Pith. sign in

REVIEW 4 major objections 5 minor 79 references

DREAM: Domain-agnostic Reverse Engineering Attributes of Black-box Model

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Black-box model attributes can be inferred from probability outputs alone, without any access to the target's training data, by learning domain-invariant output features with a multi-discriminator GAN.

desk verdict New problem setting (unknown training data) with solid but modest gains; overclaims 'arbitrary domain' because the attribute grid is fixed and closed. read the letter →

arxiv 2412.05842 v1 pith:XQ2RI4M4 submitted 2024-12-08 cs.LG cs.AI

Rongqing Li , Jiaqi Yu , Changsheng Li , Wenhan Luo , Ye Yuan , Guoren Wang This is my paper · ORCID
classification cs.LGcs.AI
keywords black-boxreverseengineeringmodelattributeinferenceout-of-distributiongeneralizationdomain-invariantfeaturesmulti-discriminatorGANextractionattackprobabilityoutputsMLaaSsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Model-reverse-engineering attacks previously worked only when the attacker already knew the target model's training dataset, because the meta-model was trained on white-box models trained on that same data. This paper claims that the training data can be dropped entirely: if the attacker knows only the target's label space and can query it, white-box models trained on other datasets with overlapping labels can serve as source domains, and an out-of-distribution generalization step can bridge the domain gap in the output distributions. DREAM learns domain-invariant features from probability outputs with a multi-discriminator GAN, then classifies the nine architecture and training attributes from those features. The experiments report consistent gains over the prior method and four OOD baselines on held-out domains of PACS and MEDU, and show that a surrogate model built with DREAM-inferred attributes extracts the victim's function nearly as well as a surrogate using the exact architecture.

What carries the argument

MDGAN (multi-discriminator generative adversarial network): a generator network that maps each model's concatenated probability outputs into a 128-dimensional latent vector, together with one discriminator per source domain. Each discriminator is trained to call its own domain's features 'real' and every other domain's features 'fake'; the generator is trained to fool all of them while also minimizing cross-entropy attribute-classification loss with a trade-off weight $\lambda$, so the latent representation becomes domain-invariant across source domains and transfers to the unseen target domain. The domain-agnostic reverse meta-model is a set of nine small MLPs, one per attribute, that classify the invariant features into the enumerated attribute values.

What would settle it

Train a target model with an architecture value outside the enumerated grid—for example, kernel size 7 or a residual connection—while keeping every other attribute inside the grid, and run DREAM on it. If the average accuracy over the remaining attributes stays near the reported level, the grid limitation is weak; if accuracy collapses toward random choice, the enumerated-grid assumption is load-bearing for the paper's broad domain-agnostic claim.

Watch

Extended reading notes

Core claim

The paper's claim is that attributes of a black-box classifier—activation function, dropout, pooling, kernel size, number of convolutional and fully connected layers, optimizer, batch size, and batchnorm—remain inferable from probability outputs alone when the target's training set is unknown. The key move is to treat the unknown training-set distribution as an out-of-distribution target domain: the attacker collects datasets whose label space overlaps the target's, trains a large model zoo of 5,184 attribute combinations per domain, and uses those outputs as source domains. A multi-discriminator GAN encodes the output vectors into an invariant latent space that no source-domain discriminator can tell apart, and $K=9$ classifiers predict each attribute from that space. On leave-one-domain-out tests, DREAM reaches 52.38% average attribute accuracy on the Photo target of PACS versus 48.04% for the best baseline, and 56.86% versus 52.33% on the EMNIST target of MEDU; the model-extraction experiment raises stolen-model accuracy from 45.88% for a random surrogate to 62.81% with a DREAM-inferred surrogate, close to 68.46% for an exact-architecture surrogate.

Load-bearing premise

The load-bearing premise is that the target model's attributes must fit the fixed enumerated grid of attribute values that the white-box models are trained on; kernels, depths, optimizers, or structural choices outside that grid have no representable answer in the meta-model.

