Research map / Adversarial robustness and security / Attacks on text and graphs

Towards Model Extraction Attacks in GAN-Based Image Translation via Domain Shift Mitigation

AAAI 2024 · Adversarial robustness and security › Attacks on text and graphs · approach: Membership inference and inversion · 5 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a model extraction attack on GAN-based image-to-image translation that mitigates domain shift via a wavelet high-frequency regularizer and a GAN-specific sharpness-aware minimization optimizer.

Problem

Model extraction attacks on image-to-image translation (I2IT) APIs are underexplored, and standard query-selection methods from classifier MEA do not transfer because the attacker's query distribution differs from the victim's training data (domain shift).

Approach

Instead of closing the query-training distribution gap, mitigate the effect of domain shift on the surrogate directly: add a wavelet regularization term penalizing L1 distance on high-frequency DWT subbands between victim and attack outputs, and train the surrogate GAN with sharpness-aware minimization to find flatter minima.

Key results

• On horse2zebra, the attack reaches FID/KID 82.63/2.55 for Rcapability versus 115.09/5.59 for Artist-Copy.
• On 4x super-resolution, PSNR for Rcapability rises to 29.73 from 27.67 for Artist-Copy, with LPIPS dropping from 0.177 to 0.145.
• Ablation on horse2zebra shows wavelet regularization and SAM each improve over the baseline, and combining them gives the best FID/KID.

Measured effects reported in the paper

Surprising findings

• Their attack with half the queries (2-3k) outperforms the baseline with 4-5k queries, suggesting that domain shift mitigation can matter more than raw query count.

Limitations

• Only evaluated against Artist-Copy as baseline, the only known MEA for GAN-based I2IT.
• Real-world commercial API code is withheld per ethics statement, limiting reproducibility.
• Only Pix2Pix and CycleGAN backbones tested; no dedicated defense evaluated.

Experimental setup

Datasets: horse2zebra photo2vangogh DIV2K Flickr2K OutdoorSceneTraining Animal10 Landscape Anime FFHQ

Benchmarks: horse2zebra photo2vangogh 4x anime super-resolution face2cartoon landscape2cartoon

Metrics: FID KID PSNR LPIPS

Baselines: Artist-Copy

Builds on: Pix2Pix CycleGAN SAM Artist-Copy

Closest papers by meaning

• Attention! Your Vision Language Model Could Be Maliciously Manipulated (NeurIPS 2025 · similarity 0.85)
• Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks (CVPR 2025 · similarity 0.85)
• Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models (CVPR 2025 · similarity 0.85)
• PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.84)
• HQA-VLAttack: Towards High Quality Adversarial Attack on Vision-Language Pre-Trained Models (NeurIPS 2025 · similarity 0.84)
• Pixel Is Not a Barrier: An Effective Evasion Attack for Pixel-Domain Diffusion Models (AAAI 2025 · similarity 0.84)