{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,18]],"date-time":"2025-12-18T14:30:25Z","timestamp":1766068225782,"version":"3.45.0"},"reference-count":63,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","license":[{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,11,1]],"date-time":"2025-11-01T00:00:00Z","timestamp":1761955200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["92270123","62372122"],"award-info":[{"award-number":["92270123","62372122"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Research Grants Council, Hong Kong SAR, China","award":["15226221","15225921","15208923"],"award-info":[{"award-number":["15226221","15225921","15208923"]}]},{"DOI":"10.13039\/501100010428","name":"Innovation and Technology Fund","doi-asserted-by":"publisher","award":["ITS-140-23FP"],"award-info":[{"award-number":["ITS-140-23FP"]}],"id":[{"id":"10.13039\/501100010428","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2025,11]]},"DOI":"10.1109\/tdsc.2025.3588857","type":"journal-article","created":{"date-parts":[[2025,7,15]],"date-time":"2025-07-15T17:44:56Z","timestamp":1752601496000},"page":"6622-6635","source":"Crossref","is-referenced-by-count":1,"title":["Unlocking High-Fidelity Learning: Towards Neuron-Grained Model Extraction"],"prefix":"10.1109","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4205-677X","authenticated-orcid":false,"given":"Yaxin","family":"Xiao","sequence":"first","affiliation":[{"name":"Department of Electrical and Electronic Engineering, The Hong Kong Polytechnic University, Hong Kong"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9008-2112","authenticated-orcid":false,"given":"Haibo","family":"Hu","sequence":"additional","affiliation":[{"name":"Department of Electrical and Electronic Engineering and the Research Centre for Privacy and Security Technologies in Future Smart Systems, The Hong Kong Polytechnic University, Hong Kong"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1547-2847","authenticated-orcid":false,"given":"Qingqing","family":"Ye","sequence":"additional","affiliation":[{"name":"Department of Electrical and Electronic Engineering, The Hong Kong Polytechnic University, Hong Kong"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0123-1364","authenticated-orcid":false,"given":"Li","family":"Tang","sequence":"additional","affiliation":[{"name":"Department of Software Engineering, Yunnan University, Kunming, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-1418-9537","authenticated-orcid":false,"given":"Zi","family":"Liang","sequence":"additional","affiliation":[{"name":"Department of Electrical and Electronic Engineering, The Hong Kong Polytechnic University, Hong Kong"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1224-9885","authenticated-orcid":false,"given":"Huadi","family":"Zheng","sequence":"additional","affiliation":[{"name":"Huawei Technologies Company, Ltd., Shenzhen, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01360"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00474"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2004.31"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2025.103046"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2025.3526063"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2025.3542761"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"article-title":"Explaining and harnessing adversarial examples","year":"2014","author":"Goodfellow","key":"ref12"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2022.3230825"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref15","first-page":"1309","article-title":"Exploring connections between active learning and model extraction","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Chandrasekaran"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5432"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"article-title":"Learning multiple layers of features from tiny images","year":"2009","author":"Krizhevsky","key":"ref18"},{"key":"ref19","first-page":"302","article-title":"Dynamics of on-line gradient descent learning for multilayer neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Saad"},{"key":"ref20","first-page":"9470","article-title":"Student specialization in deep rectified networks with finite width and input dimension","volume-title":"Proc. 37th Int. Conf. Mach. Learn.","author":"Tian"},{"key":"ref21","first-page":"4577","article-title":"A local convergence theory for mildly over-parameterized two-layer neural network","volume-title":"Proc. Conf. Learn. Theory","author":"Zhou"},{"article-title":"Provable methods for training neural networks with sparse connectivity","year":"2015","author":"Sedghi","key":"ref22"},{"key":"ref23","first-page":"574","article-title":"Sliced score matching: A scalable approach to density and score estimation","volume-title":"Proc. 36th Conf. Uncertainty Artif. Intell.","author":"Song"},{"key":"ref24","first-page":"15241","article-title":"How to steer your adversary: Targeted and efficient model stealing defenses with gradient redirection","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Mazeika"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00085"},{"key":"ref26","first-page":"5305","article-title":"MODELGUARD: Information-theoretic defense against model extraction attacks","volume-title":"Proc. 33rd