{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,24]],"date-time":"2026-10-24T17:04:29Z","timestamp":1792861469922,"version":"4.5.0"},"reference-count":148,"publisher":"Association for Computing Machinery (ACM)","issue":"14s","license":[{"start":{"date-parts":[[2023,7,17]],"date-time":"2023-07-17T00:00:00Z","timestamp":1689552000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"European Union\u2019s Horizon 2020","award":["826078"],"award-info":[{"award-number":["826078"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2023,12,31]]},"abstract":"<jats:p>Machine-Learning-as-a-Service (MLaaS) has become a widespread paradigm, making even the most complex Machine Learning models available for clients via, e.g., a pay-per-query principle. This allows users to avoid time-consuming processes of data collection, hyperparameter tuning, and model training. However, by giving their customers access to the (predictions of their) models, MLaaS providers endanger their intellectual property such as sensitive training data, optimised hyperparameters, or learned model parameters. In some cases, adversaries can create a copy of the model with (almost) identical behaviour using the the prediction labels only. While many variants of this attack have been described, only scattered defence strategies that address isolated threats have been proposed. To arrive at a comprehensive understanding why these attacks are successful and how they could be holistically defended against, a thorough systematisation of the field of model stealing is necessary. We address this by categorising and comparing model stealing attacks, assessing their performance, and exploring corresponding defence techniques in different settings. We propose a taxonomy for attack and defence approaches and provide guidelines on how to select the right attack or defence strategy based on the goal and available resources. Finally, we analyse which defences are rendered less effective by current attack strategies.<\/jats:p>","DOI":"10.1145\/3595292","type":"journal-article","created":{"date-parts":[[2023,4,29]],"date-time":"2023-04-29T07:13:39Z","timestamp":1682752419000},"page":"1-41","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":143,"title":["I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences"],"prefix":"10.1145","volume":"55","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6990-4321","authenticated-orcid":false,"given":"Daryna","family":"Oliynyk","sequence":"first","affiliation":[{"name":"SBA Research, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0424-5999","authenticated-orcid":false,"given":"Rudolf","family":"Mayer","sequence":"additional","affiliation":[{"name":"SBA Research &amp; Vienna University of Technology, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9272-6225","authenticated-orcid":false,"given":"Andreas","family":"Rauber","sequence":"additional","affiliation":[{"name":"Vienna University of Technology, Austria"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2023,7,17]]},"reference":[{"key":"e_1_3_2_2_2","volume-title":"USENIX Security Symposium","author":"Tram\u00e8r Florian","year":"2016","unstructured":"Florian Tram\u00e8r, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction APIs. In USENIX Security Symposium. USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity16\/technical-sessions\/presentation\/tramer."},{"key":"e_1_3_2_3_2","volume-title":"ACM Asia Conference on Computer and Communications Security (ASIA CCS)","author":"Papernot Nicolas","year":"2017","unstructured":"Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami. 2017. Practical black-box attacks against machine learning. In ACM Asia Conference on Computer and Communications Security (ASIA CCS). ACM. DOI:10.1145\/3052973.3053009"},{"key":"e_1_3_2_4_2","volume-title":"IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Orekondy Tribhuvanesh","year":"2019","unstructured":"Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019. Knockoff nets: Stealing functionality of black-box models. In IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE. DOI:10.1109\/CVPR.2019.00509"},{"key":"e_1_3_2_5_2","doi-asserted-by":"publisher","DOI":"10.1109\/THS.2017.7943475"},{"key":"e_1_3_2_6_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Krishna Kalpesh","year":"2020","unstructured":"Kalpesh Krishna, Gaurav Singh Tomar, Ankur Parikh, Nicolas Papernot, and Mohit Iyyer. 2020. Thieves of Sesame Street: Model extraction on BERT-based APIs. In International Conference on Learning Representations (ICLR). Retrieved from https:\/\/iclr.cc\/virtual_2020\/poster_Byl5NREFDr.html."},{"key":"e_1_3_2_7_2","unstructured":"Vahid Behzadan and William Hsu. 2019. Adversarial Exploitation of Policy Imitation. Retrieved from http:\/\/arxiv.org\/abs\/1906.01121."},{"key":"e_1_3_2_8_2","volume-title":"USENIX Security Symposium","author":"Jagielski Matthew","year":"2020","unstructured":"Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, and Nicolas Papernot. 2020. High accuracy and high fidelity extraction of neural networks. In USENIX Security Symposium. USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/jagielski."},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"e_1_3_2_10_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Orekondy Tribhuvanesh","year":"2020","unstructured":"Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2020. Prediction poisoning: Towards defenses against DNN model stealing attacks. In International Conference on Learning Representations (ICLR). Retrieved from https:\/\/iclr.cc\/virtual_2020\/poster_SyevYxHtDB.html."