Research map / Adversarial robustness and security / Black-box and transfer attacks
Defending Against Model Stealing Attacks With Adaptive Misinformation
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Selectively replace predictions for OOD queries with uncorrelated misinformation | Adaptive Misinformation · Flowers-17, KnockoffNets | clone accuracy: 63.6% -> 14.3% | Helped |
| Use adaptive OOD-based misinformation instead of indiscriminate prediction poisoning | Flowers-17, KnockoffNets · Flowers-17, KnockoffNets | defender accuracy: 91.1% -> 91.1% | No clear effect |
| Adaptively inject misinformation only for OOD inputs rather than perturbing every query | Adaptive Misinformation · KnockoffNets across evaluated datasets | clone accuracy | Helped |
| Use adaptive OOD-based misinformation rather than Prediction Poisoning | Adaptive Misinformation · JBDA | security-accuracy trade-off | Mixed |
| Train the clone using argmax labels instead of prediction probabilities | KnockoffNets attacker · KnockoffNets | clone accuracy | Hurt |
| Train the clone using argmax labels instead of prediction probabilities | JBDA attacker · JBDA | clone accuracy | Mixed |
| Use Deceptive Perturbation, which preserves the top-1 class | Model stealing defenses · KnockoffNets and JBDA | clone accuracy | No clear effect |
| Use Prediction Poisoning, which perturbs predictions for all queries | Model stealing defenses · KnockoffNets and JBDA | defender accuracy: 0% | Hurt |
| Use an uncorrelated misinformation model for OOD predictions rather than correlated perturbed predictions | Adaptive Misinformation versus Prediction Poisoning · MNIST, KnockoffNets | clone accuracy | Helped |
| Use adaptive misinformation rather than an undefended model | Adaptive Misinformation · Model stealing attacks | clone accuracy: by up to 40% | Helped |
| Apply adaptive misinformation while preserving correct service for ID inputs | Adaptive Misinformation · Benign in-distribution users | defender accuracy: <0.5% | No clear effect |
| Use the adaptive misinformation defense rather than an undefended model | Defender inference · Classification service | computational overhead: <2× | Hurt |
Closest papers by meaning
- Efficient Model Stealing Defense with Noise Transition Matrix (CVPR 2024 · similarity 0.89)
- Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.87)
- Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting (AAAI 2025 · similarity 0.86)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.85)
- GraphIP–Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It? (NeurIPS 2026 · similarity 0.85)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.