Pith. sign in

REVIEW 3 major objections 5 minor 32 references

Assessing Risk of Stealing Proprietary Models for Medical Imaging Tasks

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A 5,000-query attack can functionally clone a black-box medical imaging model.

desk verdict Plausible hard-label model-stealing demo for medical imaging, but the headline GBC result is likely inflated by proxy data from the victim's own group, and QueryWise itself is inconsistent. read the letter →

arxiv 2506.19464 v1 pith:RRBCHYAD submitted 2025-06-24 eess.IV cs.CRcs.CV

Ankita Raj , Harsh Swaika , Deepankar Varma , Chetan Arora This is my paper · ORCID
classification eess.IVcs.CRcs.CV
keywords modelstealingextractionmedicalimagingblack-boxattackhard-labelqueryknowledgedistillationpseudo-labelinggallbladdercancerclassification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that proprietary black-box medical imaging models can be functionally cloned by an adversary who has no access to the victim model's weights, training data, or soft labels, only its top-1 prediction. It proposes a two-step attack, QueryWise, that first trains an anchor model on 5,000 queried hard labels and then trains a student thief on both the labeled queries and the remaining unlabeled proxy images, using soft pseudo-labels from the anchor and an exponential-moving-average teacher. On a gallbladder-cancer ultrasound classification task the resulting thief reaches 77 percent accuracy, above the 70 percent of a published radiologist baseline, and it improves agreement with the victim across architectures and tasks. The paper takes this as evidence that the common belief in the safety of hidden-weight diagnostic services is unfounded, and that current perturbation-based defenses do not reliably stop the attack.

What carries the argument

The load-bearing mechanism is QueryWise's two-step distillation loop. Step one trains an anchor model purely on the queried hard labels. Step two trains a student thief on a combined loss: on labeled images the student is supervised by the victim's hard labels plus the anchor's softened logits via knowledge distillation; on unlabeled images it is supervised by softened outputs of the anchor and of a teacher whose weights are an exponential moving average of the student's own weights, with only samples whose maximum softmax probability exceeds a threshold contributing. Logit adjustment counters the class imbalance induced by querying an out-of-distribution proxy set. The student becomes the final thief model.

What would settle it

Run QueryWise with a 5,000-query budget against a black-box medical classifier using a public proxy dataset from a different institution, scanner, or patient population than the victim's training data, and check whether thief accuracy still exceeds the radiologist baseline or even the random-query baseline; if accuracy collapses toward chance once the proxy distribution is truly external, the paper's central generalization claim fails.

Watch

Extended reading notes

Core claim

The paper claims that model stealing is a realistic threat for medical imaging classifiers under a strict threat model: hard-label-only access, a 5,000-query budget, and no access to the victim's training distribution. The central empirical discovery is that a two-stage training procedure, QueryWise, which reuses the unlabeled proxy data that ordinary stealing methods discard, produces thieves that outperform standard stealing baselines and, on the gallbladder-cancer task, surpass published radiologist accuracy (77.05 percent vs 70.00 percent). The authors also report that the attack transfers across convolutional and transformer architectures and to a COVID-19 lung-ultrasound classifier, and that three state-of-the-art perturbation-based defenses fail to reduce thief accuracy consistently without also damaging the victim. In the authors' reading, this invalidates the assumption that keeping model weights hidden is sufficient protection for monetized diagnostic models.

Load-bearing premise

The attack's success assumes the victim's top-1 labels on the attacker's out-of-distribution proxy images are informative enough to train a thief that generalizes to the victim's real test distribution; in the main experiment that proxy data comes from the same research group that built the victim, so the assumption is easier to satisfy than in a genuine external attack.

