RADEP: A Resilient Adaptive Defense Framework Against Model Extraction Attacks

Abdul Rahman; Alison Hu; Amit Chakraborty; Edward Bowen; Kevin Choi; Sachin Shetty; Sandip Roy; Sayyed Farid Ahamed; Soumya Banerjee

REVIEW 4 major objections 4 minor 21 references

RADEP: A Resilient Adaptive Defense Framework Against Model Extraction Attacks

T0 review · 4 major / 4 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read RADEP, a four-layer MLaaS defense, claims to substantially cut substitute-model accuracy under JBDA-TR, Cloudleak, and KnockoffNet attacks while adding less than 0.01 ms per-query detection

desk verdict An incremental but well-scoped MLaaS defense framework with extensive experiments; the empirical story is undercut by an underspecified response mechanism and missing artifacts. read the letter →

arxiv 2505.19364 v1 pith:72FULVZF submitted 2025-05-25 cs.CR

Amit Chakraborty , Sayyed Farid Ahamed , Sandip Roy , Soumya Banerjee , Kevin Choi , Abdul Rahman , Alison Hu , Edward Bowen

show 1 more author

Sachin Shetty

This is my paper · ORCID

classification cs.CR

keywords modelextractionattackMachine-Learning-as-a-Servicedeeplearningsecuritymaliciousquerydetectionadversarialtrainingadaptiveresponsewatermarkingbackdoortriggers

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

RADEP is a four-layer defense for machine-learning-as-a-service APIs that tries to make model extraction attacks fail without punishing legitimate users. The paper's central claim is that combining progressive adversarial training, a hybrid malicious-query detector, an adaptive response that perturbs suspicious outputs, and ownership verification reduces a substitute model's test accuracy substantially under JBDA-TR, Cloudleak, and KnockoffNet attacks, compared with no defense and with several baselines. The reported overhead is less than 0.01 ms per query for detection and 15 to 60 ms for response, which is what would make the defense practical in real-time serving. A sympathetic reader would take the paper as evidence that layered, adaptive defenses can beat static defenses against extraction while keeping latency low.

What carries the argument

The load-bearing object is the composite suspicion score of Eq. (2), $S(q) = \alpha_1 (1-P_{\max}(q)) + \alpha_2 H(q) + \alpha_3 (1-M(q)) + \alpha_4 \sigma(q)$, with entropy $H$ defined by Eq. (3) and Bayesian uncertainty $\sigma$ from Monte Carlo dropout. Algorithm 1 maps $S(q)$ to three perturbation levels via thresholds $\tau_1$ and $\tau_2$ and outputs $P_{\text{pert}} = P + \delta$ with $\delta \sim \mathcal{N}(0,\epsilon)$. The mechanism works by making the perturbation a continuous function of how anomalous a query looks, so normal traffic is lightly touched while extraction queries receive noise that degrades the labels used to train a substitute model.

What would settle it

Run RADEP against a KnockoffNet-style attack whose surrogate query stream matches the frequency and variance of legitimate user traffic, and measure both the false-positive rate and the substitute model's final test accuracy; if the substitute accuracy approaches the no-defense level while false positives stay low, the suspicion-score separation is not carrying the defense.

Watch

Extended reading notes

Core claim

On the paper's own terms, RADEP establishes that each layer contributes to the same end: adversarial training raises the cost of imitation, the composite suspicion score $S(q)$ (a weighted sum of max-softmax, entropy, margin, and Bayesian uncertainty) flags extraction queries, the adaptive response adds Gaussian perturbation with strength chosen by $S(q)$, and backdoor triggers plus watermarking identify stolen models. The reported numbers show substitute accuracy falling, for instance, from 91.23% to 65.17% under JBDA-TR hard-label on MNIST and from 83.72% to 65.51% under Cloudleak hard-label on the same dataset, while malicious-query detection accuracy reaches 95.86% on a KnockoffNet attack on MNIST.

Load-bearing premise

The suspicion score separates malicious from benign queries using weights and thresholds calibrated on validation data; if that calibration does not transfer to a new attack or a new data distribution, the adaptive response will either perturb legitimate answers or leave attackers effectively unperturbed.