},{"key":"e_1_3_2_11_2","volume-title":"International Joint Conference on Neural Networks (IJCNN)","author":"Correia-Silva Jacson Rodrigues","year":"2018","unstructured":"Jacson Rodrigues Correia-Silva, Rodrigo F. Berriel, Claudine Badue, Alberto F. de Souza, and Thiago Oliveira-Santos. 2018. Copycat CNN: Stealing knowledge by persuading confession with random non-labeled data. In International Joint Conference on Neural Networks (IJCNN). IEEE. DOI:10.1109\/IJCNN.2018.8489592"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-62144-5_4"},{"key":"e_1_3_2_13_2","volume-title":"International Joint Conference on Neural Networks (IJCNN)","author":"Mosafi Itay","year":"2019","unstructured":"Itay Mosafi, Eli Omid David, and Nathan S. Netanyahu. 2019. Stealing knowledge from protected deep neural networks using composite unlabeled data. In International Joint Conference on Neural Networks (IJCNN). IEEE. DOI:10.1109\/IJCNN.2019.8851798"},{"key":"e_1_3_2_14_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3069258"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.001.2000196"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"e_1_3_2_17_2","doi-asserted-by":"publisher","DOI":"10.3390\/app9050909"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/MDAT.2020.2971217"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2020.3034721"},{"key":"e_1_3_2_20_2","unstructured":"Inaam Ilahi Muhammad Usama Junaid Qadir Muhammad Umar Janjua Ala Al-Fuqaha Dinh Thai Hoang and Dusit Niyato. 2021. Challenges and Countermeasures for Adversarial Attacks on Deep Reinforcement Learning. Retrieved from http:\/\/arxiv.org\/abs\/2001.09684."},{"key":"e_1_3_2_21_2","volume-title":"IEEE High Performance Extreme Computing Conference","author":"Isakov Mihailo","year":"2019","unstructured":"Mihailo Isakov, Vijay Gadepally, Karen M. Gettings, and Michel A. Kinsy. 2019. Survey of attacks and defenses on edge-deployed neural networks (HPEC). In IEEE High Performance Extreme Computing ConferenceIEEE. DOI:10.1109\/HPEC.2019.8916519"},{"key":"e_1_3_2_22_2","volume-title":"ACM SIGKDD International Conference on Knowledge Discovery in Data Mining (KDD)","author":"Lowd Daniel","year":"2005","unstructured":"Daniel Lowd and Christopher Meek. 2005. Adversarial learning. In ACM SIGKDD International Conference on Knowledge Discovery in Data Mining (KDD). ACM Press. DOI:10.1145\/1081870.1081950"},{"key":"e_1_3_2_23_2","volume-title":"Active Learning Literature Survey","author":"Settles Burr","year":"2009","unstructured":"Burr Settles. 2009. Active Learning Literature Survey. Computer Sciences Technical Report 1648. University of Wisconsin\u2013Madison. Retrieved from http:\/\/digital.library.wisc.edu\/1793\/60660."},{"key":"e_1_3_2_24_2","volume-title":"USENIX Security Symposium","author":"Chandrasekaran V.","year":"2020","unstructured":"V. Chandrasekaran, K. Chaudhuri, I. Giacomelli, S. Jha, and Songbai Yan. 2020. Exploring connections between active learning and model extraction. In USENIX Security Symposium. USENIX Association. Retrieved from https:\/\/www.usenix.org\/system\/files\/sec20-chandrasekaran.pdf."},{"key":"e_1_3_2_25_2","unstructured":"Soham Pal Yash Gupta Aditya Shukla Aditya Kanade Shirish Shevade and Vinod Ganapathy. 2019. A framework for the extraction of deep neural networks by leveraging public data. Retrieved from http:\/\/arxiv.org\/abs\/1905.09165."},{"key":"e_1_3_2_26_2","volume-title":"AAAI Conference on Artificial Intelligence","author":"Pal Soham","year":"2020","unstructured":"Soham Pal, Yash Gupta, Aditya Shukla, Aditya Kanade, Shirish Shevade, and Vinod Ganapathy. 2020. ActiveThief: Model extraction using active learning and unannotated public data. In AAAI Conference on Artificial Intelligence. DOI:10.1609\/aaai.v34i01.5432"},{"key":"e_1_3_2_27_2","volume-title":"IEEE International Conference on Data Mining (ICDM)","author":"Pengcheng Li","year":"2018","unstructured":"Li Pengcheng, Jinfeng Yi, and Lijun Zhang. 2018. Query-efficient black-box attack by active learning. In IEEE International Conference on Data Mining (ICDM). IEEE. DOI:10.1109\/ICDM.2018.00159"},{"key":"e_1_3_2_28_2","doi-asserted-by":"publisher","DOI":"10.1109\/THS.2018.8574124"},{"key":"e_1_3_2_29_2","volume-title":"ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD)","author":"Bucilu\u01ce Cristian","year":"2006","unstructured":"Cristian Bucilu\u01ce, Rich Caruana, and Alexandru Niculescu-Mizil. 2006. Model compression. In ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD). ACM Press. DOI:10.1145\/1150402.1150464"},{"key":"e_1_3_2_30_2","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2017.2765695"},{"key":"e_1_3_2_31_2","volume-title":"IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Kariyappa Sanjay","year":"2021","unstructured":"Sanjay Kariyappa, Atul Prakash, and Moinuddin K. Qureshi. 2021. MAZE: Data-free model stealing attack using zeroth-order gradient estimation. In IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE. DOI:10.1109\/CVPR46437.2021.01360"},{"key":"e_1_3_2_32_2","unstructured":"Hui Xu Yuxin Su Zirui Zhao Yangfan Zhou Michael R. Lyu and Irwin King. 2018. DeepObfuscation: Securing the Structure of Convolutional Neural Networks via Knowledge Distillation. Retrieved from http:\/\/arxiv.org\/abs\/1806.10313."},{"key":"e_1_3_2_33_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00038"},{"key":"e_1_3_2_34_2","volume-title":"Deep Learning","author":"Goodfellow Ian","year":"2016","unstructured":"Ian Goodfellow, Yoshua Bengio, and Aaron Courville. 