{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,20]],"date-time":"2025-11-20T13:00:11Z","timestamp":1763643611038,"version":"3.37.3"},"reference-count":71,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,8,22]],"date-time":"2022-08-22T00:00:00Z","timestamp":1661126400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,8,22]],"date-time":"2022-08-22T00:00:00Z","timestamp":1661126400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100007140","name":"Synopsys","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100007140","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,8,22]]},"DOI":"10.1109\/pst55820.2022.9851981","type":"proceedings-article","created":{"date-parts":[[2022,8,25]],"date-time":"2022-08-25T18:46:39Z","timestamp":1661453199000},"page":"1-10","source":"Crossref","is-referenced-by-count":4,"title":["Careful What You Wish For: on the Extraction of Adversarially Trained Models"],"prefix":"10.1109","author":[{"given":"Kacem","family":"Khaled","sequence":"first","affiliation":[{"name":"Polytechnique Montréal,Département GIGL,Montreal,Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Gabriela","family":"Nicolescu","sequence":"additional","affiliation":[{"name":"Polytechnique Montréal,Département GIGL,Montreal,Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Felipe Gohring","family":"De Magalhaes","sequence":"additional","affiliation":[{"name":"Polytechnique Montréal,Département GIGL,Montreal,Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2011.5995496"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.220"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1355"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"article-title":"Intriguing properties of neural networks","year":"2013","author":"Szegedy","key":"ref7"},{"key":"ref8","first-page":"601","article-title":"Stealing machine learning models via prediction apis","volume-title":"25th ({USENIX} Security Symposium ({USENIX Security 16)","author":"Tram\u00e8r"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"article-title":"Thieves on sesame street! Model extraction of bert-based apis","year":"2019","author":"Krishna","key":"ref11"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3338498.3358646"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00474"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5432"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2022.3147508"},{"key":"ref16","first-page":"1345","article-title":"High accuracy and high fidelity extraction of neural networks","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Jagielski"},{"article-title":"Es attack: Model stealing against deep neural networks without data hurdles","year":"2020","author":"Yuan","key":"ref17"},{"article-title":"Maze: Data-free model stealing attack using zeroth-order gradient estimation","year":"2020","author":"Kariyappa","key":"ref18"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/WACV48630.2021.00333"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274740"},{"article-title":"Defending against machine learning model stealing attacks using deceptive perturbations","year":"2018","author":"Lee","key":"ref21"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00085"},{"article-title":"Prediction poisoning: Towards defenses against dnn model stealing attacks","volume-title":"International Conference on Learning Representations","author":"Orekondy","key":"ref24"},{"article-title":"Towards the science of security and privacy in machine learning","year":"2016","author":"Papernot","key":"ref25"},{"article-title":"Towards deep learning models resistant to adversarial attacks","year":"2017","author":"Madry","key":"ref26"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354211"},{"volume-title":"Deep Learning.","year":"2016","author":"Goodfellow","key":"ref28"},{"volume-title":"Artificial Intelligence: A Modern Approach","year":"2009","author":"Russell","key":"ref29"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/1128817.1128824"},{"article-title":"Poisoning attacks against support vector machines","year":"2012","author":"Biggio","key":"ref32"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2016.36"},{"article-title":"Defense against the dark arts: An overview of adversarial example security research and future research directions","year":"2018","author":"Goodfellow","key":"ref35"},{"key":"ref36","first-page":"1","article-title":"Exploiting machine learning to subvert your spam filter","volume":"8","author":"Nelson","year":"2008","journal-title":"LEET"},{"key":"ref37","first-page":"1689","article-title":"Is feature selection secure against training data poisoning?","volume-title":"International Conference on Machine Learning","author":"Xiao"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/1644893.1644895"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00057"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2016.7795300"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274696"},{"key":"ref46","first-page":"2003","article-title":"Cache telepathy: Leveraging shared resource attacks to learn DNN architectures","author":"Yan","year":"2018"},{"article-title":"Security analysis of deep neural networks operating in the presence of cache side-channel attacks","year":"2018","author":"Hong","key":"ref47"},{"key":"ref48","first-page":"515","article-title":"CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel","volume-title":"Proceedings of the 28th USENIX Security Symposium","author":"Batina"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3373376.3378460"},{"key":"ref50","first-page":"1","article-title":"How to own nas in your spare time","author":"Hong","year":"2020"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3411495.3421356"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TCSII.2020.2973007"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/1081870.1081950"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-015-0816-y"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-020-01316-z"},{"article-title":"Thieves on sesame street! model extraction of bert-based apis","year":"2019","author":"Krishna","key":"ref57"},{"article-title":"Bert: Pre-training of deep bidirectional transformers for language understanding","year":"2018","author":"Devlin","key":"ref58"},{"article-title":"Robustness and diversity seeking data-free knowledge distillation","year":"2020","author":"Han","key":"ref59"},{"article-title":"Explaining and harnessing adversarial examples","year":"2014","author":"Goodfellow","key":"ref60"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref62","article-title":"Mnist handwritten digit database","volume-title":"ATT Labs","volume":"2","author":"LeCun","year":"2010"},{"article-title":"Learning multiple layers of features from tiny images","year":"2009","author":"Krizhevsky","key":"ref63"},{"article-title":"Reading digits in natural images with unsupervised feature learning","year":"2011","author":"Netzer","key":"ref64"},{"article-title":"Pytorch mnist example","year":"2020","author":"Chintala","key":"ref65"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-62144-5_4"},{"article-title":"Very deep convolutional networks for large-scale image recognition","year":"2014","author":"Simonyan","key":"ref67"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"article-title":"Experiment tracking with weights and biases","year":"2020","author":"Biewald","key":"ref69"},{"article-title":"Dawn: Dynamic adversarial watermarking of neural networks","year":"2019","author":"Szyller","key":"ref70"},{"article-title":"Entangled watermarks as a defense against model extraction","year":"2020","author":"Jia","key":"ref71"}],"event":{"name":"2022 19th Annual International Conference on Privacy, Security & Trust (PST)","start":{"date-parts":[[2022,8,22]]},"location":"Fredericton, NB, Canada","end":{"date-parts":[[2022,8,24]]}},"container-title":["2022 19th Annual International Conference on Privacy, Security & Trust (PST)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9851848\/9851959\/09851981.pdf?arnumber=9851981","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,24]],"date-time":"2024-01-24T03:46:11Z","timestamp":1706067971000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9851981\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,8,22]]},"references-count":71,"URL":"https:\/\/doi.org\/10.1109\/pst55820.2022.9851981","relation":{},"subject":[],"published":{"date-parts":[[2022,8,22]]}}}