Editorial extensions

If this is right

  • An adversary with 5,000 top-1 labels and a public same-modality image collection can reproduce enough of a proprietary medical classifier's behavior to surpass expert-level accuracy on at least one clinically meaningful task.
  • Three state-of-the-art perturbation-based defenses fail to reduce thief accuracy consistently without also reducing the victim's own accuracy, so hiding weights is not a reliable protection strategy.
  • The attack transfers across thief architectures and tasks, including transformer backbones and COVID-19 lung ultrasound, so the risk is not specific to one model family.
  • QueryWise's reliance on a proxy distribution means the practical danger is greatest where public unlabeled images of the same modality are easy to obtain.
  • For model owners, the observable query response surface itself leaks enough information to clone functionality, even when the model returns only its top prediction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • In the gallbladder-cancer experiment the proxy video frames were produced by the same research group that built the victim model, so the proxy-to-victim domain gap is probably smaller than in a real attack on an unrelated proprietary service; whether 5,000 queries still suffice across a genuinely large domain shift is untested by the paper.
  • On the COVID-19 task QueryWise raised agreement with the victim without raising accuracy, suggesting the method can copy decision boundaries rather than the true clinical label; a thief that mimics a biased victim would inherit that bias.
  • A sharper test of the attack would use a proxy dataset that provably shares no acquisition pipeline or patient population with the victim's training data, and would report radiologist-level labels on the same test set instead of published baseline numbers.
  • The confidence threshold on pseudo-labels is likely a key lever; varying it should reveal whether the gain comes from high-quality pseudo-labels or simply from more training data.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper investigates model stealing attacks on black-box medical image classifiers under a hard-label setting with a limited query budget of 5,000. The authors propose QueryWise, a two-stage method that first trains an anchor model on queried labels and then trains a final student model on both labeled and unlabeled proxy data, using pseudo-labels from the anchor and an EMA-updated teacher. They evaluate QueryWise on two medical tasks — Gallbladder Cancer (GBC) and COVID-19 classification — and report that a DeiT-based thief using QueryWise achieves 77.05% accuracy on GBC, surpassing an expert radiologist (70%). They also evaluate existing model stealing defenses and find them ineffective. Supplementary experiments cover natural image datasets.

Significance. If substantiated, the paper addresses an important and under-explored vulnerability in medical MLaaS: that proprietary diagnostic models can be stolen with only hard-label queries and a public proxy dataset, and that the cloned model can surpass human expert accuracy. The threat model is realistic (no access to training data, hard labels only, 5,000 queries), and the release of source code supports reproducibility. The defense evaluation is a useful contribution. However, the headline GBC result rests on a proxy dataset from the same research group as the victim model, and the proposed method's benefit is inconsistent across tasks — on COVID-19 (Table S1), QueryWise reduces total and class-wise accuracy relative to the Random baseline. These issues must be resolved before the central claims can be fully credited.

major comments (3)
  1. [§4, Table 1] The GBC victim RadFormer [5] is trained on the GBSU static-image dataset [4], and the proxy is the GBC US videos dataset [6], which originates from the same research group (Basu et al., with Arora as co-author). The authors do not report whether the video frames in [6] come from the same patients or imaging sessions as the GBSU images, nor do they measure the distributional distance between the two datasets. If frames from [6] overlap with, or are near-duplicates of, the GBSU test images, the reported 77.05% DeiT Random+QW accuracy would reflect in-distribution distillation rather than OOD proxy stealing, which would violate the threat model described in Section 2. Please provide patient-level overlap analysis, acquisition-site information, and a control experiment using a proxy from a different institution or public source.
  2. [§4, Table S1] On the COVID-19 task, QueryWise (Random+QW) achieves lower total accuracy (63.87) and lower COVID-19 class accuracy (33.12) than the Random anchor (65.97 and 40.13, respectively). This directly weakens the paper's central claim that QueryWise 'effectively utilizes unlabeled data' to enhance thief performance under low query budgets. The authors should either explain these negative results (e.g., class imbalance, larger OOD gap) or revise the claim to state that the benefit is task-dependent. As presented, the effectiveness claim is only supported for GBC.
  3. [Table 1, §4] The headline comparison to the radiologist (77.05% vs 70.00%) is based on a single run without error bars, confidence intervals, or repeated seeds. The GBC test set size is not reported, and the difference between DeiT Random+QW (77.05%) and DeiT Random (71.31%) is just 5.74 points. Without statistical significance information, the claim that the thief 'outperforms Radiologists' accuracy' is not yet substantiated. Please report mean ± std over at least three runs and state the test-set size.
minor comments (5)
  1. [§4] Typo: 'siginificant' should be 'significant' in the paragraph following Table 1.
  2. [§2] Typo: 'the models's prediction' should be 'the model's prediction'.
  3. [§1] The phrase 'anadditionalteacher model' should be 'an additional teacher model'.
  4. [§3.2, Eqs. (5)-(6)] The indicator function uses the anchor's maximum softmax probability (`σ(q_i^a) > ρ`) in both the teacher and anchor KD loss terms; the text should clarify whether the threshold is intentionally applied to the anchor's confidence only, and how this interacts with the teacher's confidence for samples near the threshold.
  5. [Supplementary Table S2] The data-free Dual Students baseline [7] is compared at a different query budget (500K vs 5K), so the comparison is not apples-to-apples; the authors should note this limitation in the caption or text.

