{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,15]],"date-time":"2026-05-15T06:07:24Z","timestamp":1778825244003,"version":"3.51.4"},"reference-count":48,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100008111","name":"Hainan Provincial Department of Science and Technology","doi-asserted-by":"publisher","award":["ZDYF2022GXJS007"],"award-info":[{"award-number":["ZDYF2022GXJS007"]}],"id":[{"id":"10.13039\/501100008111","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100008111","name":"Hainan Provincial Department of Science and Technology","doi-asserted-by":"publisher","award":["ZDYF2022GXJS010"],"award-info":[{"award-number":["ZDYF2022GXJS010"]}],"id":[{"id":"10.13039\/501100008111","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,8]]},"DOI":"10.1016\/j.cose.2026.104919","type":"journal-article","created":{"date-parts":[[2026,4,16]],"date-time":"2026-04-16T15:03:34Z","timestamp":1776351814000},"page":"104919","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["BioGuard: Malicious sample free defense method for biometric classifiers against model extraction attacks"],"prefix":"10.1016","volume":"167","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-3093-1351","authenticated-orcid":false,"given":"Ziting","family":"Ren","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yucong","family":"Duan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9762-8838","authenticated-orcid":false,"given":"Qi","family":"Qi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"78","reference":[{"issue":"4","key":"10.1016\/j.cose.2026.104919_b1","doi-asserted-by":"crossref","first-page":"1527","DOI":"10.1109\/TR.2021.3105697","article-title":"SNIFF: reverse engineering of neural networks with fault attacks","volume":"71","author":"Breier","year":"2022","journal-title":"IEEE Trans. Reliab."},{"key":"10.1016\/j.cose.2026.104919_b2","series-title":"ASIA CCS \u201921: ACM Asia Conference on Computer and Communications Security, Virtual Event, Hong Kong, June 7-11, 2021","first-page":"14","article-title":"Ipguard: Protecting intellectual property of deep neural networks via fingerprinting the classification boundary","author":"Cao","year":"2021"},{"key":"10.1016\/j.cose.2026.104919_b3","author":"CASIA BIT","year":"2025"},{"key":"10.1016\/j.cose.2026.104919_b4","author":"CelebA dataset website","year":"2025"},{"key":"10.1016\/j.cose.2026.104919_b5","series-title":"IEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024","first-page":"3311","article-title":"DeepTheft: Stealing DNN model architectures through power side channel","author":"Gao","year":"2024"},{"key":"10.1016\/j.cose.2026.104919_b6","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103586","article-title":"Robust biometric scheme against replay attacks using one-time biometric templates","volume":"137","author":"Gernot","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.104919_b7","doi-asserted-by":"crossref","first-page":"531","DOI":"10.1109\/TIFS.2024.3515792","article-title":"Augmenting model extraction attacks against disruption-based defenses","volume":"20","author":"Gong","year":"2025","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.cose.2026.104919_b8","series-title":"Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, la, USA, November 28 - December 9, 2022","article-title":"Are you stealing my model? Sample correlation for fingerprinting deep neural networks","author":"Guan","year":"2022"},{"key":"10.1016\/j.cose.2026.104919_b9","doi-asserted-by":"crossref","first-page":"249","DOI":"10.1109\/TIFS.2024.3516566","article-title":"Joint identity verification and pose alignment for partial fingerprints","volume":"20","author":"Guan","year":"2025","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.cose.2026.104919_b10","series-title":"30th USENIX Security Symposium, USENIX Security 2021, August 11-13, 2021","first-page":"1901","article-title":"DRMI: a dataset reduction technology based on mutual information for black-box attacks","author":"He","year":"2021"},{"key":"10.1016\/j.cose.2026.104919_b11","series-title":"IEEE\/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2024, Seattle, WA, USA, June 16-22, 2024","first-page":"277","article-title":"One-class face anti-spoofing via spoof cue map-guided feature learning","author":"Huang","year":"2024"},{"key":"10.1016\/j.cose.2026.104919_b12","series-title":"33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024","article-title":"FaceObfuscator: Defending deep learning-based privacy attacks with gradient descent-resistant features in face recognition","author":"Jin","year":"2024"},{"key":"10.1016\/j.cose.2026.104919_b13","series-title":"IEEE European Symposium on Security and Privacy, EuroS&P 2019, Stockholm, Sweden, June 17-19, 2019","first-page":"512","article-title":"PRADA: protecting against DNN model stealing