Pith. sign in

REVIEW 4 major objections 5 minor 4 cited by

MISLEADER: Defending against Model Extraction with Ensembles of Distilled Models

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A black-box ML service can resist cloning even when attackers send ordinary in-distribution queries, claims MISLEADER, by ensembling distilled models that stay faithful on benign inputs yet mislead imitators.

desk verdict A real empirical defense, but the central 'no OOD assumption' claim is unsupported because the training objective only deceives on augmented inputs, not on the training distribution itself. read the letter →

arxiv 2506.02362 v1 pith:N5K7X2FI submitted 2025-06-03 cs.CR cs.AI

Xueqi Cheng , Minxing Zheng , Shixiang Zhu , Yushun Dong This is my paper
classification cs.CRcs.AI
keywords modelextractionattacksdefenseknowledgedistillationensemblelearningbileveloptimizationdataaugmentationMLaaSsecurityintellectualpropertyprotection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that a deployed machine-learning model can be protected from being cloned through its public API even when attackers query with ordinary, in-distribution data, the case where most existing defenses fail because they rely on spotting out-of-distribution (OOD) queries. The defense, MISLEADER, is built on a bilevel optimization that trains the deployed model to stay faithful to the defender's data while simultaneously minimizing the success of a simulated clone model trained on its outputs. To make that tractable without knowing the attacker's query distribution, the defender generates proxy queries by aggressively augmenting its own training data, and deploys an ensemble of heterogeneous distilled models so that no single architecture gives a would-be cloner an easy match. The paper backs the approach with generalization bounds from Rademacher complexity and a Wasserstein-distance analysis of distribution shift, and reports that clone accuracy falls substantially on MNIST, CIFAR-10, and CIFAR-100 while benign-user accuracy is preserved or even improved.

What carries the argument

The load-bearing object is the unified bilevel objective of Eq. (5), $\min_{d\in\mathcal{D}}\max_{f_s\in\mathcal{F}_s}\,[\mathbb{E}_{x\sim P}L(f_t(x),d(x)) - \lambda\,\mathbb{E}_{x\sim \tilde{P}}L(f_s(x),d(x))]$, where the augmented distribution $\tilde{P} = A_{\mathrm{aug}}(P)$, produced by random resized cropping, flipping, affine transforms, color jittering, and grayscale conversion, stands in for the attacker's unknown query distribution $Q$. The inner maximization trains a simulated clone against the defense model (the attacker-update loop of Algorithm 1), and the outer minimization keeps the defense model faithful to the target on clean data while poisoning the clone's learning signal on augmented data. On top of this sits the ensemble: several defense models of different architectures are distilled separately and their predictions averaged by soft voting at inference, which the paper argues amplifies output variance and breaks the architectural alignment clone models rely on. The supporting theory consists of a Rademacher-complexity uniform-convergence bound (Theorem 1) and a Wasserstein-1 bound on the data-free attacker's generalization gap (Theorem 2), the latter justifying the ensemble by showing that larger distributional shift $W_1(P, P_g)$ directly enlarges the extraction loss an attacker must suffer.

What would settle it

Run an extraction attack whose query set is drawn directly from the defender's training distribution $P$, using clean, un-augmented, in-distribution samples with soft labels, and measure the clone's test accuracy. If clone accuracy rises to near the undefended target's level, the claim that MISLEADER defends without any OOD assumption fails in exactly the in-distribution regime it is meant to cover, since the objective in Eq. (5) only penalizes the clone on the augmented proxy $\tilde{P}$, not on $P$ itself.

Watch

Extended reading notes

Core claim

MISLEADER's central claim is that model extraction can be defended against without any assumption that attacker queries are out-of-distribution, by solving one unified bilevel problem: choose a defense model $d$ that maximizes agreement with the target model $f_t$ on the benign distribution $P$, while an inner maximization trains the strongest possible clone $f_s$ against $d$ on an augmented proxy distribution $\tilde{P} = A_{\mathrm{aug}}(P)$. The objective, Eq. (5), is $\min_{d\in\mathcal{D}}\max_{f_s\in\mathcal{F}_s}\,[\mathbb{E}_{x\sim P}L(f_t(x),d(x)) - \lambda\,\mathbb{E}_{x\sim \tilde{P}}L(f_s(x),d(x))]$: the first term preserves fidelity for benign users, the second degrades extractability. The defense treats the attacker's unknown query distribution $Q$ as unobservable and replaces it with the augmented version of the defender's own data, using standard image transformations to expand the support of $P$ in directions likely to overlap with real attacker queries. A second layer of protection replaces the single defense model with an ensemble of heterogeneous distilled models whose outputs are combined by soft voting, so that architectural mismatch alone raises the cost of cloning. The paper also states two formal guarantees: a Rademacher-complexity bound showing the empirical minimax risk converges to its population counterpart at $O(1/\sqrt{n})$, and a Wasserstein bound showing the data-free attacker's generalization gap is controlled by $W_1(P, P_g)$ times the Lipschitz constants of the models and loss.