Circularity Check

0 steps flagged · score 2.0 of 10

No circular derivation; central claim is empirical, but the GBC headline result is weakened by same-group data provenance and a possible distributional-leakage confound.

full rationale

The paper's claimed derivation is not circular in the sense of a prediction reducing to a fitted input or a self-citation chain. QueryWise is an empirical training procedure: the student model is trained with a labeled loss combining hard labels from the victim with anchor-model soft labels, and an unlabeled loss combining anchor and EMA-teacher pseudo-labels, then evaluated on held-out test data. The improvement over baselines is measured, not derived from the method's own definition. No equation in the paper defines the reported accuracy as an identity or as a fitted parameter renamed as a prediction. The hyperparameters (alpha, beta, temperature, threshold, EMA momentum) are set once and applied across architectures; they are not fitted to the GBC test split and then reported as a prediction. The comparison to radiologists is also an external benchmark, not an input to training. The main concern is data provenance rather than logical circularity. For the GBC experiment, the victim model RadFormer [5] is trained on GBSU [4], and the proxy is the GBC US videos dataset [6]; citations [4], [5], and [6] share the same research group, with Arora as a co-author. The paper does not establish that the video frames are from different patients or acquisitions than the GBSU test images used in Table 1. If near-duplicates exist, the 77.05% DeiT Random+QW result could reflect distillation on data already close to the victim's distribution rather than a transferable hard-label steal. That is a validity threat to the headline claim, but it is not a circular derivation because the reported accuracy is not constructed to equal the proxy labels, and the paper's method is also tested on an external-domain proxy (COVIDx-US) where QueryWise does not beat Random (63.87 vs 65.97 in Table S1). The defense evaluation switches to a differentiable 'global branch only' version of RadFormer (Table S3 note), but this is disclosed and is an experimental limitation, not a self-justifying argument. Overall, the central derivation is self-contained as an empirical attack study; the same-group dataset usage warrants a lowered confidence in the GBC-specific generalization claim, but it does not make the paper's reasoning circular.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central claim rests on domain assumptions about the victim's output interface, the availability and similarity of a public proxy dataset, and the informativeness of hard labels on out-of-distribution data. The only hand-chosen parameters are the fixed hyperparameters of QueryWise, whose sensitivity is not explored.

free parameters (1)
  • QueryWise hyperparameters (alpha, beta, tau, lambda, rho, m) = alpha=0.4, beta=0.5, tau=1.5, lambda=1, rho=0.95, m=0.999
    Hand-chosen constants for the proposed two-step training; no sensitivity analysis is provided, and the performance improvement depends on these values. They are not fitted per dataset but are chosen by the authors.
assumptions (4)
  • domain assumption The victim model returns only the top-1 hard label to queries.
    Threat model in Section 2; if the victim exposes softmax probabilities, the attack landscape changes.
  • domain assumption The adversary has access to a public unlabeled dataset from the same imaging modality as the victim's training data.
    Section 2 threat model and Section 4 experimental setup; if no such proxy dataset exists, the attack cannot be mounted.
  • domain assumption The victim's hard labels on out-of-distribution proxy data are sufficiently correlated with ground truth to train a useful thief.
    Section 1 (OOD hard labels 'may lack meaningful information') and Section 3; the method's success depends on this correlation, which is not measured directly.
  • domain assumption The evaluation test set (GBSU test, POCUS test) is representative of the victim's deployment distribution.
    Section 4; the thief is tested on the victim's original benchmark, but a real attacker may face a different served population.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Assessing Risk of Stealing Proprietary Models for Medical Imaging Tasks." pith.science (2026). https://pith.science/paper/RRBCHYAD