Editorial extensions

If this is right

  • Attribute leakage no longer requires possession of the target's training set; overlapping label space plus a query budget is enough.
  • An adversary can use inferred attributes to pick a surrogate architecture, recovering most of the extraction gain of knowing the exact victim architecture.
  • Out-of-distribution generalization machinery can operate directly on probability output vectors, not only on images or raw features.
  • The framework remains competitive under partial class overlap, when source and target have different numbers of classes, and when training and test attribute combinations are disjoint.
  • The approach extends beyond the main CNN grid to a larger architecture space and to Vision Transformer attributes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the attribute language is a fixed grid, the practical reach of the method is grid-bound; an open-set or ordinal version that predicts unseen kernel sizes or depths would be the natural next test.
  • The same domain-adversarial alignment should apply to other probability-output settings, for example exposing training hyperparameters of language or speech models, but the label-space overlap assumption is harder to satisfy when outputs are open-ended.
  • The extraction experiment suggests that approximate architecture knowledge captures most of the value of exact architecture knowledge, which would strengthen the threat model for MLaaS even when reverse engineering is imperfect.
  • An ablation varying the number of discriminators could isolate whether the gain comes from multi-domain alignment rather than from the adversarial objective alone; the paper does not report this comparison.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper studies black-box model attribute reverse engineering when the target model's training data is unknown. The authors cast the problem as out-of-distribution (OOD) generalization: they train white-box models on multiple source domains with overlapping label spaces, obtain model outputs via queries, learn domain-invariant features with a multi-discriminator GAN (MDGAN), and train per-attribute classifiers on these features. At inference, queries are sent to the target black-box model and the extracted features are classified into attribute values. The paper reports experiments on PACS and MEDU modelsets, on a larger attribute space, on Vision Transformers, on a cross-dataset CIFAR setting, and on a model-extraction application, with DREAM consistently ahead of the compared baselines.

Significance. If the claims hold, the paper makes a useful advance over KENNEN by removing the requirement that the attacker know the target model's training dataset, which is a practically important relaxation. The paper also introduces a plausible OOD formulation for probability-output data rather than images, which is a novel angle, and it provides extensive experiments across multiple benchmarks, a larger attribute space, a ViT extension, and a downstream model-extraction validation. The consistent improvements over the baselines, while often modest, are a meaningful positive result. However, the central 'arbitrary domain' claim in the abstract is broader than what the closed attribute grid can support, and several experimental details are missing or inconsistent, so the manuscript needs substantial revision before the contribution can be fully assessed.

major comments (4)
  1. [Section IV-A and Eq. (2)] DREAM is a closed-set classifier over the attribute values enumerated in Table I (and the larger spaces in Tables VIII and IX). Each per-attribute head outputs a softmax over exactly the N^k values in the grid, so a target model whose attribute value is not in the grid (e.g., kernel size 7 in the main experiments, or a residual connection, GroupNorm, or a non-enumerated optimizer) has no correct output and is silently assigned an in-grid value. The abstract's claim that DREAM 'can gracefully apply to an arbitrary domain' is therefore not supported for out-of-grid architectures; Section IV-G3 only holds out combinations of values within the same grid, not values outside it. Please either restrict the claim to the enumerated attribute space or add an open-set/unknown-value mechanism with experiments on out-of-grid attributes.
  2. [Section IV-A and Section V] The manuscript refers to 'Appendix.B' for the statistics of the PACS and MEDU modelsets, but no appendix is present in the submitted text. In addition, Section IV-A describes per-domain splits of 5,000/1,000/1,000 (train/validation/test), which would imply 15,000/3,000/3,000 models across the three PACS domains, whereas Section V states that the PACS modelset comprises 13,000 models (10,000 training, 2,000 validation, 1,000 testing). These numbers need to be reconciled, and the full construction procedure (training epochs, hyperparameters, query sampling, random seeds, and per-domain statistics) must be provided to make the experiments reproducible and to verify the stated 45 GPU-day cost.
  3. [Section IV-G2 and Table VI] The CIFAR experiment changes the number of classes between source and target (7 source classes versus 5 selected target classes), but the generator's input dimension is fixed to N*C as stated in Section IV-B (e.g., 700 for PACS with C=7). The paper does not explain how a target output vector of dimension N*5 is fed into this generator, nor how the target model's output probabilities over its full label set are reduced to the five overlapping classes. The text also says the source domains are Sketch and Cartoon, while the Table VI caption says Photo and Sketch. As written, the claimed result that DREAM handles different numbers of classes is not reproducible and the description is internally inconsistent.
  4. [Section IV-D, Tables II and III] The paper reports averages over 10 trials but does not report standard deviations or significance tests. Since several of the reported improvements over the best baseline are around 2-5 percentage points in average accuracy, it is not possible to assess whether these differences are reliable or within trial-to-trial noise. Reporting variance and, where feasible, paired significance tests would materially strengthen the central claim that DREAM outperforms the baselines.
minor comments (5)
  1. [Section III-D] The claim that MDGAN 'does not suffer from mode collapse' because G is an encoder rather than a generator is not substantiated; an encoder network in an adversarial setup can still collapse if different inputs map to nearly identical features. Please either provide empirical evidence or soften this claim.
  2. [Section II, references [36]-[38]] The citation mapping in the reverse-engineering related works appears to be off: the text says '[37] theoretically proves the weight and bias can be reversed in linear network with ReLU activation' (which corresponds to Rolnick and Kording, reference [36]) and '[38] infers hyperparameters and loss functions of generative models' (which corresponds to Asnani et al., reference [37]). Please correct the citation numbers.
  3. [Section IV-B] There is a typo: 'the number of classes if C = 10' should read 'the number of classes is C = 10'.
  4. [Section I, Figure 2] The caption of Figure 2 is grammatically incomplete: 'The performance of KENNEN [22] on black-box model trained on Cartoon, Sketch and Photo dataset [24].' should be a full sentence describing the setup and the plotted quantity.
  5. [Algorithm 1] The stopping criterion in Algorithm 1 is 'while difference in training loss Lc of meta-model between two consecutive epochs ≥ epsilon', but no value or selection procedure for epsilon is given; the convergence criterion should be specified.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: target-domain inference is not used in training, and the closed attribute grid is an explicit scope limitation rather than a circular reduction.