Load-bearing premise

The whole defense rests on the assumption that augmenting the defender's own training data produces a query distribution $\tilde{P}$ that covers what a real attacker will actually send; if an attacker queries with the un-augmented training distribution itself, the defense model will answer correctly and the clone can learn unimpeded.

Editorial extensions

If this is right

  • MLaaS providers could deploy a defended model without first deciding which queries are suspicious; every query receives the same treatment, so a failure to detect an attack no longer opens the door to extraction.
  • A would-be cloner using surrogate or synthetic data would face sharply lower clone accuracy, with the paper reporting drops of roughly 42 to 47 percentage points on CIFAR-10 under a soft-label data-free attack while the service stays usable.
  • Because the ensemble members are trained separately by architecture and combined by soft voting, the defense can be deployed in parallel and extended by adding new member architectures rather than retraining from scratch.
  • The Rademacher bound implies the defense's empirical training objective is a reliable proxy for its true performance once the sample size is large, so defensive training does not need a separate security-specific tuning stage.
  • The Wasserstein bound formalizes the design intuition that heterogeneity is itself the defense: pushing the generator's synthetic distribution further from $P$ directly enlarges the attacker's generalization gap and makes cloning harder.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The defense's protection is conditional on the augmentation operator covering the attacker's query support: nothing in Eq. (5) punishes the model for being accurate on the un-augmented training distribution itself, so a realistic strengthening would fold observed attack queries back into $\tilde{P}$ over time, an adaptive loop the paper does not explore.
  • The same bilevel template, fidelity on $P$ plus deception on an augmented proxy, transfers to other theft-prone API surfaces such as graph-neural-network services or language-model APIs wherever a suitable augmentation operator exists for the input space.
  • Because the distilled ensemble reportedly matches or exceeds the target model's own accuracy, the training recipe could plausibly be adopted outside security as a general accuracy-boosting procedure, with extraction resistance as a side benefit rather than the headline.
  • An attacker who knows the defender's training distribution and queries exactly from it would receive correct predictions; testing this precise case would separate the paper's empirical strength against surrogate and synthetic queries from its claimed coverage of fully in-distribution attacks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes MISLEADER, a defense against model extraction attacks that claims not to rely on OOD assumptions. The defense trains an ensemble of distilled models using the bilevel objective in Eq. (5), which enforces agreement with the target model on the defender's training distribution P and penalizes agreement between a simulated clone and the defense on an augmented distribution tilde P = A_aug(P). The paper derives Rademacher-complexity and Wasserstein generalization bounds in Section 4 and reports experiments on MNIST, CIFAR-10, and CIFAR-100 showing lower clone accuracy and preserved utility compared with several baselines. The central claim is that the defense works when attacker queries are in-distribution, but the method and evaluation do not actually instantiate or test this setting.

Significance. An effective no-OOD defense would be a valuable contribution because existing defenses largely rely on detecting OOD queries. The empirical study is thorough in some respects: code is released, runs are repeated five times with standard deviations, and utility is preserved or improved. However, the load-bearing premise that the augmented distribution tilde P approximates the attacker's query distribution Q is not established, and Theorem 1 analyzes a different objective from the one optimized in Algorithm 1. The paper's main claim therefore remains unsupported, so the significance is conditional on a conceptual gap that is central to the paper.

