shows the mean beat the median on most models and residual error tracks order statistics beyond the top-two gap.
  • Beyond the paper, the minimax bound covers only per-input recovery; the true extraction cost across many inputs remains unproven, so the measured roughly 16x query multiplier should be read as an empirical floor until a surrogate-level lower bound exists.
  • Beyond the paper, if the logistic law survives in free-form generation, a token-level noise schedule could throttle LLM APIs as well, but sequence-level utility would need its own calibration because errors compound across tokens.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes Caliber, an output-perturbation defense for score-returning APIs that adds i.i.d. Gaussian noise to the internal logits. It proves two theoretical properties: strict monotone degradation of agreement with the clean prediction (Proposition 1), with a computable accuracy corridor (Corollary 1), and a minimax lower bound on the number of repeated queries needed to recover a single input's clean logits (Proposition 2). Methodologically, Caliber normalizes the noise variance by the squared median top-two logit margin and fits a logistic curve to the normalized noise-utility relationship, either per model or shared per task, then inverts the curve in closed form to select the noise level that achieves a target utility. Experiments on 25 vision models, 8 LLMs, and 1 VLM report per-model calibration errors of 0.6–1.4%, shared-curve leave-one-architecture-out errors of 3.7–8.8%, and end-to-end distillation experiments showing that surrogate accuracy tracks the configured degradation.

Significance. If the central empirical claim holds — that after margin normalization the noise-utility relationship follows a single logistic law that transfers across architectures — Caliber would provide a practical, low-cost way to set output-perturbation strength without per-model tuning, with a clean theoretical backbone. The proofs of Proposition 1 and Corollary 1 are standard and correct; the accuracy corridor is a useful conceptual contribution; and Proposition 2 is a rigorous minimax statement for the per-input recovery problem. The paper is also unusually honest in its Section 5 limitations. The main risk is precisely the transferability assumption: the paper's own leave-one-architecture-out results show per-architecture errors of 11–13% for some families, so the cross-architecture single-law claim is not fully established at the per-architecture level.

major comments (3)
  1. [Section 3.3 / Appendix A (Eq. 9)] The headline cross-architecture claim is not supported at the per-architecture level. The abstract and conclusion state that the shared curve achieves 'single-digit held-out error', but Appendix A reports leave-one-architecture-out per-architecture errors of roughly 12% on CIFAR-100 for a held-out ResNet and 11–13% on MMLU for the Qwen models. These are the architectures a provider might actually serve, and at those error levels the closed-form inversion (Eq. 10) will miss the target utility by more than the paper's 'single-digit' wording suggests. Since the central contribution is the cross-architecture single-pass calibration, the paper should report the per-architecture distribution of held-out errors (not just task means), temper the abstract accordingly, or add a mechanism (e.g., per-architecture confidence bounds or a small per-architecture correction) that addresses the tail.
  2. [Section 4.2 / Table 1 / Table 4] The per-model calibration errors (0.6–1.4% mean absolute relative error) are in-sample interpolation figures: the logistic curve is fit to the same noise-utility sweep that is then inverted at target points within that sweep's range. They do not demonstrate extrapolation to target utilities outside the fitted range or to new architectures. Section 4.1 correctly notes that the finite-sample measurement floor is about one accuracy point, so sub-percent claims should be interpreted cautiously. The abstract's '0.6–1.4%' should be qualified as in-sample interpolation at the measurement floor, and the paper should separate interpolation error from extrapolation error if any targets outside the fitted range are tested.
  3. [Section 3.5 (used in Section 4.3)] The conversion from the per-input recovery bound to a utility-level cost relies on the assumption that equal mean-squared-error residuals 'act like fresh Gaussian noise of the same intensity' when read through the accuracy curve. Proposition 2 bounds squared error, not the resulting soft-label or accuracy degradation; the equivalence is exact only for the sample mean, whose residual remains Gaussian. The paper labels this a 'mean-squared-error proxy' in Section 3.5, but the abstract and Section 4.3 present the query multiplier (e.g., 'recovering an essentially clean surrogate costs ~16x') as a consequence of the framework. This is an empirical assumption, not a theorem. Either provide direct evidence that equal-MSE residuals produce comparable utility across estimators, or state in the abstract and conclusion that the utility-level cost multiplier is an empirical observation, not a proven bound.
minor comments (4)
  1. [Section 4.2, Table 1] The relative errors in Table 1 are signed (e.g., +2.8, -0.1). Consider presenting absolute errors or adding a column for the signed error so readers can see bias direction; the text gives the mean absolute error, but the table layout would be clearer with both.
  2. [Section 3.1, Eq. (4)] The product formula in Eq. (4) is an approximation, while the later proof of Proposition 1 uses Eq. (5). The text states this, but it would help to explicitly note that Eq. (4) is not used in the proofs and serves only intuition, to avoid a reader mistaking it for a derived result.
  3. [Section 2.2] The phrase 'parameter-free' is confusing because the calibration curve has parameters (v50, p, c) and the scale S. The intended meaning is 'leaves the served weights untouched'; consider using 'weight-free' or 'no retraining' to avoid ambiguity.
  4. [Figure 1] Figure 1 summarizes the four-step calibration procedure, but the steps are not referenced in the text at Figure 1. A sentence in Section 3.4 pointing the reader to the figure would improve readability.

