Research map / Adversarial robustness and security / Attacks on text and graphs
Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add MAD targeted posterior perturbations | Knockoff attacker on MNIST · MNIST | stolen-model accuracy: 99.1% -> 69.8% | Hurt |
| Add MAD targeted posterior perturbations | JB-top3 attacker on MNIST · MNIST | stolen-model accuracy: 87.3%→35.7% | Hurt |
| Add MAD targeted posterior perturbations | Knockoff attacker on CUB200 · CUB200 | stolen-model accuracy: 65.1%→41.9% | Hurt |
| Use MAD rather than reverse-sigmoid and random-noise perturbation | Knockoff attacker on MNIST · MNIST | L1 perturbation at attacker accuracy under 80%: 0.95; 0.63× ... ($L_1 \approx$ 1.5) | Helped |
| Use MAD rather than DP-SGD or random-noise defense | Knockoff attacker · All evaluated datasets | defender accuracy when attacker accuracy is below 70%: 39%; 56.4%; 1% | Helped |
| Add the accuracy-preserving argmax constraint (ablation) | MAD · All evaluated datasets | stolen-model accuracy | Mixed |
| Use random simplex extremes instead of selecting the gradient-objective maximizer (ablation) | MAD · Model stealing defense experiments | attacker accuracy | Hurt |
| Replace the surrogate Jacobian with the identity matrix (ablation) | MAD · Model stealing defense experiments | attacker accuracy | Hurt |
| Use gradient information from the surrogate model to target posterior perturbations (ablation) | MAD · Model stealing defense experiments | attacker accuracy | Helped |
| Use a randomly initialized rather than a more-trained surrogate model (ablation) | MAD · Model stealing defense experiments | defense effectiveness | Helped |
| Train the attacker using only the top-1 label rather than posterior probabilities | MAD · Model stealing defense experiments | stolen-model accuracy: 9% absolute accuracy reduction | Hurt |
Closest papers by meaning
- Efficient Model Stealing Defense with Noise Transition Matrix (CVPR 2024 · similarity 0.89)
- Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.87)
- GraphIP–Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It? (NeurIPS 2026 · similarity 0.87)
- Train to Defend: First Defense Against Cryptanalytic Neural Network Parameter Extraction Attacks (NeurIPS 2025 · similarity 0.87)
- HoneypotNet: Backdoor Attacks Against Model Extraction (AAAI 2025 · similarity 0.86)
- Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.