full rationale

The derivation chain is self-contained. DREAM trains generator G and meta-model Φ on white-box source-domain outputs O_i using Eq. (4); the target black-box model is queried only at inference, and its outputs/attributes never appear in the training objectives (Eqs. 1-4) or in the tuning of λ, which is selected on the validation split. There is no parameter fitted to the held-out target results, so the reported accuracies are predictions rather than refitted values. The enumerated attribute grid in Table I (and its larger variant Table VIII) is the declared output label space of the K independent softmax classifiers in Eq. (2); an architecture with an out-of-grid attribute value cannot be represented and would be silently mapped to the nearest in-grid class. That is a real expressiveness/scope limitation of the 'arbitrary domain' claim, but it is not circular, because the paper never claims to output values outside this explicitly defined attribute language and all experiments test within it. The only self-citation found, reference [4], appears in a generic image-classification citation list and does not support any load-bearing step. No uniqueness theorem or author-imported ansatz is invoked. Hence no circular step is present.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several stated assumptions rather than on fitted constants. The most load-bearing is the shared attribute grid between white-box and target models (Section IV-A, Table I). The method also assumes the target's label space is known (Section III-A), that probability outputs carry sufficient architecture-discriminative signal that survives domain shifts (Sections I and III-E), and that the trained white-box models generalize like deployed models (footnote 2). The hyperparameters listed as free parameters (trade-off lambda, query count, latent dimension, modelset sizes) are hand-chosen or validation-tuned; none are fitted to the target-domain test results, so the circularity burden is low. No new physical or mathematical entities are introduced.

free parameters (5)
  • lambda (trade-off in Eq. 4) = tuned from {0.001, 0.01, 0.1, 1, 10}; final value not reported
    Balances MDGAN alignment loss and attribute classification loss; chosen on the source validation set.
  • Number of queries N = 100
    Sets the meta-model input dimension N*C; chosen by hand.
  • Generator latent dimension = 128
    Output size of the generator's second linear layer; chosen by hand.
  • White-box models per domain = 5000 train, 1000 validation, 1000 test per domain
    Sample sizes from the 5,184,000 possible models; affect training cost and stability but are not fitted.
  • Learning rates alpha, beta = 1e-5 (generator/discriminators), 1e-4 (meta-model)
    Set in Section IV-B; standard tuning.
assumptions (5)
  • domain assumption White-box models and the target black-box model share the same enumerated attribute space (Table I).
    Stated in Section IV-A: modelsets are built by enumerating all possible attribute values; if the target uses an architecture outside this grid, the meta-model cannot represent it.
  • domain assumption The label space of the target black-box model is known and source datasets with overlapping labels can be collected.
    Section III-A threat model states 'only the label space of the black-box model are known' and uses it to collect OOD datasets.
  • domain assumption Probability outputs of models contain sufficient domain-invariant signal to discriminate architecture attributes.
    Core premise of the OOD framing (Sections I and III-E); if this fails, no invariant feature learning can succeed.
  • ad hoc to paper White-box models selected are not overtrained and generalize like deployed models.
    Footnote 2 in Section IV-A asserts that practical deployed models generalize, so the meta-model is trained only on validation-best white-box models.
  • standard math Standard GAN min-max training converges to a useful invariant feature space.
    Section III-D relies on adversarial training dynamics to align feature distributions across domains.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DREAM: Domain-agnostic Reverse Engineering Attributes of Black-box Model." pith.science (2026). https://pith.science/paper/XQ2RI4M4

@misc{pith2026241205842,
  author       = {Pith},
  title        = {Pith review of: DREAM: Domain-agnostic Reverse Engineering Attributes of Black-box Model},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XQ2RI4M4}},
  note         = {Machine review of arXiv:2412.05842}
}
read the original abstract