Circularity Check

1 steps flagged · score 5.0 of 10

Per-model calibration errors are in-sample fit errors; the shared-curve transfer and the theoretical bounds are non-circular, so the circularity is partial.

  1. fitted input called prediction [Section 3.3 (Eq. 9), Section 4.2 / Table 1, abstract]
    "Caliber fits (v50,p,c) by bounded least-squares on the (v, Ã) points from a single noise-free sweep, in either of two modes. Per-model fitting uses the target model’s own sweep, the precise deployment mode."

    The (v, Ã) points from the target model's own sweep are used both to fit the three-parameter logistic curve and, after inversion, to report 0.6–1.4% error for targets at 90/80/70/60% of baseline. Those targets lie inside the fitted sweep, so the per-model error is the in-sample residual of the fitted curve, not an out-of-sample prediction; Eq. 10 is the algebraic inverse of the same curve, so hitting a target in the fitted range is a consistency check. The real out-of-sample evidence is the leave-one-architecture-out shared-curve error (Appendix A), which is larger (3.3–8.8% mean, up to ~12–13% per architecture), confirming the per-model numbers carry no extrapolation content.

full rationale

The central theoretical claims are self-contained: Proposition 1 is proved in Appendix B from the Gaussian comparison integral, Corollary 1 derives a computable accuracy corridor from that proposition, and Proposition 2 gives a minimax lower bound proved by a Gaussian prior argument. None of these reduce to a fitted parameter or to a self-citation. The only load-bearing use of prior work by the same authors (Wang et al. [45]) is the order-preservation product (Eq. 4) used for intuition; the exact monotonicity result is proved in this paper, so that self-citation is not circular. The logistic calibration law (Eq. 9) is explicitly an empirical regularity, and the paper marks where "the empirical evidence takes over", which is honest rather than circular. However, the flagship per-model accuracy numbers (0.6–1.4% mean absolute relative error, 3.4% worst) are obtained by fitting the logistic curve to a model's own noise sweep and then inverting it to targets within that same sweep; this is in-sample interpolation error, not a prediction. The shared per-task curve is validated by leave-one-architecture-out transfer and is the non-circular basis for the cross-architecture claim, and the paper reports its imperfect transfer (up to ~12–13% for some held-out architectures). Overall, the derivation chain is only partially circular: the per-model headline is a fitted input presented as calibration accuracy, while the theoretical bounds and the cross-architecture transfer evaluation stand independently.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central mechanism introduces no invented entities. It depends on four fitted or chosen quantities (S plus the logistic parameters v50, p, c), on one empirical law (Equation 9), and on the standard knowledge-distillation threat model. The mathematical propositions use standard Gaussian probability and minimax estimation, and their assumptions are explicit in the text.