Editorial extensions

If this is right

If RADEP works as reported, an attacker needs substantially more queries or a fundamentally different strategy to reach the same substitute accuracy, because the adaptive response degrades the labels used for training.
Legitimate users should see little change, since queries with low suspicion scores receive the smallest perturbations.
Ownership verification gives an MLaaS provider a way to trace unauthorized copies back to the original model, even after pruning or fine-tuning, via backdoor triggers and watermarks.
The reported per-query overhead means the defense can run inline in real-time API serving rather than as an offline audit.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: The suspicion score's weights and thresholds are the fragile part; a practical deployment would need continuous recalibration against new query patterns, and the paper does not provide a guarantee that the calibration procedure itself is adaptive.
Editorial inference: An attacker who mimics the query-frequency and variance statistics of legitimate users could in principle bypass the behavioral half of detection, leaving only the uncertainty metrics; a direct test would be to run KnockoffNet with a surrogate dataset whose query timing matches benign traffic.
Editorial inference: The framework could be combined with rate limiting or per-user query budgets, since the adaptive response degrades utility gradually; one testable extension is whether a query budget plus RADEP's perturbation yields strictly lower extraction accuracy than either alone.
Editorial inference: The reported resilience to adaptive adversaries might be tested by an attacker who trains a substitute on the perturbed responses themselves, effectively absorbing the noise; measuring substitute accuracy after such a noise-aware extraction would clarify the limits of the defense.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: RADEP is a sensible layering of existing defenses—adversarial training, uncertainty-based query scoring, response perturbation, watermarking/backdoors—and the paper evaluates it across three attacks and four datasets. That breadth is real work, and the overhead figures (sub-0.01 ms detection, 15–60 ms response) are useful if they hold. But the contribution is incremental: each component traces to prior work, and no single piece is new.

The soft spots are not tiny. Algorithm 1, the load-bearing adaptive response, adds zero-mean Gaussian noise to the soft output. As written, that noise is unbiased; a substitute model trained on enough queries would average it out, so it cannot explain the large accuracy drops in Table III. The prose mentions label flipping and adaptive label scaling, but neither appears in the algorithm. Either the implemented defense is different from the described one, or epsilon values large enough to explain the drops would also destroy utility for legitimate users—and no clean-query accuracy table is reported. Without an ablation isolating this component, the central claim is unverified.

The experimental reporting is also thin: no standard deviations or confidence intervals, no code, no fitted alpha_i values, no thresholds, no epsilon schedule, and only vague descriptions of baselines. The writing has defects: a Table?? placeholder, mismatched reference numbers (DAWN/adaptive misinformation confusion), and Table III's "Baseline Defense" is not identified clearly. These are fixable, but they make the paper hard to check.

The citation pattern is mostly standard; the self-citations are to the authors' own prior ML security work, which is not a problem here.

Who gets value: readers working on MLaaS defenses will find the framework a useful checklist and the overhead data a data point. But the paper as submitted does not demonstrate that RADEP works as claimed.

My recommendation: send to peer review rather than desk reject—the topic is timely and the flaws are correctable—but the referee should require code and hyperparameters, an ablation of the response mechanism, and a legitimate-user utility table. Without those, the empirical claims should not stand.

Referee Report

4 major / 4 minor

Summary. The paper proposes RADEP, a multi-layered defense framework for MLaaS against model extraction attacks. RADEP combines progressive adversarial training, malicious-query detection via uncertainty quantification and behavioral analysis, an adaptive query-response mechanism that perturbs suspicious outputs based on a suspicion score, ownership verification via backdoor triggers and watermarking, and a periodic evaluation/adjustment loop. The central claim is that, under JBDA-TR, Cloudleak, and KnockoffNet attacks, RADEP substantially reduces the substitute model's test accuracy compared with no defense and with baseline defenses, while keeping detection below 0.01 ms per query and response times between 15 and 60 ms, with minimal impact on legitimate queries.