major comments (4)
  1. [Section 3.2, Eq. (5); Algorithm 1] The unified objective optimizes fidelity on P in the first term and deception only on the augmented distribution tilde P in the second term. For an attacker whose query distribution is exactly P, the defense model is trained to satisfy d(x) approx f_t(x) on every queried input, so a clone trained on (x, d(x)) with x ~ P recovers the target's behavior. This is precisely the regime the paper claims to handle ('does not rely on OOD assumptions'), but the objective gives the defender no mechanism to degrade extraction on P. The augmentation operator A_aug is a fixed set of defender-chosen transforms; no argument or experiment shows that optimizing on tilde P reduces extraction risk on P.
  2. [Section 4.1, Definition 4, Theorem 1] Theorem 1 is stated for a simplified setting with Q = P, and both terms in the population and empirical risks are expectations over P. Algorithm 1 and Eq. (5), however, train the attacker term on samples from tilde P. The bound therefore applies to a different ERM objective from the one actually optimized, as the proof in Appendix B.1 confirms. Thus the paper provides no theoretical guarantee for the no-OOD setting it claims to address.
  3. [Appendix C.2, Table 5; Section 5.2] The only data-based extraction experiments use Knockoff Nets with a surrogate distribution described only as 'similar' to the training set. There is no experiment in which the attacker queries exactly from P, and the similarity is not quantified. The main tables report DFME attacks, whose queries are generator-induced and hence not a test of the Q = P regime. The empirical evaluation therefore does not validate the central no-OOD claim.
  4. [Section 4.2, Theorem 2] The Wasserstein bound in Theorem 2 is a generic Lipschitz-stability result: it bounds the gap between expectations over P and P_g but does not relate the MISLEADER objective to the extraction loss E_{x~P} L(f_t(x), f_s(x)). The subsequent claim that ensembling 'amplifies the distribution shift' and thereby increases W_1(P, P_g) is not proven, and Figure 2 measures architecture mismatch rather than this Wasserstein effect.
minor comments (5)
  1. [Section 4.1] The sentence 'We further further strengthen this result' contains a duplicated word and should read 'We further strengthen this result.'
  2. [Appendix A.1] The text says 'real-world graph datasets' but the datasets used are image datasets; this should be corrected to 'image datasets.'
  3. [Table 4] The header for the MNIST DFME experiments reads 'Attack Defense CIFAR-10 Clone Model Architecture' and should instead say 'MNIST Clone Model Architecture.'
  4. [Section 5.2] The statement that MISLEADER reduces clone accuracy by '42% to 47%' should clarify that these are percentage-point reductions relative to the undefended baseline, not relative percentage decreases.
  5. [Section 3.3, Eq. (6)] The first term of Eq. (5) is written as L(f_t(x), d(x)), but Eq. (6) defines L_defense as a combination of cross-entropy and KL divergence; the notation should be aligned to make clear that the fidelity term in Eq. (5) is the distillation loss from Eq. (6).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: MISLEADER is an empirically constructed defense whose claims are not forced by its own definitions or by self-citation.

full rationale

The paper's core objective (Eq. 5) is a constructed surrogate: it replaces the unknown attacker distribution Q with an augmented in-distribution proxy tilde P and the clone-target loss L(fs, ft) with a clone-defender loss L(fs, d). This is an approximation and a potential distributional gap, but it is not a self-referential reduction: the defended model is not defined in terms of the evaluation metric, and the empirical evaluations use independent attack implementations (DFME, DFMS-HL, Knockoff Nets) rather than re-importing the fitted attacker from Algorithm 1. The theoretical bounds (Theorems 1 and 2) are standard Rademacher/Wasserstein inequalities; their assumptions do not include the target result. The only load-bearing citations are to external prior defenses and attacks; the two self-citations ([5,65]) are background references and do not carry the argument. The main weakness is that Theorem 1 analyzes a P-based objective while Algorithm 1 trains the deception term on tilde P, and the claim that ensembling enlarges W1(P,Pg) is asserted rather than proved; these are correctness/coverage concerns, not circularity. Under the rule that circularity must be exhibited as an equation-level reduction or a self-citation chain, none is present.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or model entities. The free parameters are standard hyperparameters tuned per experiment. The key axiom is the augmentation proxy assumption, which is the main source of fragility.

free parameters (3)
  • lambda (attacker regularization coefficient) = tuned within [10^-3, 10^-1]
    Controls the trade-off between utility and extraction resistance in Eq. (2) and Eq. (5). The paper tunes it on validation data.
  • alpha (distillation weight) = tuned within [0.1, 0.9]
    Balances cross-entropy and KL divergence in the distillation loss, Eq. (6). Tuned per experiment.
  • T (distillation temperature) = tuned within [1, 10]
    Softens teacher and student probability distributions in Eq. (6). Tuned as a hyperparameter.
assumptions (4)
  • domain assumption Bounded loss function L <= B (Assumption 1)
    Assumed in Section 4.1 to apply the Rademacher complexity bound. Holds for cross-entropy and KL with bounded model outputs, but is an extra condition on the problem.
  • ad hoc to paper The attacker's query distribution Q is well approximated by the augmented distribution tilde P = A_aug(P)
    This is the load-bearing assumption invoked in Section 3.2 when replacing Q with tilde P in the unified objective Eq. (5). The paper provides no evidence that this proxy holds for any realistic attacker, and it is exactly what fails for in-distribution extraction.
  • domain assumption The loss L is jointly rho-Lipschitz and target/clone models are L-Lipschitz (Theorem 2)
    Used in Section 4.2 to prove the Wasserstein bound. Neural network clones are not guaranteed to be L-Lipschitz, so this restricts the applicability of the theorem.
  • standard math Existence of an optimal transport map for the 1-Wasserstein distance (Theorem 2 proof)
    Invoked in Appendix B.2. Standard result for W1 on separable metric spaces.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MISLEADER: Defending against Model Extraction with Ensembles of Distilled Models." pith.science (2026). https://pith.science/paper/N5K7X2FI