free parameters (4)
  • v50 (half-degradation scale) = varies; fit per model or per task
    Fitted by bounded least-squares on the (v, A_tilde) points from the noise sweep; directly sets the noise level in the closed-form inversion, Equation (10).
  • p (logistic steepness) = varies; fit per model or per task
    Fitted alongside v50; controls how quickly accuracy drops through the transition region in Equation (9).
  • c (residual accuracy floor) = varies; fit per model or per task
    Residual floor in Equation (9); determines the saturated degradation level at high noise.
  • S (median top-two logit margin) = model-specific, computed from the validation set
    Data-derived normalization scale in Equation (7); the design choice between median, mean, and trimmed mean is ablated in Section 4.4. Not fit to a utility target, but it is a chosen statistic on which the calibration transfer relies.
assumptions (4)
  • domain assumption The evaluated inputs have a unique clean maximizer with positive gaps g_j; Proposition 1 requires this for strict monotone agreement degradation.
    Section 3.1 states the unique-maximizer condition; ties and zero gaps are excluded from the monotonicity theorem.
  • ad hoc to paper After margin normalization v = sigma^2/S^2, normalized utility follows the logistic law in Equation (9) across architectures.
    This is an empirical regularity, not derived from the margin statistic; it is the load-bearing premise for transferring calibration without per-model tuning.
  • domain assumption The attacker uses knowledge distillation with temperature T>1 on returned soft-label scores as in Equation (1), and the defender's target utility is a good proxy for what the surrogate learns.
    Section 2.1 threat model; end-to-end experiments test this assumption, but the per-input recovery bound does not bound full extraction.
  • ad hoc to paper Equal mean-squared-error residuals act like fresh Gaussian noise of the same intensity when reading v_use through the accuracy curve.
    Section 3.5 admits this is exact only for the sample mean and is otherwise a mean-squared-error proxy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Caliber: Cross-Architecture Extraction-Cost Control for Score-Returning APIs." pith.science (2026). https://pith.science/paper/RTMMVGKH

@misc{pith2026260801023,
  author       = {Pith},
  title        = {Pith review of: Caliber: Cross-Architecture Extraction-Cost Control for Score-Returning APIs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RTMMVGKH}},
  note         = {Machine review of arXiv:2608.01023}
}
abstract

We present Caliber, an output-perturbation defense against model extraction that formulates noise selection as a calibration problem: how much the defense degrades the supervision signal used to train a surrogate, and the provable per-input query cost of recovering the clean logits. To defend against an attacker that uses returned scores for knowledge distillation, Caliber adds independent and identically distributed Gaussian noise to the internal logits. We establish two properties of the resulting perturbed predictions. Monotone agreement degradation: When the clean logits have a unique maximizer, agreement with the clean prediction decreases strictly with the noise scale, so every target in $(1/K,1)$ corresponds to a unique positive scale; task accuracy is bounded by computable lower and upper envelopes. Per-input recovery cost: We derive a closed-form minimax lower bound on the repeated queries needed to recover the clean logits for a fixed input. Caliber normalizes noise variance by the squared median top-two logit margin and fits the resulting noise-utility relationship with a logistic curve, either per model or shared within a task. Across more than thirty model-dataset combinations, per-model calibration achieves mean absolute relative errors of 0.6-1.4%. End-to-end experiments show that surrogate performance generally tracks the configured degradation, while fixed-input averaging follows the expected variance reduction.

Figures

Figures reproduced from arXiv: 2608.01023 by the authors.

Figure 1
Figure 1. Overview of Caliber. Top: i.i.d. Gaussian noise of variance σ 2 is injected into the logits before the softmax. Bottom: after margin normalization, the noise-utility relationship is a single logistic curve, which Caliber inverts in closed form to map a target utility A ∗ to the required σ 2 , fit per model or shared per task. 2. We introduce a margin-normalized calibration law that sets any degradation target on a s… view at source ↗
Figure 2
Figure 2. Model extraction threat model domain but not f’s architecture or training. This interface matches deployed sys￾tems, where production LLM APIs expose top-k log-probabilities and specialized fine-tuned classifiers are served through the same score-returning endpoints. Attack mechanism. The attacker collects Dsteal = {(xi , zi)} N i=1 and trains ˆf by knowledge distillation (KD) [12], minimizing the KD loss LKD = X N … view at source ↗
Figure 3
Figure 3. Utility decay under injected logit noise inverted numerically per model, and doing so on the cached sweeps of Section 4 hits agreement targets of 0.9–0.6 with a mean absolute relative error of 0.08% (0.27% at worst) across those same twenty-five CIFAR and MMLU models, the resolution of the 64-draw Monte Carlo verification itself. This establishes the monotonic control requirement of Section 2.2 at the mechanism leve… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Margin-statistic ablation under amortized calibration using one shared logistic curve per task. Error bars denote 95% confidence intervals over 12 independent resam￾pling of the calibration probe. 50.3% even at M=16. The attacker must then source M distinct near-duplic…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 35 canonical work pages

