Research map / Adversarial robustness and security / Attacks on text and graphs
Data-Free Hard-Label Robustness Stealing Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DFHL-RS, a data-free hard-label attack that steals both accuracy and adversarial robustness of an adversarially trained MLaaS model by querying with generator-synthesized High-Entropy Examples.
Problem
Model stealing under a hard-label, data-free setting where the attacker has no proxy data and cannot obtain soft labels, and existing attacks only steal accuracy rather than adversarial robustness.
Approach
Decouples generator training (guided by the clone model as surrogate, with label smoothing, augmentation, and a class-diversity loss, storing batches in a memory bank) from clone training, which queries the target with High-Entropy Examples (maximizing prediction entropy without an l_inf constraint) and fits hard labels.
Key results
- On CIFAR-10, the clone model reaches 77.86% clean accuracy and 39.51% AutoAttack robust accuracy, only 4.71% and 8.40% below the target model.
- On CIFAR-100, DFHL-RS achieves 51.94% clean and 19.30% AA accuracy, outperforming BEST, which uses a proxy dataset.
- Transfer attacks using the clone as surrogate achieve higher attack success rates than MAZE, DFME, and DFMS-HL at each epsilon tested.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use HEE query samples instead of AT-generated examples | Robustness stealing on CIFAR-10 with MobileNetV2 clone · CIFAR-10 | Clean Acc: 34.42 -> 50.12 | Helped |
| Use HEE query samples instead of AT-generated examples | Robustness stealing on CIFAR-10 with MobileNetV2 clone · CIFAR-10 | Robust Acc: 22.64 -> 18.98 | Hurt |
| Use HEE query samples instead of UE examples | Robustness stealing on CIFAR-10 with MobileNetV2 clone · CIFAR-10 | Clean Acc: 48.84 -> 50.12 | Helped |
| Use HEE query samples instead of UE examples | Robustness stealing on CIFAR-10 with MobileNetV2 clone · CIFAR-10 | Robust Acc: 14.86 -> 18.98 | Helped |
| Add the entropy objective to HEE construction (ablation) | HEE on CIFAR-10 with MobileNetV2 clone · CIFAR-10 | Robust Acc: 18.26 -> 18.98 | Helped |
| Remove the l-infinity constraint from HEE construction (ablation) | HEE on CIFAR-10 with MobileNetV2 clone · CIFAR-10 | Robust Acc: 15.90 -> 18.98 | Helped |
| Add diversity loss (ablation) | DFHL-RS · CIFAR-10 | AA: 38.87 -> 39.51 | Helped |
| Add label smoothing (ablation) | DFHL-RS · CIFAR-10 | AA: 38.42 -> 39.51 | Helped |
| Add standard augmentation in the first stage (ablation) | DFHL-RS · CIFAR-10 | AA: 36.80 -> 39.51 | Helped |
| Add strong augmentation in the second stage (ablation) | DFHL-RS · CIFAR-10 | AA: 38.66 -> 39.51 | Helped |
| Reduce the batch size from 256 to 128 (ablation) | DFHL-RS · CIFAR-10 | AA: 39.51 -> 36.42 | Hurt |
| Reduce epochs from 300 to 150 (ablation) | DFHL-RS · CIFAR-10 | AA: 39.51 -> 34.73 | Hurt |
Surprising findings
- Direct adversarial training on hard-labeled synthetic queries (Data-Free AT) performs far worse than the other variants, with clean accuracy of 36.15% on CIFAR-10.
Limitations
- Query budget (38.4M on CIFAR-10) is large compared with some baselines, e.g., DFME and DS at 20M.
- Clone architecture mismatch (MobileNetV2) causes a noticeable drop in attack performance.
- Evaluation limited to CIFAR-10 and CIFAR-100 with ResNet18/WideResNet targets.
Experimental setup
Datasets: CIFAR-10 CIFAR-100
Benchmarks: CIFAR-10 CIFAR-100
Metrics: clean accuracy robust accuracy (FGSM, PGD-20, PGD-100, CW-100, AutoAttack) attack success rate for transfer attacks
Baselines: BEST Data-Free AT Data-Free AE Data-Free UE MAZE DFME DFMS-HL DS
Builds on: Adversarial Robustness Distillation Uncertain Examples DFME DFMS-HL BEST
Closest papers by meaning
- SAME: Sample Reconstruction against Model Extraction Attacks (AAAI 2024 · similarity 0.85)
- Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.84)
- Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting (AAAI 2025 · similarity 0.84)
- Model Inversion Robustness: Can Transfer Learning Help? (CVPR 2024 · similarity 0.84)
- Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks (ICLR 2025 · similarity 0.83)
- Defense Against Model Stealing Based on Account-Aware Distribution Discrepancy (AAAI 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.