Significance. If the reported results are substantiated, RADEP would be a practically relevant contribution: it combines several defense ideas into one framework, evaluates against multiple modern extraction attacks, and reports low per-query overhead. The paper also usefully distinguishes hard-label and soft-label attack scenarios. However, the current manuscript does not provide enough detail to verify the central mechanism, and several load-bearing experimental claims are not backed by reproducible evidence: the perturbation algorithm is underspecified, no legitimate-user utility is measured, and all quantitative tables are point estimates without variance.

major comments (4)

[Section III.C, Algorithm 1] The adaptive response mechanism is the load-bearing component, but as specified it cannot produce the reported substitute-accuracy drops. Algorithm 1 (line 4) sets P_pert(y|q_i) = P(y|q_i) + delta with delta ~ N(0, epsilon), so the perturbed response is an unbiased estimate of the clean soft output. A substitute trained on 10^4 to 10^5 such queries (Section IV.A.2) minimizes an objective whose expectation is close to the clean-label objective plus a variance term, so the minimizer is close to the undefended victim function and repeated queries average away the noise. The surrounding text mentions label flipping and adaptive label scaling, but these are not implemented in Algorithm 1. The paper must specify the actual deterministic perturbation or label-scaling rule, report the epsilon values used, and provide an ablation that isolates this component; otherwise the large drops in Table III (e.g., MNIST JBDA-TR hard label from 91.23% to 65.17%) remain unexplained.
[Abstract and Section III.C] The paper claims 'minimal impact on legitimate queries' in the abstract and Section III.C, but no table or experiment reports utility for legitimate users, such as clean test accuracy of the protected model after applying detection and response. Since the response strength depends on suspicion thresholds tau1 and tau2 and the perturbation scales epsilon_low/medium/high, false positives can degrade benign outputs. A utility-versus-security curve or a clean-query accuracy table is necessary to support the trade-off claim.
[Section III.B and Section III.E] The central free parameters are not reported or released: the suspicion-score weights alpha_1..alpha_4, the detection threshold tau, the response thresholds tau1 and tau2, the perturbation schedule epsilon_low/medium/high, and the watermark perturbation in Eq. (4). Section III.B says alpha_i are calibrated on validation data and Section III.E says thresholds are adjusted periodically, but the calibration procedure, the resulting values, and the adjustment rule are absent. Without these, the experiments cannot be reproduced or checked for circularity, and the comparison in Tables II and III is not independently verifiable.
[Section IV.A.4 and Tables I-III] All experimental tables report single point estimates with no standard deviations, confidence intervals, or number of independent runs, and the baseline implementations (PRADA, OOD detection, DAWN, deceptive perturbation, AMAO, adaptive misinformation) are only named, not described in terms of hyperparameters or code. Given that some reported numbers differ by only a few points (e.g., Table I CIFAR-10 soft label 43.97 vs 43.14), statistical variation could change the ranking. The authors should report repeated-run statistics, seeds, and baseline configuration details, or release code.

minor comments (4)

[Section IV.D] Section IV.D states 'DAWN [16]' and 'Adaptive Misinformation [20]', but in the reference list [16] is Kariyappa and Qureshi (adaptive misinformation), [20] is Szyller et al. (DAWN), and [21] is Lee et al. (deceptive perturbation); the in-text citation numbers are inconsistent.
[Section IV.D] Section IV.D references 'Table??' with an unresolved placeholder; the referenced table number should be Table III.
[Table I caption] Table I caption contains a typo: 'most effecgive results' should be 'most effective results'.
[Section IV.A.4] Section IV.A.4 lists PRADA as a comparison defense, but no PRADA results appear in Tables II or III; clarify whether PRADA was evaluated or remove it from the list.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: RADEP's central results are externally benchmarked; calibration/feedback is parameter tuning, not self-definition.