  1. [45]

    In: WWW (2025).https://doi.org/10

    Wang, Z., Ma, Z., Feng, X., Mei, Z., Ma, Z., Wang, D., Xue, M., Bai, G.: AI model modulation with logits redistribution. In: WWW (2025).https://doi.org/10. 1145/3696410.3714737

    arXiv 2025

  2. [1]

    In: USENIX Se- curity (2018)

    Adi, Y., Baum, C., Cisse, M., Pinkas, B., Keshet, J.: Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In: USENIX Se- curity (2018)

    work page 2018

  3. [2]

    com/news/detecting-and-preventing-distillation-attacks(2026), news post, February 2026

    Anthropic:Detectingandpreventingdistillationattacks.https://www.anthropic. com/news/detecting-and-preventing-distillation-attacks(2026), news post, February 2026

    work page 2026

  4. [3]

    In: ICML (2024)

    Carlini, N., Paleka, D., Dvijotham, K.D., Steinke, T., Hayase, J., Cooper, A.F., Lee, K., Jagielski, M., Nasr, M., Conmy, A., et al.: Stealing part of a production language model. In: ICML (2024)

    work page 2024

  5. [4]

    arXiv preprint arXiv:2501.12948 (2025)

    DeepSeek-AI, Guo, D., et al.: DeepSeek-R1: Incentivizing reasoning capability in LLMs via reinforcement learning. arXiv preprint arXiv:2501.12948 (2025)

    arXiv 2025

  6. [5]

    In: CVPR (2009)

    Deng, J., Dong, W., Socher, R., Li, L.J., Li, K., Fei-Fei, L.: ImageNet: A large-scale hierarchical image database. In: CVPR (2009)

    2009

  7. [6]

    In: NeurIPS (2023)

    Dubiński,J.,Pawlak,S.,Boenisch,F.,Trzciński,T.,Dziedzic,A.:Bucksforbuckets (B4B): Active defenses against stealing encoders. In: NeurIPS (2023)

    work page 2023

  8. [7]

    In: ICLR (2022) Caliber: Cross-Architecture Extraction-Cost Control 19

    Dziedzic, A., Kaleem, M.A., Lu, Y.S., Papernot, N.: Increasing the cost of model extraction with calibrated proof of work. In: ICLR (2022) Caliber: Cross-Architecture Extraction-Cost Control 19

    work page 2022

Show all 47 references
  1. [8]

    arXiv preprint arXiv:2602.03396 (2026)

    Fang, H., Zhang, T., Zhuang, T., Kong, J., Gao, K., Chen, B., Zheng, L., Xia, S.T., Xu, K.: Towards distillation-resistant large language models: An information- theoretic perspective. arXiv preprint arXiv:2602.03396 (2026)

    2026 arXiv

  2. [9]

    arXiv preprint arXiv:2407.21783 (2024)

    Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Let- man,A., Mathur, A.,Schelten,A., Vaughan, A.,etal.: TheLlama 3herd of models. arXiv preprint arXiv:2407.21783 (2024)

    2024 arXiv

  3. [10]

    In: ICML (2017)

    Guo, C., Pleiss, G., Sun, Y., Weinberger, K.Q.: On calibration of modern neural networks. In: ICML (2017)

    2017

  4. [11]

    In: CVPR (2016)

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: CVPR (2016)

    2016

  5. [12]

    arXiv preprint arXiv:1503.02531 (2015)

    Hinton, G., Vinyals, O., Dean, J.: Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531 (2015)

