{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T15:57:36Z","timestamp":1759334256436,"version":"build-2065373602"},"reference-count":84,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100005015","name":"Alibaba Cloud through the Research Talent Program with South China University of Technology","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100005015","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2024YFE0105400"],"award-info":[{"award-number":["2024YFE0105400"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372186","62472179"],"award-info":[{"award-number":["62372186","62472179"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003453","name":"Natural Science Foundation of Guangdong Province, China","doi-asserted-by":"publisher","award":["2023A1515012841"],"award-info":[{"award-number":["2023A1515012841"]}],"id":[{"id":"10.13039\/501100003453","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities, China","doi-asserted-by":"publisher","award":["x2js\/D2240750"],"award-info":[{"award-number":["x2js\/D2240750"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Singapore Ministry of Education Academic Research Fund Tier 1","award":["A-8000981-00-00"],"award-info":[{"award-number":["A-8000981-00-00"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3607269","type":"journal-article","created":{"date-parts":[[2025,9,8]],"date-time":"2025-09-08T17:43:39Z","timestamp":1757353419000},"page":"9892-9904","source":"Crossref","is-referenced-by-count":0,"title":["Model Extraction for Image Denoising Networks"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3524-9749","authenticated-orcid":false,"given":"Huan","family":"Teng","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, South China University of Technology, Guangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2564-7703","authenticated-orcid":false,"given":"Yuhui","family":"Quan","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, South China University of Technology, Guangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7183-3155","authenticated-orcid":false,"given":"Yong","family":"Xu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, South China University of Technology, Guangzhou, China"}]},{"given":"Jun","family":"Huang","sequence":"additional","affiliation":[{"name":"Platform of AI, Alibaba Cloud, Hangzhou, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1674-6056","authenticated-orcid":false,"given":"Hui","family":"Ji","sequence":"additional","affiliation":[{"name":"Department of Mathematics, National University of Singapore, Queenstown, Singapore"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.5555\/3241094.3241142"},{"key":"ref2","first-page":"1309","article-title":"Exploring connections between active learning and model extraction","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX Secur.)","author":"Chandrasekaran"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref4","article-title":"A framework for the extraction of deep neural networks by leveraging public data","author":"Pal","year":"2019","journal-title":"arXiv:1905.09165"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01360"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00474"},{"key":"ref7","first-page":"1345","article-title":"High accuracy and high fidelity extraction of neural networks","volume-title":"Proc. 29th USENIX Conf. Secur. Symp.","author":"Jagielski"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP51992.2021.00024"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3052973.3053009"},{"key":"ref10","article-title":"Adversarial attacks on neural network policies","author":"Huang","year":"2017","journal-title":"arXiv:1702.02284"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3324772"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813677"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/336"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3384841"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-44137-0_32"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2020.107639"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00564"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20071-7_2"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.00710"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2010.161"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW.2017.150"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2016.2631888"},{"key":"ref25","article-title":"LAION-400M: Open dataset of CLIP-filtered 400 million image-text pairs","author":"Schuhmann","year":"2021","journal-title":"arXiv:2111.02114"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1503.02531"},{"key":"ref28","article-title":"Data-free knowledge distillation for deep neural networks","author":"Lopes","year":"2017","journal-title":"arXiv:1710.07535"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v35i3.16356"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.3301742"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3128572.3140448"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00874"},{"key":"ref33","first-page":"9551","article-title":"Zero-shot knowledge transfer via adversarial belief matching","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Micaelli"},{"key":"ref34","article-title":"Data-free adversarial distillation","author":"Fang","year":"2019","journal-title":"arXiv:1912.11006"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i6.20613"},{"key":"ref36","article-title":"Contrastive model inversion for data-free knowledge distillation","author":"Fang","year":"2021","journal-title":"arXiv:2105.08584"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02324"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00752"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00776"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02252"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.00574"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3178240"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3237371"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3293418"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3359820"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i01.5432"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3320609"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489592"},{"key":"ref49","article-title":"Thief, beware of what get you there: Towards understanding model extraction attack","author":"Zhang","year":"2021","journal-title":"arXiv:2104.05921"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670267"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2019.00020"},{"key":"ref52","article-title":"Prediction poisoning: Towards defenses against DNN model stealing attacks","author":"Orekondy","year":"2019","journal-title":"arXiv:1906.10908"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00085"},{"article-title":"Protecting DNNs from theft using an ensemble of diverse models","volume-title":"Proc. Int. Conf. Learn. Representations","author":"Kariyappa","key":"ref54"},{"key":"ref55","first-page":"5305","article-title":"ModelGuard: Information-theoretic defense against model extraction attacks","volume-title":"Proc. 33rd USENIX Secur. Symp. (USENIX Secur. 24)","author":"Tang"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3274694.3274740"},{"key":"ref57","article-title":"Stateful detection of model extraction attacks","author":"Pal","year":"2021","journal-title":"arXiv:2107.05166"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/3474369.3486863"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3261327"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.2991378"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3437526"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.01222"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.02683"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1137\/120880811"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01258-8_10"},{"key":"ref66","first-page":"1439","article-title":"Finite sample convergence rates of zero-order stochastic optimization methods","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"25","author":"Wibisono"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/s10208-015-9296-2"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3665451.3665533"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3460231.3474275"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3579856.3590336"},{"key":"ref71","first-page":"623","article-title":"Defending against data-free model extraction by distributionally robust defensive training","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Wang"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/s00041-008-9045-x"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24574-4_28"},{"key":"ref74","first-page":"1126","article-title":"Model-agnostic meta-learning for fast adaptation of deep networks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Finn"},{"key":"ref75","article-title":"On first-order meta-learning algorithms","author":"Nichol","year":"2018","journal-title":"arXiv:1803.02999"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00182"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-021-06045-z"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.294"},{"key":"ref79","article-title":"Real-world noisy image denoising: A new benchmark","author":"Xu","year":"2018","journal-title":"arXiv:1804.02603"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1016\/j.jvcir.2018.01.012"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2017.2662206"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1007\/11787006_1"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2001.937655"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00984"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11153562.pdf?arnumber=11153562","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,30]],"date-time":"2025-09-30T13:17:26Z","timestamp":1759238246000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11153562\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":84,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3607269","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}