{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T00:00:53Z","timestamp":1784937653665,"version":"3.55.0"},"reference-count":25,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100006579","name":"Ministry of Industry and Information Technology of the People's Republic of China","doi-asserted-by":"publisher","award":["CEIEC-2020-ZM02-0134"],"award-info":[{"award-number":["CEIEC-2020-ZM02-0134"]}],"id":[{"id":"10.13039\/501100006579","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Neurocomputing"],"published-print":{"date-parts":[[2026,9]]},"DOI":"10.1016\/j.neucom.2026.133816","type":"journal-article","created":{"date-parts":[[2026,5,2]],"date-time":"2026-05-02T05:59:39Z","timestamp":1777701579000},"page":"133816","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["A new model stealing defense based on DNN retraining for decision boundary protection"],"prefix":"10.1016","volume":"693","author":[{"given":"Chenlong","family":"Zhang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Senlin","family":"Luo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8850-8380","authenticated-orcid":false,"given":"Limin","family":"Pan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dujuan","family":"Gu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jun","family":"Yuan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.neucom.2026.133816_bib0005","series-title":"25th USENIX Security Symposium (USENIX Security 16)","first-page":"601","article-title":"Stealing machine learning models via prediction {APIs}","author":"Tram\u00e8r","year":"2016"},{"key":"10.1016\/j.neucom.2026.133816_bib0010","series-title":"2019 IEEE Security and Privacy Workshops (SPW)","first-page":"43","article-title":"Defending against neural network model stealing attacks using deceptive perturbations","author":"Lee","year":"2019"},{"key":"10.1016\/j.neucom.2026.133816_bib0015","doi-asserted-by":"crossref","first-page":"1473","DOI":"10.1109\/TIFS.2023.3244107","article-title":"Categorical inference poisoning: verifiable defense against black-box DNN model stealing without constraining surrogate data and query times","volume":"18","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"21","key":"10.1016\/j.neucom.2026.133816_bib0020","doi-asserted-by":"crossref","first-page":"3500","DOI":"10.3390\/electronics11213500","article-title":"Out-of-distribution (OOD) detection based on deep learning: a review","volume":"11","author":"Cui","year":"2022","journal-title":"Electronics"},{"key":"10.1016\/j.neucom.2026.133816_bib0025","series-title":"Proceedings of the 31st ACM International Conference on Multimedia","first-page":"4178","article-title":"Isolation and induction: training robust deep neural networks against model stealing attacks","author":"Guo","year":"2023"},{"key":"10.1016\/j.neucom.2026.133816_bib0030","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103563","article-title":"Defending against model extraction attacks with OOD feature learning and decision boundary confusion","volume":"136","author":"Liang","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.neucom.2026.133816_bib0035","series-title":"Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security","first-page":"506","article-title":"Practical black-box attacks against machine learning","author":"Papernot","year":"2017"},{"key":"10.1016\/j.neucom.2026.133816_bib0040","author":"Orekondy"},{"key":"10.1016\/j.neucom.2026.133816_bib0045","series-title":"International Conference on Machine Learning","first-page":"15241","article-title":"How to steer your adversary: targeted and efficient model stealing defenses with gradient redirection","author":"Mazeika","year":"2022"},{"key":"10.1016\/j.neucom.2026.133816_bib0050","series-title":"ICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)","first-page":"1","article-title":"APGP: accuracy-preserving generative perturbation for defending against model cloning attacks","author":"Cheng","year":"2023"},{"issue":"2","key":"10.1016\/j.neucom.2026.133816_bib0055","doi-asserted-by":"crossref","first-page":"685","DOI":"10.1109\/TDSC.2023.3261327","article-title":"A comprehensive defense framework against model extraction attacks","volume":"21","author":"Jiang","year":"2023","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"10.1016\/j.neucom.2026.133816_bib0060","author":"Wang"},{"key":"10.1016\/j.neucom.2026.133816_bib0065","doi-asserted-by":"crossref","first-page":"1667","DOI":"10.1109\/TIFS.2023.3246766","article-title":"APMSA: adversarial perturbation against model stealing attacks","volume":"18","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.neucom.2026.133816_bib0070","article-title":"Defending against data-free model extraction by distributionally robust defensive training","volume":"36","author":"Wang","year":"2024","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.neucom.2026.133816_bib0075","series-title":"2020 International Conference on Hardware\/Software Codesign and System Synthesis (CODES+ ISSS)","first-page":"30","article-title":"Model stealing defense with hybrid fuzzy models: work-in-progress","author":"Gong","year":"2020"},{"key":"10.1016\/j.neucom.2026.133816_bib0080","author":"Goodfellow"},{"key":"10.1016\/j.neucom.2026.133816_bib0085","series-title":"Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security","first-page":"1322","article-title":"Model inversion attacks that exploit confidence information and basic countermeasures","author":"Fredrikson","year":"2015"},{"key":"10.1016\/j.neucom.2026.133816_bib0090","author":"Hinton"},{"key":"10.1016\/j.neucom.2026.133816_bib0095","series-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition","first-page":"4954","article-title":"Knockoff nets: stealing functionality of black-box models","author":"Orekondy","year":"2019"},{"key":"10.1016\/j.neucom.2026.133816_bib0100","series-title":"Proceedings of the AAAI Conference on Artificial Intelligence","first-page":"865","article-title":"Activethief: model extraction using active learning and unannotated public data","volume":"vol. 34","author":"Pal","year":"2020"},{"key":"10.1016\/j.neucom.2026.133816_bib0105","series-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition","first-page":"13814","article-title":"Maze: data-free model stealing attack using zeroth-order gradient estimation","author":"Kariyappa","year":"2021"},{"key":"10.1016\/j.neucom.2026.133816_bib0110","series-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition","first-page":"4771","article-title":"Data-free model extraction","author":"Truong","year":"2021"},{"key":"10.1016\/j.neucom.2026.133816_bib0115","series-title":"2019 IEEE European Symposium on Security and Privacy (EuroS&P)","first-page":"512","article-title":"PRADA: protecting against DNN model stealing attacks","author":"Juuti","year":"2019"},{"key":"10.1016\/j.neucom.2026.133816_bib0120","series-title":"Stochastic Control Theory and Stochastic Differential Systems: Proceedings of a Workshop of the \u201eSonderforschungsbereich 72 der Deutschen Forschungsgemeinschaft an Der Universit\u00e4t Bonn \u201cwhich Took Place in January 1979 at Bad Honnef","first-page":"227","article-title":"Introduction to the theory of optimal stopping","author":"Zabczyk","year":"2005"},{"key":"10.1016\/j.neucom.2026.133816_bib0125","series-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition","first-page":"770","article-title":"Defending against model stealing attacks with adaptive misinformation","author":"Kariyappa","year":"2020"}],"container-title":["Neurocomputing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0925231226012130?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0925231226012130?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T23:03:27Z","timestamp":1784934207000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0925231226012130"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9]]},"references-count":25,"alternative-id":["S0925231226012130"],"URL":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133816","relation":{},"ISSN":["0925-2312"],"issn-type":[{"value":"0925-2312","type":"print"}],"subject":[],"published":{"date-parts":[[2026,9]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A new model stealing defense based on DNN retraining for decision boundary protection","name":"articletitle","label":"Article Title"},{"value":"Neurocomputing","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.neucom.2026.133816","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"133816"}}