    2015 arXiv

  6. [13]

    In: ICLR (2022)

    Hu, E.J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., Chen, W.: LoRA: Low-rank adaptation of large language models. In: ICLR (2022)

    2022

  7. [14]

    In: USENIX Security (2020)

    Jagielski, M., Carlini, N., Berthelot, D., Kurakin, A., Papernot, N.: High accuracy and high fidelity extraction of neural networks. In: USENIX Security (2020)

    2020

  8. [15]

    In: IEEE EuroS&P (2019)

    Juuti, M., Szyller, S., Marchal, S., Asokan, N.: PRADA: Protecting against DNN model stealing attacks. In: IEEE EuroS&P (2019)

    2019

  9. [16]

    In: ICLR (2021)

    Kariyappa, S., Prakash, A., Qureshi, M.K.: Protecting DNNs from theft using an ensemble of diverse models. In: ICLR (2021)

    2021

  10. [17]

    In: CVPR (2020)

    Kariyappa, S., Qureshi, M.K.: Defending against model stealing attacks with adap- tive misinformation. In: CVPR (2020)

    2020

  11. [18]

    In: ACSAC (2018)

    Kesarwani, M., Mukhoty, B., Arya, V., Mehta, S.: Model extraction warning in MLaaS paradigm. In: ACSAC (2018)

    2018

  12. [19]

    In: ICML (2023)

    Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., Goldstein, T.: A water- mark for large language models. In: ICML (2023)

    2023

  13. [20]

    In: ICLR (2020)

    Krishna,K.,Tomar,G.S.,Parikh,A.P.,Papernot,N.,Iyyer,M.:ThievesonSesame Street! Model extraction of BERT-based APIs. In: ICLR (2020)

    2020

  14. [21]

    Krizhevsky, A., Hinton, G.: Learning multiple layers of features from tiny images. Tech. rep., University of Toronto (2009)

    2009

  15. [22]

    In: NeurIPS (2017)

    Lakshminarayanan, B., Pritzel, A., Blundell, C.: Simple and scalable predictive uncertainty estimation using deep ensembles. In: NeurIPS (2017)

    2017

  16. [23]

    In: IEEE S&P Workshops (2019)

    Lee, T., Edwards, B., Molloy, I., Su, D.: Defending against neural network model stealing attacks using deceptive perturbations. In: IEEE S&P Workshops (2019)

    2019

  17. [24]

    arXiv preprint arXiv:2505.19504 (2025)

    Li, P., Tan, Z., Zhang, M., Qu, H., Liu, H., Chen, T.: DOGe: Defensive out- put generation for LLM protection against knowledge distillation. arXiv preprint arXiv:2505.19504 (2025)

    2025

  18. [25]

    In: USENIX Security (2024)

    Liu, S., Wang, Z., Xue, M., Wang, L., Zhang, Y., Bai, G.: Being transparent is merely the beginning: Enforcing purpose limitation with polynomial approxima- tion. In: USENIX Security (2024)

    2024

  19. [26]

    In: ICLR (2021)

    Ma, H., Chen, T., Hu, T.K., You, C., Xie, X., Wang, Z.: Undistillable: Making a nasty teacher that CANNOT teach students. In: ICLR (2021)

    2021

  20. [27]

    In: ASIA CCS

    Ma, M., Liu, S., Vo, V., Fang, M., Nepal, S., Bai, G.: ClieND: Client-side neuron- level detection against poisoning attacks on cross-silo federated learning. In: ASIA CCS. pp. 1108–1124 (2026).https://doi.org/10.1145/3779208.3785390

    2026

  21. [28]

    Ma, Z., Wang, Z., Bai, G.: Convex hull approximation for activation functions. Proc. ACM Program. Lang.9(OOPSLA2) (2025).https://doi.org/10.1145/ 3763086

    2025

  22. [29]

    In: ICLR (2021) 20 C

    Maini, P., Yaghini, M., Papernot, N.: Dataset inference: Ownership resolution in machine learning. In: ICLR (2021) 20 C. Wang et al

    2021

  23. [30]

    In: ICML (2022)