2016. Deep Learning. MIT Press."},{"key":"e_1_3_2_35_2","volume-title":"Advances in Neural Information Processing Systems (NIPS)","author":"Goodfellow Ian","year":"2014","unstructured":"Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative adversarial nets. In Advances in Neural Information Processing Systems (NIPS). Curran Associates, Inc.. Retrieved from https:\/\/proceedings.neurips.cc\/paper\/2014\/file\/5ca3e9b122f61f8f06494c97b1afccf3-Paper.pdf."},{"key":"e_1_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNN.2008.2005605"},{"key":"e_1_3_2_37_2","volume-title":"ACM Asia Conference on Computer and Communications Security (ASIA CCS)","author":"Barreno Marco","year":"2006","unstructured":"Marco Barreno, Blaine Nelson, Russell Sears, Anthony D. Joseph, and J. D. Tygar. 2006. Can machine learning be secure? In ACM Asia Conference on Computer and Communications Security (ASIA CCS). ACM Press. DOI:10.1145\/1128817.1128824"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"e_1_3_2_39_2","volume-title":"USENIX Workshop on Large-scale Exploits and Emergent Threats (LEET)","author":"Nelson Blaine","year":"2008","unstructured":"Blaine Nelson, Marco Barreno, Fuching Jack Chi, Anthony D. Joseph, Benjamin I. P. Rubinstein et\u00a0al. 2008. Exploiting machine learning to subvert your spam filter. In USENIX Workshop on Large-scale Exploits and Emergent Threats (LEET). USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/leet-08\/exploiting-machine-learning-subvert-your-spam-filter."},{"key":"e_1_3_2_40_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Szegedy Christian","year":"2014","unstructured":"Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_41_2","volume-title":"Conference on Email and Anti-spam","author":"Lowd Daniel","year":"2005","unstructured":"Daniel Lowd and Christopher Meek. 2005. Good word attacks on statistical spam filters. In Conference on Email and Anti-spam."},{"key":"e_1_3_2_42_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"e_1_3_2_43_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISSPIT.2018.8642683"},{"key":"e_1_3_2_44_2","volume-title":"IEEE International Conference on System, Computation, Automation and Networking (ICSCAN)","author":"Joshi Nikhil","year":"2019","unstructured":"Nikhil Joshi and Rewanth Tammana. 2019. GDALR: An efficient model duplication attack on black box machine learning models. In IEEE International Conference on System, Computation, Automation and Networking (ICSCAN). IEEE. DOI:10.1109\/ICSCAN.2019.8878726"},{"key":"e_1_3_2_45_2","volume-title":"International Conference on Security and Privacy in Communication Systems","author":"Ali Abdullah","year":"2020","unstructured":"Abdullah Ali and Birhanu Eshete. 2020. Best-effort adversarial approximation of black-box malware classifiers. In International Conference on Security and Privacy in Communication Systems. Springer International Publishing, Cham. DOI:10.1007\/978-3-030-63086-7_18"},{"key":"e_1_3_2_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/3338498.3358646"},{"key":"e_1_3_2_47_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Lukas Nils","year":"2021","unstructured":"Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. 2021. Deep neural network fingerprinting by conferrable adversarial examples. In International Conference on Learning Representations (ICLR). Retrieved from https:\/\/openreview.net\/forum?id=VqzVhqxkjH1."},{"key":"e_1_3_2_48_2","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2022.3147508"},{"key":"e_1_3_2_49_2","volume-title":"Asia Conference on Computer and Communications Security (ASIA CCS)","author":"Chen Kangjie","year":"2021","unstructured":"Kangjie Chen, Shangwei Guo, Tianwei Zhang, Xiaofei Xie, and Yang Liu. 2021. Stealing deep reinforcement learning models for fun and profit. In Asia Conference on Computer and Communications Security (ASIA CCS). ACM. DOI:10.1145\/3433210.3453090"},{"key":"e_1_3_2_50_2","unstructured":"Takayuki Miura Satoshi Hasegawa and Toshiki Shibahara. 2021. MEGEX: Data-free Model Extraction Attack against Gradient-based Explainable AI. DOI:10.48550\/arXiv.2107.08909"},{"key":"e_1_3_2_51_2","volume-title":"International Conference on Neural Information Processing Systems (NeurIPS)","author":"B\u0103rb\u0103l\u0103u Antonio","year":"2020","unstructured":"Antonio B\u0103rb\u0103l\u0103u, Adrian Cosma, Radu Tudor Ionescu, and Marius Popescu. 2020. Black-box ripper: Copying black-box models using generative evolutionary algorithms. In International Conference on Neural Information Processing Systems (NeurIPS). Curran Associates Inc."},{"key":"e_1_3_2_52_2","volume-title":"IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Truong Jean-Baptiste","year":"2021","unstructured":"Jean-Baptiste Truong, Pratyush Maini, Robert J. Walls, and Nicolas Papernot. 2021. Data-free model extraction. In IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE. DOI:10.1109\/CVPR46437.2021.00474"},{"key":"e_1_3_2_53_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Oh Seong Joon","year":"2018","unstructured":"Seong Joon Oh, M. Augustin, M. Fritz, and B. Schiele. 