@misc{pith2026250602362,
  author       = {Pith},
  title        = {Pith review of: MISLEADER: Defending against Model Extraction with Ensembles of Distilled Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/N5K7X2FI}},
  note         = {Machine review of arXiv:2506.02362}
}
read the original abstract

Model extraction attacks aim to replicate the functionality of a black-box model through query access, threatening the intellectual property (IP) of machine-learning-as-a-service (MLaaS) providers. Defending against such attacks is challenging, as it must balance efficiency, robustness, and utility preservation in the real-world scenario. Despite the recent advances, most existing defenses presume that attacker queries have out-of-distribution (OOD) samples, enabling them to detect and disrupt suspicious inputs. However, this assumption is increasingly unreliable, as modern models are trained on diverse datasets and attackers often operate under limited query budgets. As a result, the effectiveness of these defenses is significantly compromised in realistic deployment scenarios. To address this gap, we propose MISLEADER (enseMbles of dIStiLled modEls Against moDel ExtRaction), a novel defense strategy that does not rely on OOD assumptions. MISLEADER formulates model protection as a bilevel optimization problem that simultaneously preserves predictive fidelity on benign inputs and reduces extractability by potential clone models. Our framework combines data augmentation to simulate attacker queries with an ensemble of heterogeneous distilled models to improve robustness and diversity. We further provide a tractable approximation algorithm and derive theoretical error bounds to characterize defense effectiveness. Extensive experiments across various settings validate the utility-preserving and extraction-resistant properties of our proposed defense strategy. Our code is available at https://github.com/LabRAI/MISLEADER.

Figures

Figures reproduced from arXiv: 2506.02362 by the authors.

Figure 1
Figure 1. The overview of our proposed MISLEADER framework Using the labeled dataset {xi , yi} N i=1, the attacker trains a clone model fs(x; θs) ∈ Fs, drawn from a hypothesis class Fs, to approximate the behavior of ft. The model extraction is considered successful if fs closely mimics ft under the attacker’s input distribution Q. This is formally captured as follows: Definition 1 (Threat Model). Let ft be a target model and… view at source ↗
Figure 2
Figure 2. Clone accuracy across different model architectures on CIFAR-10 under DFME attacks. Overall, matching attacker-defender architectures leads to higher extraction success. To answer RQ3, we examine how different archi￾tectural choices in the defense model influence MISLEADER’s effectiveness against model ex￾traction. Specifically, we conduct ablation ex￾periments to isolate the impact of architectural diversity of bot… view at source ↗
Figure 3
Figure 3. The test accuracy of the clone model (ResNet18_8x) on CIFAR10 with varying query budget. MISLEADER significantly out￾performs other SOTA baselines. To assess the impact of query budget on extraction performance, we experiment with a range of query budgets representing different attacker capabilities. This setup allows us to evaluate the robustness of defense strategies under varying levels of query ac￾cess. As visua… view at source ↗

Discussion (0). Sign in to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. ADS-C: Antidistillation Sampling for Classification

    cs.LG 2026-07 accept novelty 7.0 of 10

    ADS-C perturbs served classification probabilities under a per-input margin budget, preserving every top-1 prediction while degrading distilled students by 13–30 percentage points.

  2. Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses

    cs.CR 2025-08 conditional novelty 4.0 of 10

    A systematic review that organizes graph-ML IP protection into model-level and data-level attacks and defenses, and ships a benchmark library, PyGIP.

  3. A Systematic Survey of Model Extraction Attacks and Defenses: State-of-the-Art and Perspectives

    cs.CR 2025-08 conditional novelty 4.0 of 10

    The paper classifies model extraction attacks and defenses into attack, defense, and computing environment categories and surveys their current state.

  4. A Survey on Model Extraction Attacks and Defenses for Large Language Models

    cs.CR 2025-06 conditional novelty 4.0 of 10

    A taxonomy of model extraction attacks and defenses for large language models, with proposed evaluation metrics and future research directions.