Deep learning models are usually black boxes when deployed on machine learning platforms. Prior works have shown that the attributes (e.g., the number of convolutional layers) of a target black-box model can be exposed through a sequence of queries. There is a crucial limitation: these works assume the training dataset of the target model is known beforehand and leverage this dataset for model attribute attack. However, it is difficult to access the training dataset of the target black-box model in reality. Therefore, whether the attributes of a target black-box model could be still revealed in this case is doubtful. In this paper, we investigate a new problem of black-box reverse engineering, without requiring the availability of the target model's training dataset. We put forward a general and principled framework DREAM, by casting this problem as out-of-distribution (OOD) generalization. In this way, we can learn a domain-agnostic meta-model to infer the attributes of the target black-box model with unknown training data. This makes our method one of the kinds that can gracefully apply to an arbitrary domain for model attribute reverse engineering with strong generalization ability. Extensive experimental results demonstrate the superiority of our proposed method over the baselines.

Figures

Figures reproduced from arXiv: 2412.05842 by the authors.

Figure 1
Figure 1. Previous work (left) assumes the dataset used to train the target black-box model is known beforehand, and requires to use the same dataset to [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The performance of KENNEN [22] on black-box model trained on [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. An illustration of our DREAM framework. In the left part, we train a large number of white-box models using datasets collected from different styles [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: An example to illustrate the MDGAN. agnostic meta-model to infer the attributes of a black-box model with an unknown domain. C. Multi-domain Outputs Obtaining To achieve model reverse engineering, we first need to obtain the multi-domain outputs of the white-box models…
Figure 5
Figure 5. Figure 5: T-SNE visualization of features of different domains produced by DREAM, MMD, MisStyle and SelfReg on PACS modelset. [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Performance against size of training set on PACS modelset. From left to right, normalized accuracies in the P split, C split and S split are shown, [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 7
Figure 7. Figure 7: Performance on data amount for reverse engineering. [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

79 extracted references · 54 canonical work pages

  1. [1]

    Improving image recognition by retrieving from web-scale image-text data,

    A. Iscen, A. Fathi, and C. Schmid, “Improving image recognition by retrieving from web-scale image-text data,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 19 295–19 304

    work page 2023

  2. [2]

    Unireplknet: A universal perception large-kernel convnet for audio video point cloud time-series and image recognition,

    X. Ding, Y . Zhang, Y . Ge, S. Zhao, L. Song, X. Yue, and Y . Shan, “Unireplknet: A universal perception large-kernel convnet for audio video point cloud time-series and image recognition,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 5513–5524

    work page 2024

  3. [3]

    Implicit counterfactual data augmentation for deep neural networks,

    X. Zhou and O. Wu, “Implicit counterfactual data augmentation for deep neural networks,” arXiv preprint arXiv:2304.13431 , 2023

    arXiv 2023

  4. [4]

    Deep unsupervised active learning via matrix sketching,

    C. Li, R. Li, Y . Yuan, G. Wang, and D. Xu, “Deep unsupervised active learning via matrix sketching,” IEEE Transactions on Image Processing , vol. 30, pp. 9280–9293, 2021

    work page 2021

  5. [5]

    Linear classifier: An often-forgotten baseline for text classification,

    Y .-C. Lin, S.-A. Chen, J.-J. Liu, and C.-J. Lin, “Linear classifier: An often-forgotten baseline for text classification,” in Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers) , A. Rogers, J. Boyd-Graber, and N. Okazaki, Eds. Toronto, Canada: Association for Computational Linguistics, Jul. 20...

    work page 2023

  6. [6]

    Multilingual llms are better cross-lingual in-context learners with alignment,

    E. Tanwar, S. Dutta, M. Borthakur, and T. Chakraborty, “Multilingual llms are better cross-lingual in-context learners with alignment,” in Pro- ceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , 2023, pp. 6292–6307

    work page 2023

  7. [7]

    Investigating annotation noise for named entity recognition,

    Y . Zhu, Y . Ye, M. Li, J. Zhang, and O. Wu, “Investigating annotation noise for named entity recognition,” Neural Computing and Applications , vol. 35, no. 1, pp. 993–1007, 2023

    work page 2023

  8. [8]

    Give us the facts: Enhancing large language models with knowledge graphs for fact- aware language modeling,

    L. Yang, H. Chen, Z. Li, X. Ding, and X. Wu, “Give us the facts: Enhancing large language models with knowledge graphs for fact- aware language modeling,” IEEE Transactions on Knowledge and Data Engineering, 2024

    work page 2024

Show all 79 references
  1. [9]

    Class-incremental learning for multi- label audio classification,

    M. Mulimani and A. Mesaros, “Class-incremental learning for multi- label audio classification,” in ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , 2024, pp. 916–920

    2024

  2. [10]

    Audio-visual speech recognition in-the-wild: Multi-angle vehicle cabin corpus and attention-based method,

    A. Axyonov, D. Ryumin, D. Ivanko, A. Kashevnik, and A. Karpov, “Audio-visual speech recognition in-the-wild: Multi-angle vehicle cabin corpus and attention-based method,” in ICASSP 2024 - 2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2...