USENIX Secur. Symp.","author":"Tang"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29959-0_4"},{"article-title":"Dual student networks for data-free model stealing","year":"2023","author":"Beetham","key":"ref28"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3657002"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref33","first-page":"10203","article-title":"MExMI: Pool-based active model extraction crossover membership inference","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Xiao"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i8.26150"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3320609"},{"article-title":"Stateful detection of model extraction attacks","year":"2021","author":"Pal","key":"ref36"},{"key":"ref37","first-page":"1937","article-title":"Entangled watermarks as a defense against model extraction","volume-title":"Proc. 30th USENIX Secur. Symp.","author":"Jia"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00099"},{"key":"ref39","first-page":"75286","article-title":"Towards stable backdoor purification through feature shift tuning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Min"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10351028"},{"key":"ref41","article-title":"Deep learning using rectified linear units (ReLU)","author":"Agarap","year":"2018","journal-title":"arXiv:1803.08375"},{"issue":"1","key":"ref42","first-page":"3","article-title":"Rectifier nonlinearities improve neural network acoustic models","volume-title":"Proc. 30th Int. Conf. Mach. Learn.","volume":"30","author":"Maas"},{"key":"ref43","first-page":"1345","article-title":"High accuracy and high fidelity extraction of neural networks","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Jagielski"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.123"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2022\/604"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TSP.2020.2993153"},{"key":"ref48","first-page":"4140","article-title":"Recovery guarantees for one-hidden-layer neural networks","volume-title":"Proc. 34th Int. Conf. Mach. Learn.","author":"Zhong"},{"key":"ref49","first-page":"1524","article-title":"Learning one-hidden-layer ReLU networks via gradient descent","volume-title":"Proc. 22nd Int. Conf. Artif. Intell. Statist.","author":"Zhang"},{"key":"ref50","first-page":"36","article-title":"Learning overcomplete latent variable models through tensor methods","volume-title":"Proc. 28th Conf. Learn. Theory","author":"Anandkumar"},{"article-title":"Beating the perils of non-convexity: Guaranteed training of neural networks using tensor methods","year":"2015","author":"Janzamin","key":"ref51"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1214\/lnms\/1196283797"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.5555\/3104322.3104374"},{"key":"ref54","first-page":"37.1","article-title":"Exact recovery of sparsely-used dictionaries","volume-title":"Proc. 25th Annu. Conf. Learn. Theory","author":"Spielman"},{"key":"ref55","first-page":"1091","article-title":"Sparse activity and sparse connectivity in supervised learning","volume":"14","author":"Thom","year":"2013","journal-title":"J. Mach. Learn. Res."},{"key":"ref56","first-page":"695","article-title":"Estimation of non-normalized statistical models by score matching","volume":"6","author":"Hyv\u00e4rinen","year":"2005","journal-title":"J. Mach. Learn. Res."},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/5.726791"},{"article-title":"The MNIST database of handwritten digits","year":"1998","author":"LeCun","key":"ref58"},{"key":"ref59","article-title":"Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms","author":"Xiao","year":"2017","journal-title":"arXiv:1708.07747"},{"issue":"5","key":"ref61","first-page":"7","article-title":"Reading digits in natural images with unsupervised feature learning","volume-title":"Proc. NIPS Workshop Deep Learn. Unsupervised Feature Learn.","volume":"2011","author":"Netzer"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/p17-1052"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/1060745.1060764"},{"key":"ref64","first-page":"142","article-title":"Learning word vectors for sentiment analysis","volume-title":"Proc. 49th Annu. Meeting Assoc. Comput. Linguistics: Hum. Lang. Technol.","author":"Maas"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2020.2987299"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23119"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/34.58871"},{"key":"ref69","first-page":"2003","article-title":"Cache Telepathy: Leveraging shared resource attacks to learn DNN architectures","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Yan"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/11242243\/11080031.pdf?arnumber=11080031","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,14]],"date-time":"2025-11-14T21:00:39Z","timestamp":1763154039000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11080031\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11]]},"references-count":63,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2025.3588857","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"type":"print","value":"1545-5971"},{"type":"electronic","value":"1941-0018"},{"type":"electronic","value":"2160-9209"}],"subject":[],"published":{"date-parts":[[2025,11]]}}}