full rationale

The claimed defense results are measured against external attacks (JBDA-TR, Cloudleak, KnockoffNet) and compared with published baselines, so the central accuracy reductions are not derived from the defense's own definitions. The suspicion-score weights alpha_i in Eq. (2) are calibrated on validation data and the thresholds in Sec. III-E are adjusted via attack-success feedback; this is legitimate parameter tuning, not a fitted quantity being relabeled as a prediction, because the reported substitute-model accuracy is evaluated out-of-sample and is not the optimization target of the calibration. The paper's self-citations (refs [2], [3], [9], [11], [12]) are contextual or peripheral and do not carry the load-bearing argument. The genuine weaknesses are non-circular: Algorithm 1's zero-mean Gaussian perturbation, by itself, would not explain the large substitute-accuracy drops in Table III, the text mentions label flipping and adaptive label scaling that are absent from the pseudocode, no epsilon values or legitimate-user accuracy/utility table are given, and 'Algorithm 1 line 9' and 'Table??' are unresolved references. These are correctness/verification gaps, not reductions by construction, so the circularity score remains low.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The framework introduces no new entities but depends on several hand-tuned parameters (alpha weights, thresholds, perturbation sizes) and on the assumption that uncertainty scores are discriminative for malicious queries.

free parameters (6)

alpha_1, alpha_2, alpha_3, alpha_4 = not specified
Weights in the uncertainty score Eq. (2), calibrated on validation data (Section III.B).
tau (detection threshold) = not specified
Threshold for flagging queries as suspicious in Eq. (2), tuned to balance detection and false positives.
tau_1, tau_2 (suspicion level thresholds) = not specified
Thresholds in Algorithm 1 that map suspicion score to perturbation levels.
epsilon_low, epsilon_medium, epsilon_high = not specified
Perturbation magnitudes for adaptive response, chosen by hand.
epsilon for watermark perturbation (Eq. 4) = not specified
Query-dependent perturbation that forms the watermark signature.
epsilon for adversarial training (Eq. 1) = not specified
Perturbation factor for FGSM and related adversarial training methods.

assumptions (4)

domain assumption Uncertainty metrics (max softmax, entropy, margin, MC dropout) can separate malicious extraction queries from legitimate ones.
The detection mechanism in Section III.B relies on this separation; no theoretical justification is provided.
domain assumption Adversarial training with FGSM/PGD/DeepFool improves resistance to extraction without significant accuracy loss.
Section III.A uses standard adversarial training; the paper does not measure the accuracy drop on the victim model.
domain assumption The attack simulation in Section III.E accurately models real adversaries.
The defense's adaptive updates depend on this assumption; no evidence that the simulator covers a broad attack space.
domain assumption Backdoor triggers and watermarking survive pruning and fine-tuning.
Section III.D claims resilience to modifications, citing [8], but no experiments validate this.

how reviews work

0 comments

Cite this review

Pith. "Pith review of RADEP: A Resilient Adaptive Defense Framework Against Model Extraction Attacks." pith.science (2026). https://pith.science/paper/72FULVZF

@misc{pith2026250519364,
  author       = {Pith},
  title        = {Pith review of: RADEP: A Resilient Adaptive Defense Framework Against Model Extraction Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/72FULVZF}},
  note         = {Machine review of arXiv:2505.19364}
}

read the original abstract

Machine Learning as a Service (MLaaS) enables users to leverage powerful machine learning models through cloud-based APIs, offering scalability and ease of deployment. However, these services are vulnerable to model extraction attacks, where adversaries repeatedly query the application programming interface (API) to reconstruct a functionally similar model, compromising intellectual property and security. Despite various defense strategies being proposed, many suffer from high computational costs, limited adaptability to evolving attack techniques, and a reduction in performance for legitimate users. In this paper, we introduce a Resilient Adaptive Defense Framework for Model Extraction Attack Protection (RADEP), a multifaceted defense framework designed to counteract model extraction attacks through a multi-layered security approach. RADEP employs progressive adversarial training to enhance model resilience against extraction attempts. Malicious query detection is achieved through a combination of uncertainty quantification and behavioral pattern analysis, effectively identifying adversarial queries. Furthermore, we develop an adaptive response mechanism that dynamically modifies query outputs based on their suspicion scores, reducing the utility of stolen models. Finally, ownership verification is enforced through embedded watermarking and backdoor triggers, enabling reliable identification of unauthorized model use. Experimental evaluations demonstrate that RADEP significantly reduces extraction success rates while maintaining high detection accuracy with minimal impact on legitimate queries. Extensive experiments show that RADEP effectively defends against model extraction attacks and remains resilient even against adaptive adversaries, making it a reliable security framework for MLaaS models.