    2024

  3. [11]

    Decision-based adversarial attack with frequency mixup,

    X.-C. Li, X.-Y . Zhang, F. Yin, and C.-L. Liu, “Decision-based adversarial attack with frequency mixup,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 1038–1052, 2022

    2022

  4. [12]

    Adversarial attack on large scale graph,

    J. Li, T. Xie, L. Chen, F. Xie, X. He, and Z. Zheng, “Adversarial attack on large scale graph,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 1, pp. 82–95, 2021

    2021

  5. [13]

    Adversarial attack framework on graph embedding models with limited knowledge,

    H. Chang, Y . Rong, T. Xu, W. Huang, H. Zhang, P. Cui, X. Wang, W. Zhu, and J. Huang, “Adversarial attack framework on graph embedding models with limited knowledge,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 5, pp. 4499–4513, 2022

    2022

  6. [14]

    A more context-aware approach for textual adversarial attacks using probability difference-guided beam search,

    H. Liu, B. Ji, J. Yu, S. Li, J. Ma, Z. Yi, M. Du, M. Li, J. Liu, and Z. Mo, “A more context-aware approach for textual adversarial attacks using probability difference-guided beam search,” IEEE Transactions on Knowledge and Data Engineering , 2023

    2023

  7. [15]

    A unified framework for adversarial attacks on multi- source domain adaptation,

    J. Wu and J. He, “A unified framework for adversarial attacks on multi- source domain adaptation,” IEEE Transactions on Knowledge and Data Engineering, 2022

    2022

  8. [16]

    Explanation-based data-free model extraction attacks,

    A. Yan, R. Hou, H. Yan, and X. Liu, “Explanation-based data-free model extraction attacks,” World Wide Web, vol. 26, no. 5, pp. 3081–3092, 2023

    2023

  9. [17]

    Dual student networks 13 for data-free model stealing,

    J. Beetham, N. Kardan, A. S. Mian, and M. Shah, “Dual student networks 13 for data-free model stealing,” in The Eleventh International Conference on Learning Representations , 2022, pp. 1–12

    2022

  10. [18]

    Stealing part of a production language model,

    N. Carlini, D. Paleka, K. D. Dvijotham, T. Steinke, J. Hayase, A. F. Cooper, K. Lee, M. Jagielski, M. Nasr, A. Conmy et al., “Stealing part of a production language model,” in Forty-first International Conference on Machine Learning . PMLR, 2024, pp. 5680–5705

    2024

  11. [19]

    Fully exploiting every real sample: Superpixel sample gradient model stealing,

    Y . Zhao, X. Deng, Y . Liu, X. Pei, J. Xia, and W. Chen, “Fully exploiting every real sample: Superpixel sample gradient model stealing,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 316–24 325

    2024

  12. [20]

    Delving into transferable adversarial examples and black-box attacks,

    Y . Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” in International Conference on Learning Representations , 2017, pp. 1–14

    2017

  13. [21]

    Can’t steal? cont-steal! contrastive stealing attacks against image encoders,

    Z. Sha, X. He, N. Yu, M. Backes, and Y . Zhang, “Can’t steal? cont-steal! contrastive stealing attacks against image encoders,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 16 373–16 383

    2023

  14. [22]

    Towards reverse- engineering black-box neural networks,

    S. J. Oh, M. Augustin, B. Schiele, and M. Fritz, “Towards reverse- engineering black-box neural networks,” in 6th International Conference on Learning Representations , 2018, pp. 1–20

    2018

  15. [23]

    Gradient-based learning applied to document recognition,

    Y . Lecun, L. Bottou, Y . Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

    1998

  16. [24]

    Deeper, broader and artier domain generalization,

    D. Li, Y . Yang, Y .-Z. Song, and T. M. Hospedales, “Deeper, broader and artier domain generalization,” in Proceedings of the IEEE international conference on computer vision , 2017, pp. 5542–5550

    2017

  17. [25]

    Towards out-of-distribution generalization: A survey,

    Z. Shen, J. Liu, Y . He, X. Zhang, R. Xu, H. Yu, and P. Cui, “Towards out-of-distribution generalization: A survey,” arXiv preprint arXiv:2108.13624, 2021

    2021 arXiv

  18. [26]

    Domain generaliza- tion: A survey,

    K. Zhou, Z. Liu, Y . Qiao, T. Xiang, and C. C. Loy, “Domain generaliza- tion: A survey,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022

    2022

  19. [27]