@misc{pith2026250619464,
  author       = {Pith},
  title        = {Pith review of: Assessing Risk of Stealing Proprietary Models for Medical Imaging Tasks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RRBCHYAD}},
  note         = {Machine review of arXiv:2506.19464}
}
read the original abstract

The success of deep learning in medical imaging applications has led several companies to deploy proprietary models in diagnostic workflows, offering monetized services. Even though model weights are hidden to protect the intellectual property of the service provider, these models are exposed to model stealing (MS) attacks, where adversaries can clone the model's functionality by querying it with a proxy dataset and training a thief model on the acquired predictions. While extensively studied on general vision tasks, the susceptibility of medical imaging models to MS attacks remains inadequately explored. This paper investigates the vulnerability of black-box medical imaging models to MS attacks under realistic conditions where the adversary lacks access to the victim model's training data and operates with limited query budgets. We demonstrate that adversaries can effectively execute MS attacks by using publicly available datasets. To further enhance MS capabilities with limited query budgets, we propose a two-step model stealing approach termed QueryWise. This method capitalizes on unlabeled data obtained from a proxy distribution to train the thief model without incurring additional queries. Evaluation on two medical imaging models for Gallbladder Cancer and COVID-19 classification substantiates the effectiveness of the proposed attack. The source code is available at https://github.com/rajankita/QueryWise.

Figures

Figures reproduced from arXiv: 2506.19464 by the authors.

Figure 1
Figure 1. Model Stealing Attack setup: Victim model is a black-box. An adversary samples images from an unlabeled thief distribution and queries labels from the victim model to train a thief model. machine learning models [17,21,23]. In an MS attack, adversaries aim to repli￾cate the functionality of a private machine learning model that operates as a black box and is accessible only through querying, while its weights are hi… view at source ↗
Figure 2
Figure 2. Overview of QueryWise: First, a subset of the proxy data is queried from the victim model, and an anchor model is trained on the labeled data. Our main contribution lies in the second step, where a student model is trained using both labeled and unlabeled data. On labeled data, the student receives supervision from hard labels obtained from the victim and soft labels generated by the anchor model. On unlabeled data,… view at source ↗
Figure 3
Figure 3. Unlabeled data improves thief accuracy: Comparing predictions of an anchor model with a student model on two GBC test set images, we show the evolution of student model’s confidence for the ground truth (GT) class over the course of training, along with predicted labels. Anchor model’s confidence is also shown for reference. Initially aligned with the anchor, the student gains confidence in the GT class with the use… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 22 canonical work pages

  1. [5]

    Medical Image Analysis83, 102676 (2023)

    Basu, S., Gupta, M., Rana, P., Gupta, P., Arora, C.: Radformer: Transformers with global–local attention for interpretable and accurate gallbladder cancer detection. Medical Image Analysis83, 102676 (2023)

    work page 2023

  2. [4]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Basu, S., Gupta, M., Rana, P., Gupta, P., Arora, C.: Surpassing the human ac- curacy: detecting gallbladder cancer from usg images with curriculum learning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 20886–20896 (2022)

    work page 2022

  3. [6]

    In: International Conference on Medical Image Computing and Computer-Assisted Intervention