Figures

Figures reproduced from arXiv: 2505.19364 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

21 extracted references · 15 canonical work pages

[1]

Prada: protecting against dnn model stealing attacks,

M. Juuti, S. Szyller, S. Marchal, and N. Asokan, “Prada: protecting against dnn model stealing attacks,” in2019 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2019, pp. 512–527

work page 2019
[2]

A novel smartphone-based human activity recognition approach using convolutional autoencoder long short-term memory network,

D. Thakur, S. Roy, S. Biswas, E. S. Ho, S. Chattopadhyay, and S. Shetty, “A novel smartphone-based human activity recognition approach using convolutional autoencoder long short-term memory network,” in2023 IEEE 24th International Conference on Information Reuse and Integra- tion for Data Science (IRI). IEEE, 2023, pp. 146–153

work page 2023
[3]

Securing age-of- information (aoi)-enabled 5g smart warehouse using access control scheme,

A. K. Das, S. Roy, E. Bandara, and S. Shetty, “Securing age-of- information (aoi)-enabled 5g smart warehouse using access control scheme,”IEEE Internet of Things Journal, vol. 10, no. 2, pp. 1358– 1375, 2022

work page 2022
[4]

Cloudleak: Large-scale deep learning models stealing through adversarial exam- ples

H. Yu, K. Yang, T. Zhang, Y .-Y . Tsai, T.-Y . Ho, and Y . Jin, “Cloudleak: Large-scale deep learning models stealing through adversarial exam- ples.” inNDSS, vol. 38, 2020, p. 102

work page 2020
[5]

Knockoff nets: Stealing functionality of black-box models,

T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4954– 4963

work page 2019
[6]

Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,

P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” inProceedings of the 10th ACM workshop on artificial intelligence and security, 2017, pp. 15–26

2017
[7]

A comprehensive defense framework against model extraction attacks,

W. Jiang, H. Li, G. Xu, T. Zhang, and R. Lu, “A comprehensive defense framework against model extraction attacks,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 2, pp. 685–700, 2023

work page 2023
[8]

Embedding water- marks into deep neural networks,

Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding water- marks into deep neural networks,” inProceedings of the 2017 ACM on international conference on multimedia retrieval, 2017, pp. 269–277

2017

Show all 21 references

[9]

Accuracy-privacy trade- off in the mitigation of membership inference attack in federated learning,

S. F. Ahamed, S. Banerjee, S. Roy, D. Quinn, M. Vucovich, K. Choi, A. Rahman, A. Hu, E. Bowen, and S. Shetty, “Accuracy-privacy trade- off in the mitigation of membership inference attack in federated learning,”arXiv preprint arXiv:2407.19119, 2024

2024 arXiv
[10]

Data-free model extraction,

J. Truong, P. Maini, R. Wallset al., “Data-free model extraction,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2021, available at https://openaccess.thecvf.com

2021
[11]

Blockchain-based lightweight authentication protocol for iot-enabled smart agriculture,

A. Vangala, S. Roy, and A. K. Das, “Blockchain-based lightweight authentication protocol for iot-enabled smart agriculture,” in2022 In- ternational Conference on Cyber-Physical Social Intelligence (ICCSI). IEEE, 2022, pp. 110–115

2022
[12]

Mia- bad: An approach for enhancing membership inference attack and its mitigation with federated learning,

S. Banerjee, S. Roy, S. F. Ahamed, D. Quinn, M. Vucovich, D. Nan- dakumar, K. Choi, A. Rahman, E. Bowen, and S. Shetty, “Mia- bad: An approach for enhancing membership inference attack and its mitigation with federated learning,” in2024 International Conference on Computing, N...

