Towards Few-Call Model Stealing via Active Self-Paced Knowledge Distillation and Diffusion-Based Image Generation
Diffusion models showcased strong capabilities in image synthesis, being used in many computer vision tasks with great success. To this end, we propose to explore a new use case, namely to copy black-box classification models without having access to the original training data, the architecture, and the weights of the model, \ie~the model is only exposed through an inference API. More specifically, we can only observe the (soft or hard) labels for some image samples passed as input to the model. Furthermore, we consider an additional constraint limiting the number of model calls, mostly focusing our research on few-call model stealing. In order to solve the model extraction task given the applied restrictions, we propose the following framework. As training data, we create a synthetic data set (called proxy data set) by leveraging the ability of diffusion models to generate realistic and diverse images. Given a maximum number of allowed API calls, we pass the respective number of samples through the black-box model to collect labels. Finally, we distill the knowledge of the black-box teacher (attacked model) into a student model (copy of the attacked model), harnessing both labeled and unlabeled data generated by the diffusion model. We employ a novel active self-paced learning framework to make the most of the proxy data during distillation. Our empirical results on two data sets confirm the superiority of our framework over two state-of-the-art methods in the few-call model extraction scenario.
Code (0)
등록된 구현이 없습니다.
Tasks
Image GenerationKnowledge DistillationModel extractionMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Model Stealing Attack against Graph Classification with Authenticity, Uncertainty and Diversity
Recent research demonstrates that GNNs are vulnerable to the model stealing attack, a nefarious endeavor geared towards duplicating the target model via query permissions. However, they mainly focus on node classificatio…
Active LearningDiversityGraph ClassificationNode ClassificationTask-Focused Consolidation with Spaced Recall: Making Neural Networks Learn like College Students
Deep neural networks often suffer from a critical limitation known as catastrophic forgetting, where performance on past tasks degrades after learning new ones. This paper introduces a novel continual learning approach i…
Continual LearningStolen Subwords: Importance of Vocabularies for Machine Translation Model Stealing
In learning-based functionality stealing, the attacker is trying to build a local model based on the victim's outputs. The attacker has to make choices regarding the local model's architecture, optimization method and, s…
Knowledge DistillationMachine TranslationTranslationReward-Machine-Guided, Self-Paced Reinforcement Learning
Self-paced reinforcement learning (RL) aims to improve the data efficiency of learning by automatically creating sequences, namely curricula, of probability distributions over contexts. However, existing techniques for s…
reinforcement-learningReinforcement LearningReinforcement Learning (RL)Self-paced ensemble learning for speech and audio classification
Combining multiple machine learning models into an ensemble is known to provide superior performance levels compared to the individual components forming the ensemble. This is because models can complement each other in …
Audio ClassificationClassificationEnsemble LearningGeneral Classification+1