Research map / Adversarial robustness and security / Black-box and transfer attacks
Delving into Data: Effectively Substitute Training for Black-box Attack
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use diverse generated data and AST instead of real training data for substitute training | Black-box substitute training · Four image datasets, target and non-target attacks | ASR | Helped |
| Add adaptive label normalized generation (ablation) | Baseline substitute training · MNIST and CIFAR-100, non-target probability-based | ASR: 29.42 -> 49.18; 8.27 -> 21.38 | Helped |
| Add noise/label reconstruction (ablation) | ALNG substitute training · MNIST and CIFAR-100, non-target probability-based | ASR: 49.18 -> 55.21; 21.38 -> 26.31 | Helped |
| Add inter-class diversity constraint (ablation) | ALNG + N/LR substitute training · MNIST and CIFAR-100, non-target probability-based | ASR: 55.21 -> 62.82; 26.31 -> 31.27 | Helped |
| Add adversarial substitute training using boundary examples (ablation) | DDG substitute training · MNIST and CIFAR-100, non-target probability-based | ASR: 62.82 -> 66.31; 31.27 -> 35.48 | Helped |
| Vary the attack algorithm used to generate AST examples (ablation) | AST · MNIST, probability-based and label-based evaluations | ASR | No clear effect |
| Vary the substitute-model architecture (ablation) | Black-box attack against CIFAR-10 VGG-16 · CIFAR-10, target and non-target attacks | ASR | Mixed |
Closest papers by meaning
- DaST: Data-Free Substitute Training for Adversarial Attacks (CVPR 2020 · similarity 0.91)
- AGS: Affordable and Generalizable Substitute Training for Transferable Adversarial Attack (AAAI 2024 · similarity 0.88)
- Adversarial Machine Unlearning (ICLR 2025 · similarity 0.85)
- Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy (ICLR 2025 · similarity 0.85)
- Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization (ICLR 2024 · similarity 0.85)
- Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting (AAAI 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.