Reference graph

Works this paper leans on

65 extracted references · 44 canonical work pages · cited by 4 Pith papers

  1. [1]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In27th USENIX security symposium (USENIX Security 18), pages 1615–1631, 2018

    work page 2018

  2. [2]

    Backpropagation and stochastic gradient descent method.Neurocomputing, 5(4-5):185–196, 1993

    Shun-ichi Amari. Backpropagation and stochastic gradient descent method.Neurocomputing, 5(4-5):185–196, 1993

    work page 1993

  3. [3]

    Knowledge distillation: A good teacher is patient and consistent

    Lucas Beyer, Xiaohua Zhai, Amélie Royer, Larisa Markeeva, Rohan Anil, and Alexander Kolesnikov. Knowledge distillation: A good teacher is patient and consistent. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10925–10934, 2022

    2022

  4. [4]

    Data sharing and interoperability: Fostering in- novation and competition through apis.Computer Law & Security Review, 35(5):105314, 2019

    Oscar Borgogno and Giuseppe Colangelo. Data sharing and interoperability: Fostering in- novation and competition through apis.Computer Law & Security Review, 35(5):105314, 2019

    work page 2019

  5. [5]

    Atom: A framework of detecting query-based model extraction attacks for graph neural networks.arXiv preprint arXiv:2503.16693, 2025

    Zhan Cheng, Bolin Shen, Tianming Sha, Yuan Gao, Shibo Li, and Yushun Dong. Atom: A framework of detecting query-based model extraction attacks for graph neural networks.arXiv preprint arXiv:2503.16693, 2025

    arXiv 2025

  6. [6]

    The mnist database of handwritten digit images for machine learning research [best of the web].IEEE signal processing magazine, 29(6):141–142, 2012

    Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web].IEEE signal processing magazine, 29(6):141–142, 2012

    2012

  7. [7]

    Simon and Schuster, 2024

    Numa Dhamani.Introduction to generative AI. Simon and Schuster, 2024

    work page 2024

  8. [8]

    An optimized intelligent open-source mlaas framework for user-friendly clustering and anomaly detection.The Journal of Supercomputing, 80(18):26658–26684, 2024

    Kamal A ElDahshan, Gaber E Abutaleb, Berihan R Elemary, Ebeid A Ebeid, and AbdAllah A AlHabshy. An optimized intelligent open-source mlaas framework for user-friendly clustering and anomaly detection.The Journal of Supercomputing, 80(18):26658–26684, 2024

    work page 2024

Show all 65 references
  1. [9]

    Efficient knowledge distillation from an ensemble of teachers

    Takashi Fukuda, Masayuki Suzuki, Gakuto Kurata, Samuel Thomas, Jia Cui, and Bhuvana Ramabhadran. Efficient knowledge distillation from an ensemble of teachers. InInterspeech, pages 3697–3701, 2017

    2017

  2. [10]

    Model extraction attacks and defenses on cloud-based machine learning models.IEEE Communications Magazine, 58(12):83–89, 2021

    Xueluan Gong, Qian Wang, Yanjiao Chen, Wang Yang, and Xinchang Jiang. Model extraction attacks and defenses on cloud-based machine learning models.IEEE Communications Magazine, 58(12):83–89, 2021

    2021

  3. [11]

    Machine learning as a service (mlaas)—an enterprise perspective

    Ioannis Grigoriadis, Eleni Vrochidou, Iliana Tsiatsiou, and George A Papakostas. Machine learning as a service (mlaas)—an enterprise perspective. InProceedings of International Conference on Data Science and Applications: ICDSA 2022, Volume 2, pages 261–273. Springer, 2023

    2022

  4. [12]

    A realistic model extraction attack against graph neural networks.Knowledge-Based Systems, 300:112144, 2024

    Faqian Guan, Tianqing Zhu, Hanjin Tong, and Wanlei Zhou. A realistic model extraction attack against graph neural networks.Knowledge-Based Systems, 300:112144, 2024

    2024

  5. [13]

    The content moderator’s dilemma: Removal of toxic content and distortions to online discourse.arXiv preprint arXiv:2412.16114, 2024

    Mahyar Habibi, Dirk Hovy, and Carlo Schwarz. The content moderator’s dilemma: Removal of toxic content and distortions to online discourse.arXiv preprint arXiv:2412.16114, 2024

    2024

  6. [14]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  7. [15]

    Protecting intellectual property of language generation apis with lexical watermark

    Xuanli He, Qiongkai Xu, Lingjuan Lyu, Fangzhao Wu, and Chenguang Wang. Protecting intellectual property of language generation apis with lexical watermark. InProceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 10758–10766, 2022

    2022

  8. [16]

    Distilling the knowledge in a neural network

    Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531, 2015

    2015 arXiv

  9. [17]