    Basu, S., Singla, S., Gupta, M., Rana, P., Gupta, P., Arora, C.: Unsupervised contrastive learning of image representations from ultrasound videos with hard negative mining. In: International Conference on Medical Image Computing and Computer-Assisted Intervention. pp. 423–433. Springer (2022)

    work page 2022

  4. [1]

    https://www.qure.ai/, accessed: 2024-03-02

    Qure.ai. https://www.qure.ai/, accessed: 2024-03-02

    work page 2024

  5. [2]

    https://www.skinvision.com/, accessed: 2024-03-02

    Skinvision. https://www.skinvision.com/, accessed: 2024-03-02

    work page 2024

  6. [3]

    In: International Conference on Medical Image Computing and Computer-Assisted Intervention

    Alkhunaizi, N., Kamzolov, D., Takáč, M., Nandakumar, K.: Suppressing poisoning attacks on federated learning for medical imaging. In: International Conference on Medical Image Computing and Computer-Assisted Intervention. pp. 673–683. Springer (2022)

    work page 2022

  7. [7]

    In: Dual Student Networks for Data-Free Model Stealing

    Beetham, J., Kardan, N., Mian, A., Shah, M.: Dual student networks for data-free model stealing. In: Dual Student Networks for Data-Free Model Stealing. Eleventh International Conference on Learning Representations (ICLR) (2023)

    work page 2023

  8. [8]

    Applied Sciences11(2), 672 (2021)

    Born, J., Wiedemann, N., Cossio, M., Buhre, C., Brändle, G., Leidermann, K., Goulet, J., Aujayeb, A., Moor, M., Rieck, B., et al.: Accelerating detection of lung pathologies with explainable ultrasound image analysis. Applied Sciences11(2), 672 (2021)

    work page 2021

Show all 32 references
  1. [9]

    In: International Con- ference on Learning Representations (2020)

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al.: An image is worth 16x16 words: Transformers for image recognition at scale. In: International Con- ference on Learning Representa...

    2020

  2. [10]

    arXiv:2103.10003 (2021)

    Ebadi, A., Xi, P., MacLean, A., Tremblay, S., Kohli, S., Wong, A.: COVIDx-US - An Open-Access Benchmark Dataset of Ultrasound Imaging Data for AI-Driven COVID-19 Analytics. arXiv:2103.10003 (2021)

    2021 arXiv

  3. [11]

    In: International Conference on Machine Learning

    Furlanello, T., Lipton, Z., Tschannen, M., Itti, L., Anandkumar, A.: Born again neural networks. In: International Conference on Machine Learning. pp. 1607–1616. PMLR (2018)

    2018

  4. [12]

    arXiv preprint arXiv:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  5. [13]

    He,K.,Zhang,X.,Ren,S.,Sun,J.:Deepresiduallearningforimagerecognition.In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 770–778 (2016)

    2016

  6. [14]

    In: NIPS Deep Learning and Representation Learning Workshop (2015)

    Hinton, G., Vinyals, O., Dean, J.: Distilling the knowledge in a neural network. In: NIPS Deep Learning and Representation Learning Workshop (2015)

    2015

  7. [15]

    In: 29th USENIX security symposium (USENIX Security 20)

    Jagielski, M., Carlini, N., Berthelot, D., Kurakin, A., Papernot, N.: High accu- racy and high fidelity extraction of neural networks. In: 29th USENIX security symposium (USENIX Security 20). pp. 1345–1362 (2020)

    2020

  8. [16]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Kariyappa, S., Qureshi, M.K.: Defending against model stealing attacks with adap- tive misinformation. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 770–778 (2020) Assessing Risk of Stealing Proprietary Models for Medical Imaging Tasks 11

    2020

  9. [17]

    In: 2020 IEEE Security and Privacy Workshops (SPW)

    Kumar, R.S.S., Nyström, M., Lambert, J., Marshall, A., Goertzel, M., Comis- soneru, A., Swann, M., Xia, S.: Adversarial machine learning-industry perspectives. In: 2020 IEEE Security and Privacy Workshops (SPW). pp. 69–75. IEEE (2020)

    2020

  10. [18]

    In: International Confer- ence on Machine Learning

    Mazeika, M., Li, B., Forsyth, D.: How to steer your adversary: Targeted and effi- cient model stealing defenses with gradient redirection. In: International Confer- ence on Machine Learning. pp. 15241–15254. PMLR (2022)