2024
[13]

Explaining and harnessing adversarial examples,

I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,”arXiv preprint arXiv:1412.6572, 2014

2014 arXiv
[14]

Towards deep learning models resistant to adversarial attacks,

A. Madry, “Towards deep learning models resistant to adversarial attacks,”arXiv preprint arXiv:1706.06083, 2017

2017 arXiv
[15]

Adversarial active learning for deep networks: a margin based approach,

M. Ducoffe and F. Precioso, “Adversarial active learning for deep networks: a margin based approach,”arXiv preprint arXiv:1802.09841, 2018

2018 arXiv
[16]

Defending against model stealing attacks with adaptive misinformation,

S. Kariyappa and M. K. Qureshi, “Defending against model stealing attacks with adaptive misinformation,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020, pp. 770–778

2020
[17]

A simple baseline for bayesian uncertainty in deep learning,

W. J. Maddox, P. Izmailov, T. Garipov, D. P. Vetrov, and A. G. Wilson, “A simple baseline for bayesian uncertainty in deep learning,”Advances in neural information processing systems, vol. 32, 2019

2019
[18]

On information and sufficiency,

S. Kullback and R. Leibler, “On information and sufficiency,”The Annals of Mathematical Statistics, vol. 22, no. 1, pp. 79–86, 1951

1951
[19]

Label flipping attacks against naive bayes on spam filtering systems,

H. Zhang, N. Cheng, Y . Zhang, and Z. Li, “Label flipping attacks against naive bayes on spam filtering systems,”Applied Intelligence, vol. 51, no. 7, pp. 4503–4514, 2021

2021
[20]

Dawn: Dynamic adversarial watermarking of neural networks,

S. Szyller, B. G. Atli, S. Marchal, and N. Asokan, “Dawn: Dynamic adversarial watermarking of neural networks,” inProceedings of the 29th ACM International Conference on Multimedia, 2021, pp. 4417– 4425

2021
[21]

Defending against neural network model stealing attacks using deceptive perturbations,

T. Lee, B. Edwards, I. Molloy, and D. Su, “Defending against neural network model stealing attacks using deceptive perturbations,” in2019 IEEE Security and Privacy Workshops (SPW). IEEE, 2019, pp. 43–49

2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Prada: protecting against dnn model stealing attacks,

M. Juuti, S. Szyller, S. Marchal, and N. Asokan, “Prada: protecting against dnn model stealing attacks,” in2019 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2019, pp. 512–527

work page 2019

[2] [2]

A novel smartphone-based human activity recognition approach using convolutional autoencoder long short-term memory network,

D. Thakur, S. Roy, S. Biswas, E. S. Ho, S. Chattopadhyay, and S. Shetty, “A novel smartphone-based human activity recognition approach using convolutional autoencoder long short-term memory network,” in2023 IEEE 24th International Conference on Information Reuse and Integra- tion for Data Science (IRI). IEEE, 2023, pp. 146–153

work page 2023

[3] [3]

Securing age-of- information (aoi)-enabled 5g smart warehouse using access control scheme,

A. K. Das, S. Roy, E. Bandara, and S. Shetty, “Securing age-of- information (aoi)-enabled 5g smart warehouse using access control scheme,”IEEE Internet of Things Journal, vol. 10, no. 2, pp. 1358– 1375, 2022

work page 2022

[4] [4]

Cloudleak: Large-scale deep learning models stealing through adversarial exam- ples

H. Yu, K. Yang, T. Zhang, Y .-Y . Tsai, T.-Y . Ho, and Y . Jin, “Cloudleak: Large-scale deep learning models stealing through adversarial exam- ples.” inNDSS, vol. 38, 2020, p. 102

work page 2020

[5] [5]

Knockoff nets: Stealing functionality of black-box models,

T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” inProceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4954– 4963

work page 2019

[6] [6]

Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,

P.-Y . Chen, H. Zhang, Y . Sharma, J. Yi, and C.-J. Hsieh, “Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models,” inProceedings of the 10th ACM workshop on artificial intelligence and security, 2017, pp. 15–26

2017

[7] [7]

A comprehensive defense framework against model extraction attacks,

W. Jiang, H. Li, G. Xu, T. Zhang, and R. Lu, “A comprehensive defense framework against model extraction attacks,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 2, pp. 685–700, 2023

work page 2023

[8] [8]

Embedding water- marks into deep neural networks,

Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding water- marks into deep neural networks,” inProceedings of the 2017 ACM on international conference on multimedia retrieval, 2017, pp. 269–277

2017