    Learning to learn from apis: Black-box data-free meta-learning

    Zixuan Hu, Li Shen, Zhenyi Wang, Baoyuan Wu, Chun Yuan, and Dacheng Tao. Learning to learn from apis: Black-box data-free meta-learning. InInternational Conference on Machine Learning, pages 13610–13627. PMLR, 2023. 10

    2023

  10. [18]

    Densely connected convolutional networks

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017

    2017

  11. [19]

    High accuracy and high fidelity extraction of neural networks

    Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, and Nicolas Papernot. High accuracy and high fidelity extraction of neural networks. In29th USENIX security symposium (USENIX Security 20), pages 1345–1362, 2020

    2020

  12. [20]

    A comprehensive defense framework against model extraction attacks.IEEE Transactions on Dependable and Secure Computing, 21(2):685–700, 2023

    Wenbo Jiang, Hongwei Li, Guowen Xu, Tianwei Zhang, and Rongxing Lu. A comprehensive defense framework against model extraction attacks.IEEE Transactions on Dependable and Secure Computing, 21(2):685–700, 2023

    2023

  13. [21]

    Prada: protecting against dnn model stealing attacks

    Mika Juuti, Sebastian Szyller, Samuel Marchal, and N Asokan. Prada: protecting against dnn model stealing attacks. In2019 IEEE European Symposium on Security and Privacy (EuroS&P), pages 512–527. IEEE, 2019

    2019

  14. [22]

    Maze: Data-free model stealing attack using zeroth-order gradient estimation

    Sanjay Kariyappa, Atul Prakash, and Moinuddin K Qureshi. Maze: Data-free model stealing attack using zeroth-order gradient estimation. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13814–13823, 2021

    2021

  15. [23]

    Protecting dnns from theft using an ensemble of diverse models

    Sanjay Kariyappa, Atul Prakash, and Moinuddin K Qureshi. Protecting dnns from theft using an ensemble of diverse models. InInternational Conference on Learning Representations, 2021

    2021

  16. [24]

    Defending against model stealing attacks with adaptive misinformation

    Sanjay Kariyappa and Moinuddin K Qureshi. Defending against model stealing attacks with adaptive misinformation. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 770–778, 2020

    2020

  17. [25]

    Model extraction warning in mlaas paradigm

    Manish Kesarwani, Bhaskar Mukhoty, Vijay Arya, and Sameep Mehta. Model extraction warning in mlaas paradigm. InProceedings of the 34th annual computer security applications conference, pages 371–380, 2018

    2018

  18. [26]

    Nsml: Meet the mlaas platform with a real-world case study.arXiv preprint arXiv:1810.09957, 2018

    Hanjoo Kim, Minkyu Kim, Dongjoo Seo, Jinwoong Kim, Heungseok Park, Soeun Park, Hyun- woo Jo, KyungHyun Kim, Youngil Yang, Youngkwan Kim, et al. Nsml: Meet the mlaas platform with a real-world case study.arXiv preprint arXiv:1810.09957, 2018

    arXiv

  19. [27]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  20. [28]

    An ensemble approach for classification and prediction of diabetes mellitus using soft voting classifier.International Journal of Cognitive Computing in Engineering, 2:40–46, 2021

    Saloni Kumari, Deepika Kumar, and Mamta Mittal. An ensemble approach for classification and prediction of diabetes mellitus using soft voting classifier.International Journal of Cognitive Computing in Engineering, 2:40–46, 2021

    2021

  21. [29]

    Defending against model extraction attacks with physical unclonable function.Information Sciences, 628:196–207, 2023

    Dawei Li, Di Liu, Ying Guo, Yangkun Ren, Jieyu Su, and Jianwei Liu. Defending against model extraction attacks with physical unclonable function.Information Sciences, 628:196–207, 2023

    2023

  22. [30]

    PhD thesis, Nanyang Technological University, 2025

    Guanlin Li.Securing Machine Learning as a Service: Attack Identification and Defense Design. PhD thesis, Nanyang Technological University, 2025

    2025

  23. [31]

    Defending against model extraction attacks with ood feature learning and decision boundary confusion.Computers & Security, 136:103563, 2024

    Chuang Liang, Jie Huang, Zeping Zhang, and Shuaishuai Zhang. Defending against model extraction attacks with ood feature learning and decision boundary confusion.Computers & Security, 136:103563, 2024

    2024

  24. [32]

    Model extraction attacks revisited

    Jiacheng Liang, Ren Pang, Changjiang Li, and Ting Wang. Model extraction attacks revisited. InProceedings of the 19th ACM Asia Conference on Computer and Communications Security, pages 1231–1245, 2024

    2024

  25. [33]

