Research map / Label-efficient and robust learning / Recognition and long-tail
Knockoff Nets: Stealing Functionality of Black-Box Models
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Query random images from an independent large image distribution rather than victim-training images | Knockoff Nets · Open-world image classification across Caltech256, CUBS200, Indoor67, and Diabetic5 | top-1 accuracy relative to victim: 0.81-0.96× | Helped |
| Use adaptive querying with certainty reward in the closed world | Knockoff Nets · CUBS200, D² | query budget to reach 68.3% accuracy: 6× quicker; B=60k; B=10k | Helped |
| Add adaptive sampling to the random-query approach | Knockoff Nets · Closed-world and open-world image classification | top-1 accuracy: up to 4.5% | Mixed |
| Use certainty reward instead of certainty plus diversity and loss rewards (ablation) | Adaptive Knockoff Nets · Closed-world image classification | sample efficiency | Helped |
| Add diversity and loss rewards alongside certainty (ablation) | Adaptive Knockoff Nets · Open-world CUBS200 with OpenImages | sample efficiency: 1.5× quicker | Helped |
| Use uncertainty reward instead of certainty (ablation) | Adaptive Knockoff Nets · Closed-world image classification | sample efficiency | Hurt |
| Return only argmax predictions rather than full posteriors (ablation) | Knockoff Nets · Victim with K=256 | accuracy relative to original performance: 0.76-0.84× | Hurt |
| Retain top-k posterior probabilities rather than only argmax (ablation) | Knockoff Nets · Victim with K=256 | accuracy relative to original performance: 0.91× at k=2; 0.96× at k=5 | Helped |
| Round posterior outputs to r decimals (ablation) | Knockoff Nets · Victim with K=256 | accuracy relative to original performance: 0.99× at r=2 | No clear effect |
| Use a more complex knockoff architecture (ablation) | Knockoff Nets · Image classification with ResNet-34 or VGG-16 victims | top-1 accuracy | Helped |
| Use a hierarchical adaptive action space rather than a flat bandit (ablation) | Adaptive Knockoff Nets · CUBS200, D² | query efficiency to reach 50% accuracy: 2× | Helped |
| Use OpenImages-Faces rather than CelebA as the query image source | Real-world facial-characteristics API knockoff · API test sets | accuracy relative to API: 0.82× | Helped |
Closest papers by meaning
- Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.88)
- Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealing (CVPR 2024 · similarity 0.87)
- Community Forensics: Using Thousands of Generators to Train Fake Image Detectors (CVPR 2025 · similarity 0.86)
- Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting (AAAI 2025 · similarity 0.86)
- Where's the Liability in the Generative Era? Recovery-based Black-Box Detection of AI-Generated Content (CVPR 2025 · similarity 0.86)
- Defense Against Model Stealing Based on Account-Aware Distribution Discrepancy (AAAI 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.