2018. Towards reverse-engineering black-box neural networks. In International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_54_2","volume-title":"Annual Design Automation Conference (DAC)","author":"Hua Weizhe","year":"2018","unstructured":"Weizhe Hua, Zhiru Zhang, and G. Edward Suh. 2018. Reverse engineering convolutional neural networks through side-channel information leaks. In Annual Design Automation Conference (DAC). ACM. DOI:10.1145\/3195970.3196105"},{"key":"e_1_3_2_55_2","volume-title":"International Conference on Architectural Support for Programming Languages and Operating Systems","author":"Hu Xing","year":"2020","unstructured":"Xing Hu, Ling Liang, Shuangchen Li, Lei Deng, Pengfei Zuo et\u00a0al. 2020. DeepSniffer: A DNN model extraction framework based on learning architectural hints. In International Conference on Architectural Support for Programming Languages and Operating Systems. ACM. DOI:10.1145\/3373376.3378460"},{"key":"e_1_3_2_56_2","volume-title":"USENIX Security Symposium","author":"Yan Mengjia","year":"2020","unstructured":"Mengjia Yan, Christopher W. Fletcher, and Josep Torrellas. 2020. Cache telepathy: Leveraging shared resource attacks to learn DNN architectures. In USENIX Security Symposium. USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/yan."},{"key":"e_1_3_2_57_2","unstructured":"Sanghyun Hong Michael Davinroy Yi\u01e7itcan Kaya Stuart Nevans Locke Ian Rackow Kevin Kulda Dana Dachman-Soled and Tudor Dumitra\u015f. 2020. Security Analysis of Deep Neural Networks Operating in the Presence of Cache Side-channel Attacks. (2020). Retrieved from http:\/\/arxiv.org\/abs\/1810.03487."},{"key":"e_1_3_2_58_2","doi-asserted-by":"publisher","DOI":"10.1109\/TCSII.2020.2973007"},{"key":"e_1_3_2_59_2","volume-title":"USENIX Security Symposium","author":"Zhu Yuankun","year":"2021","unstructured":"Yuankun Zhu, Yueqiang Cheng, Husheng Zhou, and Yantao Lu. 2021. Hermes attack: Steal DNN models with lossless inference accuracy. In USENIX Security Symposium. USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/zhu."},{"key":"e_1_3_2_60_2","unstructured":"Daniel Teitelman Itay Naeh and Shie Mannor. 2020. Stealing Black-box Functionality Using the Deep Neural Tree Architecture. Retrieved from http:\/\/arxiv.org\/abs\/2002.09864."},{"key":"e_1_3_2_61_2","volume-title":"IEEE Military Communications Conference (MILCOM)","author":"Shi Yi","year":"2017","unstructured":"Yi Shi and Yalin E. Sagduyu. 2017. Evasion and causative attacks with adversarial deep learning. In IEEE Military Communications Conference (MILCOM). IEEE. DOI:10.1109\/MILCOM.2017.8170807"},{"key":"e_1_3_2_62_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-57463-9_4"},{"key":"e_1_3_2_63_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2018.02.007"},{"key":"e_1_3_2_64_2","unstructured":"Nicolas Papernot Patrick McDaniel and Ian Goodfellow. 2016. Transferability in Machine Learning: From Phenomena to Black-box Attacks Using Adversarial Samples. Retrieved from http:\/\/arxiv.org\/abs\/1605.07277."},{"key":"e_1_3_2_65_2","volume-title":"Conference on Fairness, Accountability, and Transparency (FAT)","author":"Milli Smitha","year":"2019","unstructured":"Smitha Milli, Ludwig Schmidt, Anca D. Dragan, and Moritz Hardt. 2019. Model reconstruction from model explanations. In Conference on Fairness, Accountability, and Transparency (FAT). ACM. DOI:10.1145\/3287560.3287562"},{"key":"e_1_3_2_66_2","volume-title":"International Conference on Machine Learning (ICML)","author":"Rolnick David","year":"2020","unstructured":"David Rolnick and Konrad Kording. 2020. Reverse-engineering deep ReLU networks. In International Conference on Machine Learning (ICML). PMLR. Retrieved from https:\/\/proceedings.mlr.press\/v119\/rolnick20a.html."},{"key":"e_1_3_2_67_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-56877-1_7"},{"key":"e_1_3_2_68_2","volume-title":"ICML Workshop on the Security and Privacy of Machine Learning","author":"Roberts Nicholas","year":"2019","unstructured":"Nicholas Roberts, Vinay Uday Prabhu, and Matthew McAteer. 2019. Model weight theft with just noise inputs: The curious case of the petulant attacker. In ICML Workshop on the Security and Privacy of Machine Learning. Retrieved from https:\/\/icml2019workshop.github.io\/."},{"key":"e_1_3_2_69_2","unstructured":"Ulrich A\u00efvodji Alexandre Bolot and S\u00e9bastien Gambs. 2020. Model extraction from counterfactual explanations. Retrieved from http:\/\/arxiv.org\/abs\/2009.01884."},{"key":"e_1_3_2_70_2","unstructured":"Tatsuya Takemura Naoto Yanai and Toru Fujiwara. 2020. Model Extraction Attacks against Recurrent Neural Networks. Retrieved from http:\/\/arxiv.org\/abs\/2002.00123."},{"key":"e_1_3_2_71_2","volume-title":"ACM Asia Conference on Computer and Communications Security (ASIA CCS)","author":"Wu Bang","year":"2022","unstructured":"Bang Wu, Xiangwen Yang, Shirui Pan, and Xingliang Yuan. 2022. Model extraction attacks on graph neural networks: Taxonomy and realisation. In ACM Asia Conference on Computer and Communications Security (ASIA CCS). ACM. DOI:10.1145\/3488932.3497753"},{"key":"e_1_3_2_72_2","volume-title":"USENIX Security Symposium","author":"He Xinlei","year":"2021","unstructured":"Xinlei He, Jinyuan Jia, Michael Backes, Neil Zhenqiang Gong, and Yang Zhang. 2021. Stealing links from graph neural networks. In USENIX Security Symposium. USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/he."},{"key":"e_1_3_2_73_2","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24178"},{"key":"e_1_3_2_74_2","unstructured":"Sebastian Szyller Vasisht Duddu Tommi Gr\u00f6ndahl and N. Asokan. 2021. Good Artists Copy Great Artists Steal: Model Extraction Attacks against Image Translation Generative Adversarial Networks. DOI:10.48550\/arXiv.2104.12623"},{"key":"e_1_3_2_75_2","volume-title":"Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies","author":"He Xuanli","year":"2021","unstructured":"Xuanli He, Lingjuan Lyu, Lichao Sun, and Qiongkai Xu. 2021. Model extraction and adversarial transferability, your BERT is vulnerable! In Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies."},{"key":"e_1_3_2_76_2","volume-title":"Annual Computer Security Applications Conference (ACSAC)","author":"Hu Hailong","year":"2021","unstructured":"Hailong Hu and Jun Pang. 2021. Stealing machine learning models: Attacks and countermeasures for generative adversarial networks. In Annual Computer Security Applications Conference (ACSAC). ACM. DOI:10.1145\/3485832.3485838"},{"key":"e_1_3_2_77_2","unstructured":"Xinyi Zhang Chengfang Fang and Jie Shi. 2021. Thief Beware of What Get You There: Towards Understanding Model Extraction Attack. DOI:10.48550\/arXiv.2104.05921"},{"key":"e_1_3_2_78_2","volume-title":"International Conference on Cloud Networking","author":"Aarts Arne","year":"2021","unstructured":"Arne Aarts, Wil Michiels, and Peter Roelse. 2021. Leveraging partial model extractions using uncertainty quantification. In International Conference on Cloud Networking. IEEE. DOI:10.1109\/CloudNet53349.2021.9657130"},{"key":"e_1_3_2_79_2","volume-title":"International Conference on Intelligent Computing and Signal Processing (ICSP)","author":"Wang Yixu","year":"2022","unstructured":"Yixu Wang and Xianming Lin. 2022. Enhance model stealing attack via label refining. In International Conference on Intelligent Computing and Signal Processing (ICSP). IEEE. DOI:10.1109\/ICSP54964.2022.9778562"},{"key":"e_1_3_2_80_2","volume-title":"ACM SIGSAC Conference on Computer and Communications Security (CCS)","author":"Liu Yupei","year":"2022","unstructured":"Yupei Liu, Jinyuan Jia, Hongbin Liu, and Neil Zhenqiang Gong. 2022. StolenEncoder: Stealing pre-trained encoders in self-supervised learning. In ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM."},{"key":"e_1_3_2_81_2","unstructured":"Zeyang Sha Xinlei He Ning Yu Michael Backes and Yang Zhang. 2022. Can\u2019t Steal? Cont-Steal! Contrastive Stealing Attacks against Image Encoders. DOI:10.48550\/arXiv.2201.07513"},{"key":"e_1_3_2_82_2","volume-title":"European Conference on Computer Vision (ECCV)","author":"Wang Yixu","year":"2022","unstructured":"Yixu Wang, Jie Li, Hong Liu, Yan Wang, Yongjian Wu, Feiyue Huang, and Rongrong Ji. 2022. Black-box dissector: Towards erasing-based hard-label model stealing attack. In European Conference on Computer Vision (ECCV). Springer Nature Switzerland, Cham. DOI:10.1007\/978-3-031-20065-6_12"},{"key":"e_1_3_2_83_2","doi-asserted-by":"publisher","DOI":"10.1002\/int.23022"},{"key":"e_1_3_2_84_2","volume-title":"IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Sanyal Sunandini","year":"2022","unstructured":"Sunandini Sanyal, Sravanti Addepalli, and R. Venkatesh Babu. 2022. Towards data-free model stealing in a hard label setting. In IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE. DOI:10.1109\/CVPR52688.2022.01485"},{"key":"e_1_3_2_85_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17140-6_28"},{"key":"e_1_3_2_86_2","volume-title":"International Conference on Machine Learning (ICML)","author":"Dziedzic Adam","year":"2022","unstructured":"Adam Dziedzic, Nikita Dhawan, Muhammad Ahmad Kaleem, Jonas Guan, and Nicolas Papernot. 2022. On the difficulty of defending self-supervised learning against model extraction. In International Conference on Machine Learning (ICML). PMLR. Retrieved from https:\/\/proceedings.mlr.press\/v162\/dziedzic22a.html."},{"key":"e_1_3_2_87_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833607"},{"key":"e_1_3_2_88_2","volume-title":"International Workshop on Deep Learning on Graphs: Methodologies and Applications (DLGMA)","author":"DeFazio David","year":"2020","unstructured":"David DeFazio and Arti Ramesh. 2020. Adversarial model extraction on graph neural networks. In International Workshop on Deep Learning on Graphs: Methodologies and Applications (DLGMA)."},{"key":"e_1_3_2_89_2","volume-title":"International Joint Conference on Artificial Intelligence (IJCAI)","author":"Gong Xueluan","year":"2021","unstructured":"Xueluan Gong, Yanjiao Chen, Wenbin Yang, Guanghao Mei, and Qian Wang. 2021. InverseNet: Augmenting model extraction attacks with training data inversion. In International Joint Conference on Artificial Intelligence (IJCAI). DOI:10.24963\/ijcai.2021\/336"},{"key":"e_1_3_2_90_2","volume-title":"ACM Conference on Recommender Systems (RecSys)","author":"Yue Zhenrui","year":"2021","unstructured":"Zhenrui Yue, Zhankui He, Huimin Zeng, and Julian McAuley. 2021. Black-box attacks on sequential recommenders via data-free model extraction. In ACM Conference on Recommender Systems (RecSys). ACM. DOI:10.1145\/3460231.3474275"},{"key":"e_1_3_2_91_2","volume-title":"ACM Conference on Fairness, Accountability, and Transparency (FAccT)","author":"Wang Yongjie","year":"2022","unstructured":"Yongjie Wang, Hangwei Qian, and Chunyan Miao. 2022. DualCF: Efficient model extraction attack from counterfactual explanations. In ACM Conference on Fairness, Accountability, and Transparency (FAccT). ACM. DOI:10.1145\/3531146.3533188"},{"key":"e_1_3_2_92_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29959-0_4"},{"key":"e_1_3_2_93_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2009.191"},{"key":"e_1_3_2_94_2","volume-title":"IEEE International Conference on Computer Vision (ICCV)","author":"Selvaraju Ramprasaath R.","year":"2017","unstructured":"Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. 