attacks","author":"Juuti","year":"2019"},{"key":"10.1016\/j.cose.2026.104919_b14","series-title":"IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, Virtual, June 19-25, 2021","first-page":"13814","article-title":"MAZE: data-free model stealing attack using zeroth-order gradient estimation","author":"Kariyappa","year":"2021"},{"key":"10.1016\/j.cose.2026.104919_b15","series-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"10.1016\/j.cose.2026.104919_b16","series-title":"The MNIST database of handwritten digits","author":"LeCun","year":"1998"},{"key":"10.1016\/j.cose.2026.104919_b17","series-title":"IEEE\/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023","first-page":"11578","article-title":"Rethinking out-of-distribution (OOD) detection: Masked image modeling is all you need","author":"Li","year":"2023"},{"issue":"4","key":"10.1016\/j.cose.2026.104919_b18","doi-asserted-by":"crossref","first-page":"4521","DOI":"10.1109\/TPAMI.2022.3195956","article-title":"Fedipr: Ownership verification for federated deep neural network models","volume":"45","author":"Li","year":"2023","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"10.1016\/j.cose.2026.104919_b19","series-title":"Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence, IJCAI 2024, Jeju, South Korea, August 3-9, 2024","first-page":"431","article-title":"Protecting object detection models from model extraction attack via feature space coverage","author":"Li","year":"2024"},{"key":"10.1016\/j.cose.2026.104919_b20","series-title":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security, ASIA CCS 2023, Melbourne, VIC, Australia, July 10-14, 2023","first-page":"913","article-title":"QUDA: query-limited data-free model extraction","author":"Lin","year":"2023"},{"key":"10.1016\/j.cose.2026.104919_b21","doi-asserted-by":"crossref","unstructured":"Liu, Z., Luo, P., Wang, X., Tang, X., 2015. Deep Learning Face Attributes in the Wild. In: Proceedings of International Conference on Computer Vision. ICCV.","DOI":"10.1109\/ICCV.2015.425"},{"issue":"2","key":"10.1016\/j.cose.2026.104919_b22","doi-asserted-by":"crossref","first-page":"47:1","DOI":"10.1145\/3691626","article-title":"A survey of text watermarking in the era of large language models","volume":"57","author":"Liu","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.cose.2026.104919_b23","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2024.110915","article-title":"RADAP: a robust and adaptive defense against diverse adversarial patches on face recognition","volume":"157","author":"Liu","year":"2025","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.cose.2026.104919_b24","series-title":"European Conference on Computer Vision","first-page":"549","article-title":"Frequency domain model augmentation for adversarial attack","author":"Long","year":"2022"},{"key":"10.1016\/j.cose.2026.104919_b25","series-title":"Computer Vision - ECCV 2022 - 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part IV","first-page":"549","article-title":"Frequency domain model augmentation for adversarial attack","volume":"vol. 13664","author":"Long","year":"2022"},{"issue":"12","key":"10.1016\/j.cose.2026.104919_b26","doi-asserted-by":"crossref","first-page":"310:1","DOI":"10.1145\/3664596","article-title":"An overview of privacy-enhancing technologies in biometric recognition","volume":"56","author":"Melzi","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.cose.2026.104919_b27","doi-asserted-by":"crossref","DOI":"10.1109\/TIFS.2025.3553806","article-title":"Adversarial attack and reliable defense based on frequency domain feature enhancement for automatic modulation classification","author":"Meng","year":"2025","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.cose.2026.104919_b28","author":"Open-source community LiblibAI model infringement report","year":"2025"},{"issue":"3","key":"10.1016\/j.cose.2026.104919_b29","doi-asserted-by":"crossref","first-page":"374","DOI":"10.1109\/TBIOM.2024.3391759","article-title":"Template inversion attack using synthetic face images against real face recognition systems","volume":"6","author":"Otroshi-Shahreza","year":"2024","journal-title":"IEEE Trans. Biom. Behav. Identity Sci."},{"key":"10.1016\/j.cose.2026.104919_b30","first-page":"865","article-title":"ActiveThief: Model extraction using active learning and unannotated public data","author":"Pal","year":"2020"},{"key":"10.1016\/j.cose.2026.104919_b31","series-title":"43rd IEEE Symposium on Security and Privacy, SP 2022, San Francisco, CA, USA, May 22-26, 2022","first-page":"1157","article-title":"DeepSteal: Advanced model extractions leveraging efficient weight stealing in memories","author":"Rakin","year":"2022"},{"key":"10.1016\/j.cose.2026.104919_b32","first-page":"9614","article-title":"Disguide: Disagreement-guided data-free model extraction","author":"Rosenthal","year":"2023"},{"key":"10.1016\/j.cose.2026.104919_b33","doi-asserted-by":"crossref","first-page":"1429","DOI":"10.1109\/TIFS.2023.3320609","article-title":"HODA: hardness-oriented detection of model extraction attacks","volume":"19","author":"Sadeghzadeh","year":"2024","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.cose.2026.104919_b34","series-title":"Proceedings of the 39th IEEE\/ACM International Conference on Automated Software Engineering, ASE 2024, Sacramento, CA, USA, October 27 - November 1, 2024","first-page":"1645","article-title":"Constructing surrogate models in machine learning using combinatorial testing and active learning","author":"Shree","year":"2024"},{"key":"10.1016\/j.cose.2026.104919_b35","series-title":"Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024","article-title":"CemiFace: Center-based semi-hard synthetic face generation for face recognition","author":"Sun","year":"2024"},{"issue":"9","key":"10.1016\/j.cose.2026.104919_b36","first-page":"223:1","article-title":"Deep learning for iris recognition: A survey","volume":"56","author":"Thanh","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.cose.2026.104919_b37","series-title":"IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, Virtual, June 19-25, 2021","first-page":"4771","article-title":"Data-free model extraction","author":"Truong","year":"2021"},{"key":"10.1016\/j.cose.2026.104919_b38","first-page":"3371","article-title":"Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion","volume":"11","author":"Vincent","year":"2010","journal-title":"J. Mach. Learn. Res."},{"key":"10.1016\/j.cose.2026.104919_b39","series-title":"Advances in Neural Information Processing Systems 36: Annual Conference on Neural Information Processing Systems 2023, NeurIPS 2023, New Orleans, la, USA, December 10 - 16, 2023","article-title":"Defending against data-free model extraction by distributionally robust defensive training","author":"Wang","year":"2023"},{"key":"10.1016\/j.cose.2026.104919_b40","series-title":"Forty-First International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024","article-title":"Defense against model extraction attack by Bayesian active watermarking","author":"Wang","year":"2024"},{"issue":"2","key":"10.1016\/j.cose.2026.104919_b41","doi-asserted-by":"crossref","first-page":"800","DOI":"10.1109\/TCYB.2024.3514838","article-title":"Invisible DNN watermarking against model extraction attack","volume":"55","author":"Xi","year":"2025","journal-title":"IEEE Trans. Cybern."},{"key":"10.1016\/j.cose.2026.104919_b42","series-title":"Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms","author":"Xiao","year":"2017"},{"key":"10.1016\/j.cose.2026.104919_b43","first-page":"19974","article-title":"SAME: sample reconstruction against model extraction attacks","author":"Xie","year":"2024"},{"key":"10.1016\/j.cose.2026.104919_b44","series-title":"Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024","article-title":"Id3: Identity-preserving-yet-diversified diffusion models for synthetic face recognition","author":"Xu","year":"2024"},{"key":"10.1016\/j.cose.2026.104919_b45","series-title":"Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC, Canada, December 10 - 15, 2024","article-title":"United we stand, divided we fall: Fingerprinting deep neural networks via adversarial trajectories","author":"Xu","year":"2024"},{"issue":"4","key":"10.1016\/j.cose.2026.104919_b46","doi-asserted-by":"crossref","first-page":"105:1","DOI":"10.1145\/3705295","article-title":"Racial bias within face recognition: A survey","volume":"57","author":"Yucer","year":"2025","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.cose.2026.104919_b47","doi-asserted-by":"crossref","first-page":"1667","DOI":"10.1109\/TIFS.2023.3246766","article-title":"APMSA: adversarial perturbation against model stealing attacks","volume":"18","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.cose.2026.104919_b48","series-title":"33rd USENIX Security Symposium, USENIX Security 2024, Philadelphia, PA, USA, August 14-16, 2024","article-title":"Unveiling the secrets without data: Can graph neural networks be exploited through data-free model extraction attacks?","author":"Zhuang","year":"2024"}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826000957?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826000957?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,5,15]],"date-time":"2026-05-15T05:11:31Z","timestamp":1778821891000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826000957"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8]]},"references-count":48,"alternative-id":["S0167404826000957"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.104919","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,8]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"BioGuard: Malicious sample free defense method for biometric classifiers against model extraction attacks","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.104919","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"104919"}}