    Generalizing to unseen domains: A survey on domain generalization,

    J. Wang, C. Lan, C. Liu, Y . Ouyang, T. Qin, W. Lu, Y . Chen, W. Zeng, and S. Y . Philip, “Generalizing to unseen domains: A survey on domain generalization,” IEEE transactions on knowledge and data engineering , vol. 35, no. 8, pp. 8052–8072, 2022

    2022

  20. [28]

    Domain generalization with adversarial feature learning,

    H. Li, S. J. Pan, S. Wang, and A. C. Kot, “Domain generalization with adversarial feature learning,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 5400–5409

    2018

  21. [29]

    Selfreg: Self-supervised contrastive regularization for domain generalization,

    D. Kim, Y . Yoo, S. Park, J. Kim, and J. Lee, “Selfreg: Self-supervised contrastive regularization for domain generalization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2021, pp. 9619–9628

    2021

  22. [30]

    Domain generalization with mixstyle,

    K. Zhou, Y . Yang, Y . Qiao, and T. Xiang, “Domain generalization with mixstyle,” in ICLR, 2021

    2021

  23. [31]

    Learning invariant representations and risks for semi-supervised domain adaptation,

    B. Li, Y . Wang, S. Zhang, D. Li, K. Keutzer, T. Darrell, and H. Zhao, “Learning invariant representations and risks for semi-supervised domain adaptation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2021, pp. 1104–1113

    2021

  24. [32]

    Cache telepathy: Leveraging shared resource attacks to learn dnn architectures,

    M. Yan, C. Fletcher, and J. Torrellas, “Cache telepathy: Leveraging shared resource attacks to learn dnn architectures,” in USENIX Security Symposium, 2020

    2020

  25. [33]

    Reverse engineering convolutional neural networks through side-channel information leaks,

    W. Hua, Z. Zhang, and G. E. Suh, “Reverse engineering convolutional neural networks through side-channel information leaks,” in Proceedings of the 55th Annual Design Automation Conference , 2018, pp. 1–6

    2018

  26. [34]

    Hermes attack: Steal dnn models with lossless inference accuracy

    Y . Zhu, Y . Cheng, H. Zhou, and Y . Lu, “Hermes attack: Steal dnn models with lossless inference accuracy.” in USENIX Security Symposium , 2021, pp. 1973–1988

    2021

  27. [35]

    Stealing hyperparameters in machine learning,

    B. Wang and N. Z. Gong, “Stealing hyperparameters in machine learning,” in 2018 IEEE symposium on security and privacy (SP) . IEEE, 2018, pp. 36–52

    2018

  28. [36]

    Reverse-engineering deep relu networks,

    D. Rolnick and K. Kording, “Reverse-engineering deep relu networks,” in International Conference on Machine Learning . PMLR, 2020, pp. 8178–8187

    2020

  29. [37]

    Reverse engineering of generative models: Inferring model hyperparameters from generated images,

    V . Asnani, X. Yin, T. Hassner, and X. Liu, “Reverse engineering of generative models: Inferring model hyperparameters from generated images,” arXiv preprint arXiv:2106.07873 , 2021

    2021 arXiv

  30. [38]

    Correlation-aware adversarial domain adaptation and generalization,

    M. M. Rahman, C. Fookes, M. Baktashmotlagh, and S. Sridharan, “Correlation-aware adversarial domain adaptation and generalization,” Pattern Recognition, vol. 100, p. 107124, 2020

    2020

  31. [39]

    Knockoff nets: Stealing functionality of black-box models,

    T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , 2019, pp. 4954– 4963

    2019

  32. [40]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security, 2017, pp. 506–519

    2017

  33. [41]

    Maze: Data-free model stealing attack using zeroth-order gradient estimation,

    S. Kariyappa, A. Prakash, and M. K. Qureshi, “Maze: Data-free model stealing attack using zeroth-order gradient estimation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2021, pp. 13 814–13 823

    2021

  34. [42]

    Dst: Dynamic substitute training for data-free black-box attack,

    W. Wang, X. Qian, Y . Fu, and X. Xue, “Dst: Dynamic substitute training for data-free black-box attack,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 14 361–14 370

    2022

  35. [43]

    Delving into data: Effectively substitute training for black-box attack,

    W. Wang, B. Yin, T. Yao, L. Zhang, Y . Fu, S. Ding, J. Li, F. Huang, and X. Xue, “Delving into data: Effectively substitute training for black-box attack,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 4761–4770

    2021

  36. [44]

    Segmentations-leak: Membership inference attacks and defenses in semantic image segmen- tation,

    Y . He, S. Rahimian, B. Schiele, and M. Fritz, “Segmentations-leak: Membership inference attacks and defenses in semantic image segmen- tation,” in European Conference on Computer Vision . Springer, 2020, pp. 519–535

    2020

  37. [45]

    On the difficulty of membership inference attacks,

    S. Rezaei and X. Liu, “On the difficulty of membership inference attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, pp. 7892–7900