2017. Grad-CAM: Visual explanations from deep networks via gradient-based localization. In IEEE International Conference on Computer Vision (ICCV). IEEE. DOI:10.1109\/ICCV.2017.74"},{"key":"e_1_3_2_95_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Goodfellow Ian J.","year":"2015","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR)."},{"key":"e_1_3_2_96_2","volume-title":"Interpretable Machine Learning: A Guide for Making Black Box Models Explainable","author":"Molnar Christoph","year":"2019","unstructured":"Christoph Molnar. 2019. Interpretable Machine Learning: A Guide for Making Black Box Models Explainable. Retrieved from https:\/\/christophm.github.io\/interpretable-ml-book\/."},{"key":"e_1_3_2_97_2","unstructured":"Jacob Devlin Ming-Wei Chang Kenton Lee and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. Retrieved from http:\/\/arxiv.org\/abs\/1810.04805."},{"key":"e_1_3_2_98_2","doi-asserted-by":"publisher","DOI":"10.1145\/3054912"},{"key":"e_1_3_2_99_2","volume-title":"Conference on Empirical Methods in Natural Language Processing (EMNLP)","author":"Kim Yoon","year":"2014","unstructured":"Yoon Kim. 2014. Convolutional neural networks for sentence classification. In Conference on Empirical Methods in Natural Language Processing (EMNLP). Association for Computational Linguistics. DOI:10.3115\/v1\/D14-1181"},{"key":"e_1_3_2_100_2","unstructured":"Vasisht Duddu Debasis Samanta D. Vijay Rao and Valentina E. Balas. 2019. Stealing Neural Networks via Timing Side Channels. Retrieved from http:\/\/arxiv.org\/abs\/1812.11720."},{"key":"e_1_3_2_101_2","volume-title":"ACM SIGSAC Conference on Cloud Computing Security Workshop (CCSW)","author":"Liu Yuntao","year":"2020","unstructured":"Yuntao Liu and Ankur Srivastava. 2020. GANRED: GAN-based reverse engineering of DNNs via cache side-channel. In ACM SIGSAC Conference on Cloud Computing Security Workshop (CCSW). ACM. DOI:10.1145\/3411495.3421356"},{"key":"e_1_3_2_102_2","volume-title":"International Conference on Learning Representations","author":"Hong Sanghyun","year":"2020","unstructured":"Sanghyun Hong, Michael Davinroy, Yi\u01e7itcan Kaya, Dana Dachman-Soled, and Tudor Dumitra\u015f. 2020. How to Own the NAS in your spare time. In International Conference on Learning Representations. Retrieved from https:\/\/openreview.net\/forum?id=S1erpeBFPB."},{"key":"e_1_3_2_103_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833743"},{"key":"e_1_3_2_104_2","unstructured":"Zhendong Wang Xiaoming Zeng Xulong Tang Danfeng Zhang Xing Hu and Yang Hu. 2022. Demystifying Arch-hints for Model Extraction: An Attack in Unified Memory System. DOI:10.48550\/arXiv.2208.13720"},{"key":"e_1_3_2_105_2","doi-asserted-by":"publisher","DOI":"10.1109\/FCCM.2019.00059"},{"key":"e_1_3_2_106_2","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2021.3105697"},{"key":"e_1_3_2_107_2","volume-title":"IEEE\/ACM International Conference On Computer Aided Design (ICCAD)","author":"Regazzoni Francesco","year":"2020","unstructured":"Francesco Regazzoni, Shivam Bhasin, Amir Ali Pour, Ihab Alshaer, Furkan Aydin, Aydin Aysu et\u00a0al. 2020. Machine learning and hardware security: Challenges and opportunities. In IEEE\/ACM International Conference On Computer Aided Design (ICCAD). ACM. DOI:10.1145\/3400302.3416260"},{"key":"e_1_3_2_108_2","volume-title":"USENIX Security Symposium","author":"Batina Lejla","year":"2019","unstructured":"Lejla Batina, Shivam Bhasin, Dirmanto Jap, and Stjepan Picek. 2019. CSI NN: Reverse engineering of neural network architectures through electromagnetic side channel. In USENIX Security Symposium. USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/batina."},{"key":"e_1_3_2_109_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-61638-0_6"},{"key":"e_1_3_2_110_2","doi-asserted-by":"publisher","DOI":"10.1109\/HOST45689.2020.9300274"},{"key":"e_1_3_2_111_2","volume-title":"International Conference on Artificial Neural Networks (ICANN)","author":"Li Tommy","year":"2021","unstructured":"Tommy Li and Cory Merkel. 2021. Model Extraction and adversarial attacks on neural networks using switching power information. In International Conference on Artificial Neural Networks (ICANN). Springer International Publishing, Cham. DOI:10.1007\/978-3-030-86362-3_8"},{"key":"e_1_3_2_112_2","volume-title":"International Conference on Artificial Intelligence Circuits and Systems (AICAS)","author":"Dubey Anuj","year":"2022","unstructured":"Anuj Dubey, Emre Karabulut, Amro Awad, and Aydin Aysu. 2022. High-fidelity model extraction attacks via remote power monitors. In International Conference on Artificial Intelligence Circuits and Systems (AICAS). IEEE. DOI:10.1109\/AICAS54282.2022.9869973"},{"key":"e_1_3_2_113_2","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-68697-5_9"},{"key":"e_1_3_2_114_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-009-9049-y"},{"key":"e_1_3_2_115_2","volume-title":"USENIX Security Symposium","author":"Yarom Yuval","year":"2014","unstructured":"Yuval Yarom and Katrina Falkner. 2014. FLUSH+RELOAD: A high resolution, low noise, L3 cache side-channel attack. In USENIX Security Symposium. USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity14\/technical-sessions\/presentation\/yarom."},{"key":"e_1_3_2_116_2","volume-title":"USENIX Symposium on Networked Systems Design and Implementation (NSDI)","author":"Hunt Tyler","year":"2020","unstructured":"Tyler Hunt, Zhipeng Jia, Vance Miller, Ariel Szekely, Yige Hu, Christopher J. Rossbach, and Emmett Witchel. 