Research map / Adversarial robustness and security / Attacks on text and graphs
Efficient Model Stealing Defense with Noise Transition Matrix
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes EMMA, a defense against knockoff-style model stealing that multiplies victim posteriors by a noise transition matrix optimized via bi-level optimization, degrading attacker cloning while preserving defender accuracy.
Problem
Model stealing attacks replicate DNN functionality through prediction APIs; existing defenses either add heavy inference overhead, rely on idealized attacker assumptions, or are retroactive (watermarking).
Approach
Reuse the noise transition matrix from noisy-label learning as a cheap linear perturbation of predicted posteriors, optimized with a bi-level scheme that keeps the defender's top-1 label while making the surrogate attacker's cloning equivalent to learning from noisy labels.
Key results
- On CIFAR100→CIFAR10 at a 1% defender accuracy drop, EMMA reduces attacker accuracy to 61.79% vs 84.17% for Random and 78.88% for MIN-IP (best among baselines at that budget).
- On CIFAR10→CIFAR100 at 1% budget, EMMA attacker accuracy is 28.01% vs 42.33% for MIN-IP.
- Optimized transition matrix yields lower attacker accuracy than a uniform matrix with the same noise rate (e.g., 32.41% vs 71.43% on CIFAR100→CIFAR10) at similar defender accuracy.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use the optimized transition matrix instead of a uniform matrix (ablation) | EMMA · CIFAR100 → CIFAR10 | attacker accuracy: 71.43±2.26 -> 32.41±7.54 | Helped |
| use the optimized transition matrix instead of a uniform matrix (ablation) | EMMA · CIFAR10 → CIFAR100 | attacker accuracy: 35.67±3.44 -> 15.65±0.72 | Helped |
| use the optimized transition matrix instead of a uniform matrix (ablation) | EMMA · Caltech256 → CUB200 | attacker accuracy: 30.15±0.21 -> 18.25±0.43 | Helped |
Surprising findings
- Ablation shows the optimized matrix can be transferred across attack scenarios (DA→KL) and still retains considerable defense.
Limitations
- Accuracy-preserving top-1 perfect fidelity not achieved; defender accuracy drops by budget (e.g., ~1-5%).
- Evaluated only on image classification with ResNet backbones and three datasets.
- Bi-level optimization is approximate (alternating one-step approximation) and the problem is NP-hard in general.
Experimental setup
Datasets: CIFAR10 CIFAR100 CUB200 Caltech256 ImageNet-1K
Benchmarks: CIFAR10 CIFAR100 CUB200
Metrics: attacker accuracy on defender test set at accuracy-drop budg defender accuracy
Baselines: Random AM MAD NASTY GARD2 MIN-IP
Builds on: noise transition matrix loss correction MIN-IP GARD2 knockoff nets
Closest papers by meaning
- Defending Against Model Stealing Attacks With Adaptive Misinformation (CVPR 2020 · similarity 0.89)
- Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks (ICLR 2020 · similarity 0.89)
- Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.88)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.85)
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.85)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.