    2021

  38. [46]

    Membership inference attacks from first principles,

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tramèr, “Membership inference attacks from first principles,” in 2022 IEEE Symposium on Security and Privacy (SP) , 2022, pp. 1897–1914

    2022

  39. [47]

    Enhanced membership inference attacks against machine learning models,

    J. Ye, A. Maddi, S. K. Murakonda, V . Bindschaedler, and R. Shokri, “Enhanced membership inference attacks against machine learning models,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 3093–3106

    2022

  40. [48]

    Membership inference attacks by exploiting loss trajectory,

    Y . Liu, Z. Zhao, M. Backes, and Y . Zhang, “Membership inference attacks by exploiting loss trajectory,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 2085–2098

    2022

  41. [49]

    Scalable membership inference attacks via quantile regression,

    M. Bertran, S. Tang, A. Roth, M. Kearns, J. H. Morgenstern, and S. Z. Wu, “Scalable membership inference attacks via quantile regression,” Advances in Neural Information Processing Systems, vol. 36, pp. 314–330, 2024

    2024

  42. [50]

    Towards more realistic membership inference attacks on large diffusion models,

    J. Dubi ´nski, A. Kowalczuk, S. Pawlak, P. Rokita, T. Trzci ´nski, and P. Morawiecki, “Towards more realistic membership inference attacks on large diffusion models,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , 2024, pp. 4860–4869

    2024

  43. [51]

    Membership inference attacks against diffusion models,

    T. Matsumoto, T. Miura, and N. Yanai, “Membership inference attacks against diffusion models,” in 2023 IEEE Security and Privacy Workshops (SPW). IEEE, 2023, pp. 77–83

    2023

  44. [52]

    Confmix: Unsupervised domain adaptation for object detection via confidence-based mixing,

    G. Mattolin, L. Zanella, E. Ricci, and Y . Wang, “Confmix: Unsupervised domain adaptation for object detection via confidence-based mixing,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, 2023, pp. 423–433

    2023

  45. [53]

    Ssda3d: Semi-supervised domain adaptation for 3d object detection from point cloud,

    Y . Wang, J. Yin, W. Li, P. Frossard, R. Yang, and J. Shen, “Ssda3d: Semi-supervised domain adaptation for 3d object detection from point cloud,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 37, no. 3, 2023, pp. 2707–2715

    2023

  46. [54]

    Camera alignment and weighted contrastive learning for domain adap- tation in video person reid,

    D. Mekhazni, M. Dufau, C. Desrosiers, M. Pedersoli, and E. Granger, “Camera alignment and weighted contrastive learning for domain adap- tation in video person reid,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , 2023, pp. 1624–1633

    2023

  47. [55]

    Unsuper- vised video domain adaptation for action recognition: A disentanglement perspective,

    P. Wei, L. Kong, X. Qu, Y . Ren, Z. Xu, J. Jiang, and X. Yin, “Unsuper- vised video domain adaptation for action recognition: A disentanglement perspective,” Advances in Neural Information Processing Systems, vol. 36, pp. 17 623–17 642, 2024

    2024

  48. [56]

    Madg: Margin-based adversarial learning for domain generalization,

    A. Dayal, V . KB, L. R. Cenkeramaddi, C. Mohan, A. Kumar, and V . N Balasubramanian, “Madg: Margin-based adversarial learning for domain generalization,” Advances in Neural Information Processing Systems, vol. 36, pp. 58 938–58 952, 2024

    2024

  49. [57]

    Diversifying spatial-temporal perception for video domain generalization,

    K.-Y . Lin, J.-R. Du, Y . Gao, J. Zhou, and W.-S. Zheng, “Diversifying spatial-temporal perception for video domain generalization,” Advances in Neural Information Processing Systems , vol. 36, pp. 56 012–56 026, 2024

    2024

  50. [58]

    Domain generalization with correlated style uncertainty,

    Z. Zhang, B. Wang, D. Jha, U. Demir, and U. Bagci, “Domain generalization with correlated style uncertainty,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , 2024, pp. 2000–2009

    2024

  51. [59]

    Sharpness-aware gradient matching for domain generalization,

    P. Wang, Z. Zhang, Z. Lei, and L. Zhang, “Sharpness-aware gradient matching for domain generalization,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2023, pp. 3769–3778. 14

    2023

  52. [60]

    Mixstyle neural networks for domain generalization and adaptation,

    K. Zhou, Y . Yang, Y . Qiao, and T. Xiang, “Mixstyle neural networks for domain generalization and adaptation,” International Journal of Computer Vision, vol. 132, no. 3, pp. 822–836, 2024

    2024

  53. [61]

