% Key papers for Data-free substitute training (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{iclr2018_towards_28472,
  title = {{Towards Reverse-Engineering Black-Box Neural Networks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2018},
  url = {https://iclr.cc/virtual/2018/poster/243},
}

@inproceedings{cvpr2021_data_16799,
  title = {{Data-Free Model Extraction}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{cvpr2020_dast_15337,
  title = {{DaST: Data-Free Substitute Training for Adversarial Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{cvpr2021_maze_17373,
  title = {{MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimation}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{aaai2020_activethief_100259,
  title = {{ActiveThief: Model Extraction Using Active Learning and Unannotated Public Data}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/5432},
}

@inproceedings{aaai2020_model_103869,
  title = {{Model Watermarking for Image Processing Networks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2020},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/6976},
}

@inproceedings{cvpr2020_defending_15389,
  title = {{Defending Against Model Stealing Attacks With Adaptive Misinformation}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2020},
}

@inproceedings{cvpr2019_sensitive_14813,
  title = {{Sensitive-Sample Fingerprinting of Deep Neural Networks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2019},
}

@inproceedings{cvpr2022_towards_20038,
  title = {{Towards Data-Free Model Stealing in a Hard Label Setting}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2022},
}

@inproceedings{cvpr2021_simulating_17900,
  title = {{Simulating Unknown Target Models for Query-Efficient Black-Box Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{cvpr2021_delving_16848,
  title = {{Delving into Data: Effectively Substitute Training for Black-box Attack}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2021},
}

@inproceedings{cvpr2023_reinforcement_22025,
  title = {{Reinforcement Learning-Based Black-Box Model Inversion Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2023},
  url = {https://cvpr.thecvf.com/virtual/2023/poster/22427},
}

@inproceedings{icml2020_transfer_38884,
  title = {{Transfer Learning without Knowing: Reprogramming Black-box Machine Learning Models with Scarce Data and Limited Resources}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2020},
  url = {https://icml.cc/virtual/2020/poster/6376},
}

@inproceedings{cvpr2022_dst_18586,
  title = {{DST: Dynamic Substitute Training for Data-Free Black-Box Attack}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2022},
}

@inproceedings{aaai2023_practical_4395,
  title = {{Practical Disruption of Image Translation Deepfake Networks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2023},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/26693},
}

@inproceedings{neurips2023_trojllm_68611,
  title = {{TrojLLM: A Black-box Trojan Prompt Attack on Large Language Models}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2023},
  url = {https://nips.cc/virtual/2023/poster/71224},
}

@inproceedings{icml2024_stealing_44530,
  title = {{Stealing part of a production language model}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2024},
  url = {https://icml.cc/virtual/2024/poster/33922},
}

@inproceedings{iclr2021_protecting_30212,
  title = {{Protecting DNNs from Theft using an Ensemble of Diverse Models}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2021},
  url = {https://iclr.cc/virtual/2021/poster/2696},
}

@inproceedings{cvpr2025_from_26327,
  title = {{From Head to Tail: Efficient Black-box Model Inversion Attack via Long-tailed Learning}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/33057},
}

@inproceedings{aaai2025_attack_8165,
  title = {{Attack-in-the-Chain: Bootstrapping Large Language Models for Attacks Against Black-Box Neural Ranking Models}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/33332},
}

@inproceedings{aaai2025_exploring_9076,
  title = {{Exploring Query Efficient Data Generation Towards Data-Free Model Stealing in Hard Label Setting}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32048},
}

@inproceedings{aaai2025_huang_9396,
  title = {{HUANG: A Robust Diffusion Model-based Targeted Adversarial Attack Against Deep Hashing Retrieval}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32377},
}

@inproceedings{aaai2025_power_10333,
  title = {{Power of Diversity: Enhancing Data-Free Black-Box Attack with Domain-Augmented Learning}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/32896},
}

@inproceedings{cvpr2025_derivative_25901,
  title = {{Derivative-Free Diffusion Manifold-Constrained Gradient for Unified XAI}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/32385},
}

@inproceedings{cvpr2025_jailbreaking_26662,
  title = {{Jailbreaking the Non-Transferable Barrier via Test-Time Data Disguising}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2025},
  url = {https://cvpr.thecvf.com/virtual/2025/poster/35261},
}

@inproceedings{icml2026_rethinking_52956,
  title = {{Rethinking Forgery Attacks on Semantic Watermarks in Black-Box Settings: A Geometric Distortion Perspective}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=abAtCFbDqc},
}

@inproceedings{icml2026_someone_53090,
  title = {{``Someone Hid It!'': Query-Agnostic Black-Box Attacks on LLM-Based Retrieval}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=bzmt9wJ6uW},
}

@inproceedings{neurips2025_errortrace_75015,
  title = {{ErrorTrace: A Black-Box Traceability Mechanism Based on Model Family Error Space}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=3P3PL7aCXM},
}

@inproceedings{neurips2025_black_75103,
  title = {{Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=4GyTBGBVsB},
}

@inproceedings{neurips2025_bridgepure_76471,
  title = {{BridgePure: Limited Protection Leakage Can Break Black-Box Data Protection}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2025},
  url = {https://openreview.net/forum?id=JebheQvpIb},
}

@inproceedings{iclr2025_unlearn_80848,
  title = {{Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/30919},
}

@inproceedings{iclr2025_a_82326,
  title = {{A Transfer Attack to Image Watermarks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2025},
  url = {https://iclr.cc/virtual/2025/poster/29465},
}

@inproceedings{neurips2026_maskforge_92216,
  title = {{MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2026},
  url = {https://neurips.cc/virtual/2026/poster/155796},
}

@inproceedings{cvpr2026_black_96274,
  title = {{Black-box Membership Inference Attacks on the Pre-training Data of Image-generation Models}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Qi_Black-box_Membership_Inference_Attacks_on_the_Pre-training_Data_of_Image-generation_CVPR_2026_paper.html},
}

@inproceedings{cvpr2026_what_98136,
  title = {{What Your Features Reveal: Data-Efficient Black-Box Feature Inversion Attack for Split DNNs}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2026},
  url = {https://openaccess.thecvf.com/content/CVPR2026/html/Ren_What_Your_Features_Reveal_Data-Efficient_Black-Box_Feature_Inversion_Attack_for_CVPR_2026_paper.html},
}

@inproceedings{aaai2026_removing_106734,
  title = {{Removing Box-Free Watermarks for Image-to-Image Models via Query-Based Reverse Engineering}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/39041},
}

@inproceedings{aaai2026_an_107021,
  title = {{An Information Theoretic Evaluation Metric for Strong Unlearning}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/39373},
}