2020. Telekine: Secure computing with cloud GPUs. In USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/nsdi20\/presentation\/hunt."},{"key":"e_1_3_2_117_2","volume-title":"AAAI Conference on Artificial Intelligence","author":"Raff Edward","year":"2018","unstructured":"Edward Raff, Jon Barker, Jared Sylvester, Robert Brandon, Bryan Catanzaro, and Charles K. Nicholas. 2018. Malware detection by eating a whole EXE. In AAAI Conference on Artificial Intelligence. AAAI Press. Retrieved from https:\/\/aaai.org\/ocs\/index.php\/WS\/AAAIW18\/paper\/view\/16422."},{"key":"e_1_3_2_118_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Cai Han","year":"2019","unstructured":"Han Cai, Ligeng Zhu, and Song Han. 2019. ProxylessNAS: Direct neural architecture search on target task and hardware. In International Conference on Learning Representations (ICLR). Retrieved from https:\/\/openreview.net\/forum?id=HylVB3AqYm."},{"key":"e_1_3_2_119_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Maini Pratyush","year":"2021","unstructured":"Pratyush Maini, Mohammad Yaghini, and Nicolas Papernot. 2021. Dataset inference: Ownership resolution in machine learning. In International Conference on Learning Representations (ICLR). Retrieved from https:\/\/openreview.net\/forum?id=hvdKKV2yt7T."},{"key":"e_1_3_2_120_2","volume-title":"USENIX Security Symposium","author":"Jia Hengrui","year":"2021","unstructured":"Hengrui Jia, Christopher A. Choquette-Choo, Varun Chandrasekaran, and Nicolas Papernot. 2021. Entangled watermarks as a defense against model extraction. In USENIX Security Symposium. USENIX Association. Retrieved from https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/jia."},{"key":"e_1_3_2_121_2","volume-title":"ACM International Conference on Multimedia","author":"Szyller Sebastian","year":"2021","unstructured":"Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and N. Asokan. 2021. DAWN: Dynamic adversarial watermarking of neural networks. In ACM International Conference on Multimedia. ACM. DOI:10.1145\/3474085.3475591"},{"key":"e_1_3_2_122_2","unstructured":"Abhishek Chakraborty Daniel Xing Yuntao Liu and Ankur Srivastava. 2022. DynaMarks: Defending against Deep Learning Model Extraction Using Dynamic Watermarking. DOI:10.48550\/ARXIV.2207.13321"},{"key":"e_1_3_2_123_2","volume-title":"AAAI Conference on Artificial Intelligence","author":"Li Yiming","year":"2022","unstructured":"Yiming Li, Linghui Zhu, Xiaojun Jia, Yong Jiang, Shu-Tao Xia, and Xiaochun Cao. 2022. Defending against model stealing via verifying embedded external features. In AAAI Conference on Artificial Intelligence. DOI:10.1609\/aaai.v36i2.20036"},{"key":"e_1_3_2_124_2","volume-title":"Annual Computer Security Applications Conference (ACSAC)","author":"Kesarwani Manish","year":"2018","unstructured":"Manish Kesarwani, Bhaskar Mukhoty, Vijay Arya, and Sameep Mehta. 2018. Model extraction warning in MLaaS paradigm. In Annual Computer Security Applications Conference (ACSAC). ACM. DOI:10.1145\/3274694.3274740"},{"key":"e_1_3_2_125_2","doi-asserted-by":"publisher","DOI":"10.1145\/3474369.3486863"},{"key":"e_1_3_2_126_2","unstructured":"Soham Pal Yash Gupta Aditya Kanade and Shirish Shevade. 2021. Stateful Detection of Model Extraction Attacks. DOI:10.48550\/arXiv.2107.05166"},{"key":"e_1_3_2_127_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-17140-6_30"},{"key":"e_1_3_2_128_2","unstructured":"Amir Mahdi Sadeghzadeh Amir Mohammad Sobhanian Faezeh Dehghan and Rasool Jalili. 2022. HODA: Hardness-Oriented Detection of Model Extraction Attacks. DOI:10.48550\/arXiv.2106.11424"},{"key":"e_1_3_2_129_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Dziedzic Adam","year":"2022","unstructured":"Adam Dziedzic, Muhammad Ahmad Kaleem, Yu Shen Lu, and Nicolas Papernot. 2022. Increasing the cost of model extraction with calibrated proof of work. In International Conference on Learning Representations (ICLR). Retrieved from https:\/\/openreview.net\/forum?id=EAy7C1cgE1L."},{"key":"e_1_3_2_130_2","volume-title":"IEEE Conference on Communications and Network Security","author":"Grana Justin","year":"2020","unstructured":"Justin Grana. 2020. Perturbing inputs to prevent model stealing. In IEEE Conference on Communications and Network Security. IEEE. DOI:10.1109\/CNS48642.2020.9162336"},{"key":"e_1_3_2_131_2","volume-title":"International Conference on Information Systems Security and Privacy (ICISSP)","author":"Guiga L.","year":"2020","unstructured":"L. Guiga and A. W. Roscoe. 2020. Neural network security: Hiding CNN parameters with guided grad-CAM. In International Conference on Information Systems Security and Privacy (ICISSP). Retrieved from www.scopus.com."},{"key":"e_1_3_2_132_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Wang Xinran","year":"2021","unstructured":"Xinran Wang, Yu Xiang, Jun Gao, and Jie Ding. 2021. Information laundering for model privacy. In International Conference on Learning Representations (ICLR). Retrieved from https:\/\/openreview.net\/forum?id=dyaIRud1zXg."},{"key":"e_1_3_2_133_2","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2019.00020"},{"key":"e_1_3_2_134_2","volume-title":"IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Kariyappa Sanjay","year":"2020","unstructured":"Sanjay Kariyappa and Moinuddin K. Qureshi. 