    2022

  11. [19]

    In: International Conference on Learning Represen- tations (2020)

    Menon, A.K., Jayasumana, S., Rawat, A.S., Jain, H., Veit, A., Kumar, S.: Long-tail learning via logit adjustment. In: International Conference on Learning Represen- tations (2020)

    2020

  12. [20]

    In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security

    Muñoz-González, L., Biggio, B., Demontis, A., Paudice, A., Wongrassamee, V., Lupu, E.C., Roli, F.: Towards poisoning of deep learning algorithms with back- gradient optimization. In: Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. pp. 27–38 (2017)

    2017

  13. [21]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Orekondy, T., Schiele, B., Fritz, M.: Knockoff nets: Stealing functionality of black- box models. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 4954–4963 (2019)

    2019

  14. [22]

    In: International Conference on Learning Representa- tions (2019)

    Orekondy, T., Schiele, B., Fritz, M.: Prediction poisoning: Towards defenses against dnn model stealing attacks. In: International Conference on Learning Representa- tions (2019)

    2019

  15. [23]

    In: Proceed- ings of the AAAI Conference on Artificial Intelligence

    Pal,S.,Gupta,Y.,Shukla,A.,Kanade,A.,Shevade,S.,Ganapathy,V.:Activethief: Model extraction using active learning and unannotated public data. In: Proceed- ings of the AAAI Conference on Artificial Intelligence. vol. 34, pp. 865–872 (2020)

    2020

  16. [24]

    In: International Conference on Medical Image Computing and Computer-Assisted Intervention

    Pandey, P., Vardhan, A., Chasmai, M., Sur, T., Lall, B.: Adversarially robust prototypical few-shot segmentation with neural-odes. In: International Conference on Medical Image Computing and Computer-Assisted Intervention. pp. 77–87. Springer (2022)

    2022

  17. [25]

    International journal of computer vision115, 211–252 (2015)

    Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al.: Imagenet large scale visual recog- nition challenge. International journal of computer vision115, 211–252 (2015)

    2015

  18. [26]

    Advances in neural information processing systems33, 596–608 (2020)

    Sohn, K., Berthelot, D., Carlini, N., Zhang, Z., Zhang, H., Raffel, C.A., Cubuk, E.D., Kurakin, A., Li, C.L.: Fixmatch: Simplifying semi-supervised learning with consistency and confidence. Advances in neural information processing systems33, 596–608 (2020)

    2020

  19. [27]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., Wojna, Z.: Rethinking the incep- tion architecture for computer vision. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 2818–2826 (2016)

    2016

  20. [28]

    Advances in neural information processing systems30(2017)

    Tarvainen, A., Valpola, H.: Mean teachers are better role models: Weight-averaged consistency targets improve semi-supervised deep learning results. Advances in neural information processing systems30(2017)

    2017

  21. [29]

    In: International conference on machine learning

    Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., Jégou, H.: Training data-efficient image transformers & distillation through attention. In: International conference on machine learning. pp. 10347–10357. PMLR (2021)

    2021

  22. [30]

    In: European Conference on Computer Vision

    Wang, Y., Li, J., Liu, H., Wang, Y., Wu, Y., Huang, F., Ji, R.: Black-box dissector: Towards erasing-based hard-label model stealing attack. In: European Conference on Computer Vision. pp. 192–208. Springer (2022)

    2022

  23. [31]

    Medical Image Analysis69, 101977 (2021)

    Xu, M., Zhang, T., Li, Z., Liu, M., Zhang, D.: Towards evaluating the robustness of deep diagnostic models by adversarial attack. Medical Image Analysis69, 101977 (2021)

    2021

  24. [32]

    Zhang,L.,Lin,G.,Gao,B.,Qin,Z.,Tai,Y.,Zhang,J.:Neuralmodelstealingattack to smart mobile device on intelligent medical platform. Wireless Communications and Mobile Computing2020, 1–10 (2020) Assessing Risk of Stealing Proprietary Models for Medical Imaging Tasks 1 Supplementary...

    2020

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.