Research map / Adversarial robustness and security / Black-box and transfer attacks
Towards Data-Free Model Stealing in a Hard Label Setting
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DFMS-HL instead of ZSDB3KD with synthetic samples | CIFAR-10 model stealing · CIFAR-10, synthetic | clone accuracy (%): 59.46 -> 67.03 | Helped |
| Use DFMS-HL instead of ZSDB3KD with CIFAR-100 proxy classes | CIFAR-10 model stealing · CIFAR-100 (40C) and CIFAR-100 (10C) | clone accuracy (%): 59.46 -> 74.27; 59.46 -> 70.57 | Helped |
| Use DFMS-HL in place of soft-label DFME with synthetic data | CIFAR-10 model stealing with ResNet-34 victim · CIFAR-10, synthetic | clone accuracy (%): 88.10 -> 84.51 | Hurt |
| Add soft-label access to the proposed method | DFMS-HL on CIFAR-10 · CIFAR-10, synthetic and CIFAR-100 proxy | clone accuracy (%): 84.51 -> 91.24; 92.06 -> 93.96 | Helped |
| Use CIFAR-10 proxy data rather than synthetic data | DFMS-HL with CIFAR-100 victim · CIFAR-100 | clone accuracy (%): 43.56 -> 72.83 | Helped |
| Add class-diversity loss to generator training (ablation) | DFMS-HL · CIFAR-10, synthetic | clone accuracy (%): 6% | Helped |
| Vary the class-diversity coefficient across the tested range (ablation) | DFMS-HL · CIFAR-10, CIFAR-100 (10C) | clone accuracy (%): 69.29; 69.59; 69.42; 69.66; 69.54; 69.13 | No clear effect |
| Disable discriminator updates (ablation) | DFMS-HL · CIFAR-10, synthetic | clone accuracy (%): 67.03 -> 57.06 | Hurt |
| Train the generator and clone less frequently by increasing their iteration gap (ablation) | DFMS-HL · CIFAR-10, synthetic | clone accuracy (%) | Hurt |
| Combine large and small overlapping synthetic shapes rather than using either variant alone (ablation) | DFMS-HL · CIFAR-100, synthetic | clone accuracy (%): 80.34; 56.30 -> 85.92 | Helped |
| Use grayscale rather than colored synthetic images (ablation) | DFMS-HL · CIFAR-10, synthetic | clone accuracy (%): 65.84 -> 67.03 | Helped |
| Use a deeper GoogleNet clone rather than a shallower AlexNet-half clone (ablation) | DFMS-HL · CIFAR-10, CIFAR-100 (10C) | clone accuracy (%): 62.64 -> 84.50 | Helped |
Closest papers by meaning
- Dual Student Networks for Data-Free Model Stealing (ICLR 2023 · similarity 0.91)
- Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting (AAAI 2025 · similarity 0.90)
- Data-Free Hard-Label Robustness Stealing Attack (AAAI 2024 · similarity 0.89)
- Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.89)
- Efficient Model Stealing Defense with Noise Transition Matrix (CVPR 2024 · similarity 0.88)
- Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealing (CVPR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.