2020. Defending against model stealing attacks with adaptive misinformation. In IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE. DOI:10.1109\/CVPR42600.2020.00085"},{"key":"e_1_3_2_135_2","volume-title":"International Conference on Information Security and Cryptology","author":"Chen Jinyin","year":"2020","unstructured":"Jinyin Chen, Changan Wu, Shijing Shen, Xuhong Zhang, and Jianhao Chen. 2020. DAS-AST: Defending against model stealing attacks based on adaptive softmax transformation. In International Conference on Information Security and Cryptology. Springer International Publishing, Cham. DOI:10.1007\/978-3-030-71852-7_2"},{"key":"e_1_3_2_136_2","volume-title":"International Conference on Learning Representations (ICLR)","author":"Kariyappa Sanjay","year":"2021","unstructured":"Sanjay Kariyappa, Atul Prakash, and Moinuddin K. Qureshi. 2021. Protecting DNNs from theft using an ensemble of diverse models. In International Conference on Learning Representations (ICLR). Retrieved from https:\/\/openreview.net\/forum?id=LucJxySuJcE."},{"key":"e_1_3_2_137_2","volume-title":"International Joint Conference on Artificial Intelligence (IJCAI)","author":"Lee Jeonghyun","year":"2022","unstructured":"Jeonghyun Lee, Sungmin Han, and Sangkyun Lee. 2022. Model stealing defense against exploiting information leak through the interpretation of deep neural nets. In International Joint Conference on Artificial Intelligence (IJCAI). DOI:10.24963\/ijcai.2022\/100"},{"key":"e_1_3_2_138_2","volume-title":"International Conference on Machine Learning (ICML)","author":"Mazeika Mantas","year":"2022","unstructured":"Mantas Mazeika, Bo Li, and David Forsyth. 2022. How to steer your adversary: Targeted and efficient model stealing defenses with gradient redirection. In International Conference on Machine Learning (ICML). PMLR. Retrieved from https:\/\/proceedings.mlr.press\/v162\/mazeika22a.html."},{"key":"e_1_3_2_139_2","volume-title":"ACM International Conference on Conference on Information and Knowledge Management (CIKM)","author":"Alabdulmohsin Ibrahim M.","year":"2014","unstructured":"Ibrahim M. Alabdulmohsin, Xin Gao, and Xiangliang Zhang. 2014. Adding robustness to support vector machines against adversarial reverse engineering. In ACM International Conference on Conference on Information and Knowledge Management (CIKM). ACM. DOI:10.1145\/2661829.2662047"},{"key":"e_1_3_2_140_2","volume-title":"International Conference on Information Systems Security and Privacy (ICISSP)","author":"Lin Hsiao-Ying","year":"2020","unstructured":"Hsiao-Ying Lin, Chengfang Fang, and Jie Shi. 2020. Bident structure for neural network model protection: In International Conference on Information Systems Security and Privacy (ICISSP). SciTePress. DOI:10.5220\/0008923403770384"},{"key":"e_1_3_2_141_2","doi-asserted-by":"crossref","unstructured":"Herv\u00e9 Chabanne Vincent Despiegel and Linda Guiga. 2020. A Protection against the Extraction of Neural Network Models. Retrieved from http:\/\/arxiv.org\/abs\/2005.12782.","DOI":"10.5220\/0010373302580269"},{"key":"e_1_3_2_142_2","volume-title":"Computing Conference.","author":"Szentannai K\u00e1lm\u00e1n","year":"2020","unstructured":"K\u00e1lm\u00e1n Szentannai, Jalal Al-Afandi, and Andr\u00e1s Horv\u00e1th. 2020. Preventing neural network weight stealing via network obfuscation. In Computing Conference.Springer International Publishing, Cham. DOI:10.1007\/978-3-030-52243-8_1"},{"key":"e_1_3_2_143_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2005.26"},{"key":"e_1_3_2_144_2","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2023.3270135"},{"key":"e_1_3_2_145_2","doi-asserted-by":"publisher","DOI":"10.1007\/11787006_1"},{"key":"e_1_3_2_146_2","volume-title":"International Conference on Multimedia Big Data (BigMM)","author":"Duddu Vasisht","year":"2020","unstructured":"Vasisht Duddu and D. Vijay Rao. 2020. Quantifying (hyper) parameter leakage in machine learning. In International Conference on Multimedia Big Data (BigMM). IEEE. DOI:10.1109\/BigMM50055.2020.00041"},{"key":"e_1_3_2_147_2","volume-title":"Neural Information Processing Systems, Datasets & Benchmarks Track","author":"Croce Francesco","year":"2021","unstructured":"Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. 2021. RobustBench: A standardized adversarial robustness benchmark. In Neural Information Processing Systems, Datasets & Benchmarks Track. Retrieved from https:\/\/datasets-benchmarks-proceedings.neurips.cc\/paper\/2021\/file\/a3c65c2974270fd093ee8a9bf8ae7d0b-Paper-round2.pdf."},{"key":"e_1_3_2_148_2","volume-title":"Advances in Neural Information Processing Systems","author":"Tramer Florian","year":"2020","unstructured":"Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. 2020. On adaptive attacks to adversarial example defenses. In Advances in Neural Information Processing Systems, Vol. 33. Curran Associates, Inc. Retrieved from https:\/\/proceedings.neurips.cc\/paper\/2020\/file\/11f38f8ecd71867b42433548d1078e38-Paper.pdf."},{"key":"e_1_3_2_149_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3595292","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3595292","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T13:49:08Z","timestamp":1750168148000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3595292"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,7,17]]},"references-count":148,"journal-issue":{"issue":"14s","published-print":{"date-parts":[[2023,12,31]]}},"alternative-id":["10.1145\/3595292"],"URL":"https:\/\/doi.org\/10.1145\/3595292","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,7,17]]},"assertion":[{"value":"2021-08-09","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-02-14","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-07-17","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}