Research map / Adversarial robustness and security / Attacks on text and graphs
Defense Against Model Stealing Based on Account-Aware Distribution Discrepancy
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes D-ADD, a training-free, non-parametric account-aware detector that compares per-account window-augmented feature statistics (class-wise Fréchet distance to MVN reference) against training data, combined with random-label poisoning to defend image classifiers against model stealing.
Problem
Model-stealing attacks clone commercial image classifiers through black-box API queries; query-wise detectors misclassify benign out-of-distribution queries and miss benign-looking attack queries, so timely, utility-preserving defense is hard.
Approach
Exploit account-wise local dependency: keep a sliding window of recent features per account, model each class's features as a multivariate normal, and score the window by a weighted sum of class-wise squared Fréchet distances to the training-set reference statistics; flagged queries receive random labels.
Key results
- ADD achieves perfect detection (AUROC 100%) on MNIST and FashionMNIST in the in-distribution scenario, versus at most 99.7% for the best baseline.
- With D-ADD, KnockoffNets clone accuracy on CIFAR-10 drops from 87.11% undefended to 10.29%, near random chance, while target accuracy drops by 0.00% on CIFAR-10.
- Under adaptive mixing attacks, D-ADD reverses the advantage of mixed-surrogate clones over ID-only clones in all tested settings, e.g. CIFAR-10 mix clone 87.09% undefended vs 35.77% with D-ADD vs id clone 10.64%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply D-ADD poisoning to malicious-user queries | KnockoffNets, DFME, and DFMS · MNIST, FashionMNIST, CIFAR-10, CIFAR-100, and Flowers-17 | clone accuracy: 97.23 -> 12.08; 98.85 -> 10.28; 97.95 -> 10.12 (MNIST) | Hurt |
| Apply D-ADD poisoning to malicious-user queries | D-ADD · CIFAR-100, benign queries | target accuracy: 74.53 -> 74.44 (-0.09) | Hurt |
| Use class-conditional weighted distances rather than equal class weights (ablation) | ADD detector · benign queries with distribution shifts | detection performance | Helped |
| Use class-conditional distances rather than one global distribution distance (ablation) | ADD detector · benign queries with label-distribution inconsistency | AUROC | Helped |
| Mix benign-looking in-distribution queries into the attack stream | D-ADD · MNIST, FashionMNIST, CIFAR-10, CIFAR-100, and Flowers-17 adaptive KnockoffNets | clone accuracy: 98.28 -> 22.45; 98.58 -> 24.83; 63.32 -> 14.11; 76.24 -> 18.58; 87.09 -> 10.64; 89.27 -> 25.88; 51.83 -> 5.29; 61.71 -> | Hurt |
Surprising findings
- Hard-label DFMS attack evades detection-free defenses such as MeCo, but D-ADD still reduces its accuracy comparably to soft-label settings.
Limitations
- Detection and robustness are only guaranteed under certain circumstances, per the authors.
- Relies on the fundamental assumption that benign queries are semantically closer to training data than malicious queries.
- Adaptive attacks that mix in benign-looking samples can reduce detection; smaller windows improve robustness but reduce statistical reliability.
Experimental setup
Datasets: MNIST FashionMNIST CIFAR-10 CIFAR-100 Flower-17 USPS STL-10 Indoor-67
Benchmarks: MNIST FashionMNIST CIFAR-10 CIFAR-100 Flower-17
Metrics: FPR@TPR95 AUROC AUPR Top-1 accuracy
Baselines: Baseline (max softmax confidence) Energy PRADA AM EDM CIP MeCo
Builds on: PRADA Energy-based OOD detection Adversarial Misinformation (AM) EDM MeCo
Closest papers by meaning
- Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks (AAAI 2024 · similarity 0.85)
- Defense against Model Extraction Attack by Bayesian Active Watermarking (ICML 2024 · similarity 0.85)
- Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting (AAAI 2025 · similarity 0.84)
- A Sample-Level Evaluation and Generative Framework for Model Inversion Attacks (AAAI 2025 · similarity 0.84)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.84)
- Toward More Generalized Malicious URL Detection Models (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.