    Quda: Query-limited data-free model extraction

    Zijun Lin, Ke Xu, Chengfang Fang, Huadi Zheng, Aneez Ahmed Jaheezuddin, and Jie Shi. Quda: Query-limited data-free model extraction. InProceedings of the 2023 ACM Asia Conference on Computer and Communications Security, pages 913–924, 2023

    2023

  26. [34]

    Model extraction attack and defense on deep generative models

    Shengyi Liu. Model extraction attack and defense on deep generative models. InJournal of Physics: Conference Series, volume 2189, page 012024. IOP Publishing, 2022

    2022

  27. [35]

    Sgdr: Stochastic gradient descent with warm restarts.arXiv preprint arXiv:1608.03983, 2016

    Ilya Loshchilov and Frank Hutter. Sgdr: Stochastic gradient descent with warm restarts.arXiv preprint arXiv:1608.03983, 2016. 11

    2016 arXiv

  28. [36]

    Dynamic neural fortresses: An adaptive shield for model extraction defense

    Siyu Luan, Zhenyi Wang, Li Shen, Zonghua Gu, Chao Wu, and Dacheng Tao. Dynamic neural fortresses: An adaptive shield for model extraction defense. InThe Thirteenth International Conference on Learning Representations

  29. [37]

    Dataset inference: Ownership resolution in machine learning.arXiv preprint arXiv:2104.10706, 2021

    Pratyush Maini, Mohammad Yaghini, and Nicolas Papernot. Dataset inference: Ownership resolution in machine learning.arXiv preprint arXiv:2104.10706, 2021

    2021 arXiv

  30. [38]

    How to steer your adversary: Targeted and efficient model stealing defenses with gradient redirection

    Mantas Mazeika, Bo Li, and David Forsyth. How to steer your adversary: Targeted and efficient model stealing defenses with gradient redirection. InInternational conference on machine learning, pages 15241–15254. PMLR, 2022

    2022

  31. [39]

    Mixed precision training.arXiv preprint arXiv:1710.03740, 2017

    Paulius Micikevicius, Sharan Narang, Jonah Alben, Gregory Diamos, Erich Elsen, David Garcia, Boris Ginsburg, Michael Houston, Oleksii Kuchaiev, Ganesh Venkatesh, et al. Mixed precision training.arXiv preprint arXiv:1710.03740, 2017

    arXiv

  32. [40]

    Megex: Data-free model extraction attack against gradient-based explainable ai

    Takayuki Miura, Toshiki Shibahara, and Naoto Yanai. Megex: Data-free model extraction attack against gradient-based explainable ai. InProceedings of the 2nd ACM Workshop on Secure and Trustworthy Deep Learning Systems, pages 56–66, 2024

    2024

  33. [41]

    The MIT Press, 2nd edition, 2018

    Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar.Foundations of Machine Learning. The MIT Press, 2nd edition, 2018

    2018

  34. [42]

    PhD thesis, Technische Universität Wien, 2023

    Daryna Oliynyk.Man of steal: Exploring model stealing attacks against image classifiers. PhD thesis, Technische Universität Wien, 2023

    2023

  35. [43]

    Knockoff nets: Stealing functionality of black-box models

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4954–4963, 2019

    2019

  36. [44]

    Prediction poisoning: Towards defenses against dnn model stealing attacks.arXiv preprint arXiv:1906.10908, 2019

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Prediction poisoning: Towards defenses against dnn model stealing attacks.arXiv preprint arXiv:1906.10908, 2019

    1906 arXiv

  37. [45]

    Mod- elshield: Adaptive and robust watermark against model extraction attack.IEEE Transactions on Information Forensics and Security, 2025

    Kaiyi Pang, Tao Qi, Chuhan Wu, Minhao Bai, Minghu Jiang, and Yongfeng Huang. Mod- elshield: Adaptive and robust watermark against model extraction attack.IEEE Transactions on Information Forensics and Security, 2025

    2025

  38. [46]

    Practical black-box attacks against machine learning

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Anan- thram Swami. Practical black-box attacks against machine learning. InProceedings of the 2017 ACM on Asia conference on computer and communications security, pages 506–519, 2017

    2017

  39. [47]

    Relational knowledge distillation

    Wonpyo Park, Dongju Kim, Yan Lu, and Minsu Cho. Relational knowledge distillation. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 3967–3976, 2019

    2019

  40. [48]

    Automatic differentiation in pytorch

    Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Alban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. 2017

    2017

  41. [49]

    Mlaas: Machine learning as a service

    Mauro Ribeiro, Katarina Grolinger, and Miriam AM Capretz. Mlaas: Machine learning as a service. In2015 IEEE 14th international conference on machine learning and applications (ICMLA), pages 896–902. IEEE, 2015

    2015

  42. [50]