    Domain generalization via optimal transport with metric similarity learning,

    F. Zhou, Z. Jiang, C. Shui, B. Wang, and B. Chaib-draa, “Domain generalization via optimal transport with metric similarity learning,” arXiv preprint arXiv:2007.10573 , 2020

    2007 arXiv

  54. [62]

    Domain generalization via multidomain discriminant analysis,

    S. Hu, K. Zhang, Z. Chen, and L. Chan, “Domain generalization via multidomain discriminant analysis,” in Uncertainty in Artificial Intelligence. PMLR, 2020, pp. 292–302

    2020

  55. [63]

    Invariant risk minimization,

    M. Arjovsky, L. Bottou, I. Gulrajani, and D. Lopez-Paz, “Invariant risk minimization,” arXiv preprint arXiv:1907.02893 , 2019

    1907 arXiv

  56. [64]

    Environment inference for invariant learning,

    E. Creager, J.-H. Jacobsen, and R. Zemel, “Environment inference for invariant learning,” in International Conference on Machine Learning . PMLR, 2021, pp. 2189–2200

    2021

  57. [65]

    Out-of-distribution generalization via risk extrapolation (rex),

    D. Krueger, E. Caballero, J.-H. Jacobsen, A. Zhang, J. Binas, D. Zhang, R. Le Priol, and A. Courville, “Out-of-distribution generalization via risk extrapolation (rex),” in International Conference on Machine Learning . PMLR, 2021, pp. 5815–5826

    2021

  58. [66]

    Domain generalization using causal matching,

    D. Mahajan, S. Tople, and A. Sharma, “Domain generalization using causal matching,” in International Conference on Machine Learning . PMLR, 2021, pp. 7313–7324

    2021

  59. [67]

    Stable learning via sample reweighting,

    Z. Shen, P. Cui, T. Zhang, and K. Kunag, “Stable learning via sample reweighting,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, no. 04, 2020, pp. 5692–5699

    2020

  60. [68]

    Stable prediction with model misspecification and agnostic distribution shift,

    K. Kuang, R. Xiong, P. Cui, S. Athey, and B. Li, “Stable prediction with model misspecification and agnostic distribution shift,” in Proceedings of the AAAI Conference on Artificial Intelligence , vol. 34, no. 04, 2020, pp. 4485–4492

    2020

  61. [69]

    Deep stable learning for out-of-distribution generalization,

    X. Zhang, P. Cui, R. Xu, L. Zhou, Y . He, and Z. Shen, “Deep stable learning for out-of-distribution generalization,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2021, pp. 5372–5382

    2021

  62. [70]

    Stable prediction across unknown environments,

    K. Kuang, P. Cui, S. Athey, R. Xiong, and B. Li, “Stable prediction across unknown environments,” in Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining , 2018, pp. 1617–1626

    2018

  63. [71]

    Generative adversarial networks,

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial networks,” Communications of the ACM , vol. 63, no. 11, pp. 139–144, 2020

    2020

  64. [72]

    A database for handwritten text recognition research,

    J. Hull, “A database for handwritten text recognition research,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 16, no. 5, pp. 550–554, May 1994, conference Name: IEEE Transactions on Pattern Analysis and Machine Intelligence

    1994

  65. [73]

    Dida: The largest historical handwritten digit dataset with 250k digits,

    H. Kusetogullari, A. Yavariabdi, J. Hall, and N. Lavesson, “Dida: The largest historical handwritten digit dataset with 250k digits,” https:// github.com/didadataset/DIDA/, accessed: 2021-06-13

    2021

  66. [74]

    Emnist: Extending mnist to handwritten letters,

    G. Cohen, S. Afshar, J. Tapson, and A. Van Schaik, “Emnist: Extending mnist to handwritten letters,” in 2017 international joint conference on neural networks (IJCNN) . IEEE, 2017, pp. 2921–2926

    2017

  67. [75]

    Adam: A method for stochastic optimization,

    D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980 , 2014

    2014 arXiv

  68. [76]

    Pytorch: An imperative style, high-performance deep learning library,

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga et al. , “Pytorch: An imperative style, high-performance deep learning library,” Advances in neural information processing systems , vol. 32, 2019

    2019

  69. [77]

    Gradient starvation: A learning proclivity in neural networks,

    M. Pezeshki, O. Kaba, Y . Bengio, A. C. Courville, D. Precup, and G. Lajoie, “Gradient starvation: A learning proclivity in neural networks,” Advances in Neural Information Processing Systems , vol. 34, pp. 1256– 1272, 2021

    2021

  70. [78]

    Visualizing data using t-sne

    L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.” Journal of machine learning research , vol. 9, no. 11, 2008

    2008

  71. [79]

    An image is worth 16x16 words: Transformers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929 , 2020. Rongqing Li received t...

    2010 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.