Research map / Image generation / Fast diffusion sampling
Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealing
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SPSG, a model stealing method that uses superpixel-level sample gradient queries and a gradient purification step to extract more information from each real sample, outperforming data-free and data-driven stealing baselines.
Problem
Model stealing of image classifiers under a limited budget of real samples is hard: pixel-level sample gradient estimation needs huge query volumes and is detected by defenses like PRADA, and sample gradient estimates have high variance.
Approach
Estimate sample gradients at superpixel granularity by perturbing whole superpixel regions with forward differences, filter and normalize the resulting gradients to remove variance, and train the proxy to match the victim's superpixel-averaged pixel gradients alongside output matching.
Key results
- On CUB-200 with 20k real samples (probability queries), SPSG reaches 61.21% accuracy and 67.48% agreement versus 56.39% accuracy and 58.44% agreement for the second-best method.
- SPSG uses roughly 25% of the queries of the most query-efficient data-free baseline, and evades PRADA detection that flags pixel-level finite-difference queries.
- On a real-world Microsoft Custom Vision victim (Oxford Flowers), SPSG with 30k real samples reaches 79.41% proxy accuracy versus 75.24% for the next best method.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use SPSG instead of the strongest reported baseline | model stealing on CUB-200-2011 with 20k real samples · CUB-200-2011 (20k, probability) | accuracy: 56.39 -> 61.21 | Helped |
| use SPSG instead of the strongest reported baseline | model stealing on CUB-200-2011 with 20k real samples · CUB-200-2011 (20k, probability) | agreement: 58.44 -> 67.48 | Helped |
| use SPSG instead of the strongest reported baseline | model stealing on Indoor Scenes with 20k real samples · Indoor Scenes (20k, probability) | accuracy: 67.18 -> 70.27 | Helped |
| use SPSG instead of the strongest reported baseline | model stealing on Caltech256 with 20k real samples · Caltech256 (20k, probability) | accuracy: 56.74 -> 63.21 | Helped |
| use SPSG instead of the strongest reported baseline | model stealing on Diabetic5 with 20k real samples · Diabetic5 (20k, probability) | accuracy: 40.16 -> 41.27 | Helped |
| use SPSG instead of the strongest reported baseline | model stealing of the Microsoft Custom Vision model · Oxford 102 Flowers test set (30k real samples) | accuracy: 75.24% -> 79.41% | Helped |
| use SPSG instead of the strongest reported baseline | hard-label model stealing on CUB-200-2011 with 20k real samples · CUB-200-2011 (hard-label, 20k) | accuracy: 30.97 -> 34.12 | Helped |
| replace quickshift with felzenszwalb segmentation (ablation) | SPSG · CUB-200-2011 (probability) | accuracy: 55.47% -> 59.33% | Helped |
| replace quickshift with SLIC segmentation (ablation) | SPSG · CUB-200-2011 (probability) | accuracy: 55.47% -> 58.09% | Helped |
| replace quickshift with grid segmentation (ablation) | SPSG · CUB-200-2011 (probability) | accuracy: 55.47% -> 19.09% | Hurt |
| replace quickshift with felzenszwalb segmentation (ablation) | SPSG · CUB-200-2011 (hard-label) | accuracy: 25.42% -> 28.93% | Helped |
| replace quickshift with SLIC segmentation (ablation) | SPSG · CUB-200-2011 (hard-label) | accuracy: 25.42% -> 27.72% | Helped |
Surprising findings
- Grid segmentation performs very poorly for superpixel gradient stealing (about 9.7% accuracy on CUB-200 hard-label), far below quickshift, indicating image-aware segmentation matters.
Limitations
- Query volume is higher than data-driven baselines in some settings (authors note they do not minimize query volume for data-driven comparisons).
- Requires a pool of real samples, so it is not data-free.
- Segmentation choice strongly affects results; grid segmentation fails.
Experimental setup
Datasets: CUB-200-2011 Indoor Scenes Caltech256 Diabetic Retinopathy ILSVRC-2012 SUN NABirds Oxford 102 Flowers
Benchmarks: CUB-200-2011 Indoor Scenes Caltech256 Diabetic Retinopathy Oxford 102 Flowers
Metrics: test accuracy agreement query volume attack success rate (FGSM, BIM, PGD)
Baselines: ZSDB3KD DFMS EDFBA DS DFME Knockoff ActiveThief Black-Box Dissector InverseNet
Builds on: Knockoff PRADA finite difference gradient estimation quickshift superpixels
Closest papers by meaning
- Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.86)
- Defense against Model Extraction Attack by Bayesian Active Watermarking (ICML 2024 · similarity 0.84)
- Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting (AAAI 2025 · similarity 0.84)
- Community Forensics: Using Thousands of Generators to Train Fake Image Detectors (CVPR 2025 · similarity 0.84)
- TraceEvader: Making DeepFakes More Untraceable via Evading the Forgery Model Attribution (AAAI 2024 · similarity 0.84)
- Queries, Representation & Detection: The Next 100 Model Fingerprinting Schemes (AAAI 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.