    Privacy as intellectual property.Stan

    Pamela Samuelson. Privacy as intellectual property.Stan. L. Rev., 52:1125, 1999

    1999

  43. [51]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 4510–4520, 2018

    2018

  44. [52]

    Towards data-free model stealing in a hard label setting

    Sunandini Sanyal, Sravanti Addepalli, and R Venkatesh Babu. Towards data-free model stealing in a hard label setting. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 15284–15293, 2022

    2022

  45. [53]

    On efficient training of large-scale deep learning models.ACM Computing Surveys, 57(3):1–36, 2024

    Li Shen, Yan Sun, Zhiyuan Yu, Liang Ding, Xinmei Tian, and Dacheng Tao. On efficient training of large-scale deep learning models.ACM Computing Surveys, 57(3):1–36, 2024. 12

    2024

  46. [54]

    Does knowledge distillation really work?Advances in neural information processing systems, 34:6906–6919, 2021

    Samuel Stanton, Pavel Izmailov, Polina Kirichenko, Alexander A Alemi, and Andrew G Wilson. Does knowledge distillation really work?Advances in neural information processing systems, 34:6906–6919, 2021

    2021

  47. [55]

    Deep neural network watermarking against model extraction attack

    Jingxuan Tan, Nan Zhong, Zhenxing Qian, Xinpeng Zhang, and Sheng Li. Deep neural network watermarking against model extraction attack. InProceedings of the 31st ACM international conference on multimedia, pages 1588–1597, 2023

    2023

  48. [56]

    Stealing machine learning models via prediction {APIs}

    Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction {APIs}. In25th USENIX security symposium (USENIX Security 16), pages 601–618, 2016

    2016

  49. [57]

    Data-free model extraction

    Jean-Baptiste Truong, Pratyush Maini, Robert J Walls, and Nicolas Papernot. Data-free model extraction. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4771–4780, 2021

    2021

  50. [58]

    Defending against data-free model extraction by distributionally robust defensive training.Advances in Neural Information Processing Systems, 36:624–637, 2023

    Zhenyi Wang, Li Shen, Tongliang Liu, Tiehang Duan, Yanjun Zhu, Donglin Zhan, David Doermann, and Mingchen Gao. Defending against data-free model extraction by distributionally robust defensive training.Advances in Neural Information Processing Systems, 36:624–637, 2023

    2023

  51. [59]

    Defense against model extraction attack by bayesian active watermarking

    Zhenyi Wang, Yihan Wu, and Heng Huang. Defense against model extraction attack by bayesian active watermarking. InForty-First International Conference on Machine Learning, 2024

    2024

  52. [60]

    Zero-shot knowledge distillation from a decision-based black-box model

    Zi Wang. Zero-shot knowledge distillation from a decision-based black-box model. InInterna- tional conference on machine learning, pages 10675–10685. PMLR, 2021

    2021

  53. [61]

    Towards explainable model extraction attacks.International Journal of Intelligent Systems, 37(11):9936–9956, 2022

    Anli Yan, Ruitao Hou, Xiaozhang Liu, Hongyang Yan, Teng Huang, and Xianmin Wang. Towards explainable model extraction attacks.International Journal of Intelligent Systems, 37(11):9936–9956, 2022

    2022

  54. [62]

    Haitian Zhang, Guang Hua, Xinya Wang, Hao Jiang, and Wen Yang. Categorical inference poi- soning: verifiable defense against black-box dnn model stealing without constraining surrogate data and query times.IEEE Transactions on Information Forensics and Security, 18:1473–1486, 2023

    2023

  55. [63]

    Mlmodelci: An automatic cloud platform for efficient mlaas

    Huaizheng Zhang, Yuanming Li, Yizheng Huang, Yonggang Wen, Jianxiong Yin, and Kyle Guan. Mlmodelci: An automatic cloud platform for efficient mlaas. InProceedings of the 28th ACM International Conference on Multimedia, pages 4453–4456, 2020

    2020

  56. [64]

    Minimizing maximum model discrepancy for transferable black-box targeted attacks

    Anqi Zhao, Tong Chu, Yahao Liu, Wen Li, Jingjing Li, and Lixin Duan. Minimizing maximum model discrepancy for transferable black-box targeted attacks. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8153–8162, 2023

    2023

  57. [65]

    A survey of model extraction attacks and defenses in distributed computing environments, 2025

    Kaixiang Zhao, Lincan Li, Kaize Ding, Neil Zhenqiang Gong, Yue Zhao, and Yushun Dong. A survey of model extraction attacks and defenses in distributed computing environments, 2025. 13 A Reproducibility In this section, we introduce the details of the experiments in this paper ...

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.