Research map / Adversarial robustness and security / Black-box and transfer attacks
DaST: Data-Free Substitute Training for Adversarial Attacks
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train a substitute with DaST-P instead of using the pre-trained baseline | MNIST black-box attacks · MNIST non-targeted and targeted FGSM, BIM, PGD, and C&W | attack success rate: 10.04%, 10.66%, 16.06%, and 4.01% higher on FGSM, BIM, PGD, and C&W; 11.83%, 19.39, 18.62, 13.48% higher on targeted FGS | Helped |
| Train a substitute with DaST-P instead of using the pre-trained baseline | CIFAR-10 black-box attacks · CIFAR-10 non-targeted and targeted FGSM, BIM, PGD, and C&W | attack success rate | Mixed |
| Use a DaST-trained substitute rather than the pre-trained baseline | Microsoft Azure online MNIST model · Microsoft Azure non-targeted and targeted FGSM, BIM, and PGD | attack success rate: 20.25%, 32.10%, 37.74% higher on non-targeted FGSM, BIM, PGD; 30.47%, 51.84%, 46.60% higher on targeted FGSM, BIM, PGD | Helped |
| Use label-only DaST-L instead of probability-only DaST-P | Microsoft Azure online MNIST model · Microsoft Azure non-targeted and targeted attacks | attack success rate: 98.21%, 98.35%, 96.97%; 43.99%, 71.15%, 65.91% | Helped |
| Use probability-only DaST-P rather than label-only DaST-L | DaST on MNIST · MNIST attacks | test accuracy: 97.82% and 83.95% | Helped |
| Increase substitute architecture capacity from small or medium to large (ablation) | DaST-P on MNIST · MNIST FGSM, BIM, and PGD attacks | attack success rate: 69.76; 96.36; 53.99 | Helped |
| Use a small substitute architecture instead of medium or large (ablation) | DaST-P on MNIST · MNIST C&W attacks | attack success rate: 30.61; 24.86 | Helped |
| Use VGG-13 instead of ResNet-18 or ResNet-50 as the substitute (ablation) | DaST-P on CIFAR-10 · CIFAR-10 BIM, PGD, and C&W non-targeted; FGSM, BIM, PGD, and C&W targeted | attack success rate: 93.13, 56.14, 56.80; 18.27, 62.23, 41.48, 33.65 | Helped |
| Use ResNet-50 instead of VGG-13 or ResNet-18 as the substitute (ablation) | DaST-P on CIFAR-10 · CIFAR-10 non-targeted FGSM | attack success rate: 39.63 | Helped |
| Use a simpler substitute architecture rather than a larger one (ablation) | DaST-P on CIFAR-10 · CIFAR-10 adversarial attacks | attack success rate | Mixed |
| Use DaST-P rather than DaST-L | DaST on CIFAR-10 · CIFAR-10 attacks | attack success rate | Helped |
| Add label-control loss and label-conditioned generator branches (ablation) | DaST data-free substitute training · Not separately quantified | attack success rate | No clear effect |
Closest papers by meaning
- Delving into Data: Effectively Substitute Training for Black-box Attack (CVPR 2021 · similarity 0.91)
- DST: Dynamic Substitute Training for Data-Free Black-Box Attack (CVPR 2022 · similarity 0.88)
- AGS: Affordable and Generalizable Substitute Training for Transferable Adversarial Attack (AAAI 2024 · similarity 0.88)
- DataFreeShield: Defending Adversarial Attacks without Training Data (ICML 2024 · similarity 0.85)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.84)
- Data-Free Universal Attack by Exploiting the Intrinsic Vulnerability of Deep Models (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.