    Mazeika, M., Li, B., Forsyth, D.: How to steer your adversary: Targeted and effi- cient model stealing defenses with gradient redirection. In: ICML (2022)

    2022

  24. [31]

    In: ICML (2005)

    Niculescu-Mizil, A., Caruana, R.: Predicting good probabilities with supervised learning. In: ICML (2005)

    2005

  25. [32]

    In: CVPR (2019)

    Orekondy, T., Schiele, B., Fritz, M.: Knockoff Nets: Stealing functionality of black- box models. In: CVPR (2019)

    2019

  26. [33]

    In: ICLR (2020)

    Orekondy, T., Schiele, B., Fritz, M.: Prediction poisoning: Towards defenses against DNN model stealing attacks. In: ICLR (2020)

    2020

  27. [34]

    In: AAAI

    Pal, S., Gupta, Y., Shukla, A., Kanade, A., Shevade, S., Ganapathy, V.: Ac- tiveThief: Model extraction using active learning and unannotated public data. In: AAAI. vol. 34 (2020)

    2020

  28. [35]

    Pan, L., Liu, A., Huang, S., Lu, Y., Hu, X., Wen, L., King, I., Yu, P.S.: Can LLM watermarks robustly prevent unauthorized knowledge distillation? In: ACL (2025)

    2025

  29. [36]

    In: Advances in Large Margin Classifiers

    Platt, J., et al.: Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods. In: Advances in Large Margin Classifiers. MIT Press, Cambridge, MA (1999)

    1999

  30. [37]

    In: FSE Companion

    Ren, R., Yan, C., Dong, N., Bai, G.: Evolution but still exposed: An empirical study of residual APIs in the ChatGPT plugin ecosystem. In: FSE Companion. pp. 1593–1598 (2026).https://doi.org/10.1145/3803437.3805537

    2026

  31. [38]

    In: CVPR (2018)

    Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., Chen, L.C.: MobileNetV2: In- verted residuals and linear bottlenecks. In: CVPR (2018)

    2018

  32. [39]

    In: NeurIPS (2025)

    Savani, Y., Trockman, A., Feng, Z., Xu, Y.E., Schwarzschild, A., Robey, A., Finzi, M., Kolter, J.Z.: Antidistillation sampling. In: NeurIPS (2025)

    2025

  33. [40]

    In: ICLR (2015)

    Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. In: ICLR (2015)

    2015

  34. [41]

    In: USENIX Security (2016)

    Tramèr, F., Zhang, F., Juels, A., Reiter, M.K., Ristenpart, T.: Stealing machine learning models via prediction APIs. In: USENIX Security (2016)

    2016

  35. [42]

    In: CVPR (2021)

    Truong, J.B., Maini, P., Walls, R.J., Papernot, N.: Data-free model extraction. In: CVPR (2021)

    2021

  36. [43]

    arXiv preprint arXiv:2409.12191 (2024)

    Wang, P., Bai, S., Tan, S., Wang, S., Fan, Z., Bai, J., Chen, K., Liu, X., Wang, J., Ge, W., et al.: Qwen2-VL: Enhancing vision-language model’s perception of the world at any resolution. arXiv preprint arXiv:2409.12191 (2024)

    2024 arXiv

  37. [44]

    arXiv preprint arXiv:2510.10982 (2025)

    Wang, Z., Ma, Z., Ma, Z., Liu, S., Liu, A., Wang, D., Xue, M., Bai, G.: Catch-only- one: Non-transferable examples for model-specific authorization. arXiv preprint arXiv:2510.10982 (2025)

    2025 arXiv

  38. [46]

    arXiv preprint arXiv:2511.18772 (2026)

    Wang, Z., Ma, Z., Feng, X., Yan, C., Liu, D., Sun, R., Wang, D., Xue, M., Bai, G.: Re-key-free, risky-free: Adaptable model usage control. arXiv preprint arXiv:2511.18772 (2026)

    2026 arXiv

  39. [47]

    In: ACM AISec (2021)

    Zhang, Z., Chen, Y., Wagner, D.: SEAT: Similarity encoder by adversarial training for detecting model extraction attack queries. In: ACM AISec (2021)

    2021

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.