{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T02:51:11Z","timestamp":1773024671495,"version":"3.50.1"},"reference-count":38,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T00:00:00Z","timestamp":1773014400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T00:00:00Z","timestamp":1773014400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Key Research and Development Plan Special Project of Henan Province Grant","award":["241111211400"],"award-info":[{"award-number":["241111211400"]}]},{"DOI":"10.13039\/501100017700","name":"Henan Provincial Science and Technology Research Project","doi-asserted-by":"publisher","award":["242102211077"],"award-info":[{"award-number":["242102211077"]}],"id":[{"id":"10.13039\/501100017700","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Henan Province University Key Scientific Research Project","award":["23A520008"],"award-info":[{"award-number":["23A520008"]}]},{"name":"International Cooperation Program of Henan Province","award":["252102520045"],"award-info":[{"award-number":["252102520045"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>Model stealing attacks in the Machine Learning as a Service (MLaaS) paradigm face multiple technical challenges, particularly in scenarios lacking training data support. Target models remain vulnerable to reverse engineering and replication under strict environmental constraints. Existing data-free model stealing methods face critical issues such as excessively high query costs, limited attack accuracy, and low sample utilization efficiency. These factors significantly undermine the practical feasibility of such attacks. In this work, we design a Multi-Generator Collaborative Training Approach for Data-Free Model Stealing (MGCT) to address these technical bottlenecks. This framework employs a two-phase optimization paradigm to achieve effective extraction of the target model: In the first phase, a parallelized generator architecture is utilized for multi-generator collaborative training, which enhances the diversity of synthetic samples and alleviates the optimization difficulty of a single generator through a load-balancing strategy. A model distillation mechanism based on an enhanced experience replay is designed in the second phase. By integrating a hybrid sampling strategy and class-balancing constraints, low-confidence samples are dynamically selected, and class distribution equilibrium is maintained, thereby significantly improving the representational capacity of the training data. Compared to existing baseline methods, experimental evaluation results demonstrate that the MGCT framework significantly improves core evaluation metrics, including clone accuracy and query efficiency. Specifically, experimental data on the CIFAR-100 dataset show that the MGCT framework improves cloning accuracy by 2.07% and achieves 14.14% improvement under constrained budgets. These experimental results demonstrate the efficacy of the proposed method in addressing the technical bottlenecks of data-free model stealing.<\/jats:p>","DOI":"10.1186\/s42400-025-00467-1","type":"journal-article","created":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T02:01:16Z","timestamp":1773021676000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Mgct: a multi-generator collaborative training approach for data-free model stealing"],"prefix":"10.1186","volume":"9","author":[{"given":"Yunlong","family":"Gao","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3061-7768","authenticated-orcid":false,"given":"Zhiyong","family":"Zhang","sequence":"additional","affiliation":[]},{"given":"Han","family":"Liang","sequence":"additional","affiliation":[]},{"given":"Bin","family":"Song","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2026,3,9]]},"reference":[{"key":"467_CR1","doi-asserted-by":"crossref","unstructured":"Addepalli S, Nayak GK, Chakraborty A, et al (2020) Degan: Data-enriching gan for retrieving representative samples from a trained classifier. In: Proceedings of the AAAI Conference on Artificial Intelligence 3130\u20133137","DOI":"10.1609\/aaai.v34i04.5709"},{"key":"467_CR2","doi-asserted-by":"crossref","unstructured":"Bang J, Kim H, Yoo Y, et al (2021) Rainbow memory: Continual learning with a memory of diverse samples. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition 8218\u20138227","DOI":"10.1109\/CVPR46437.2021.00812"},{"key":"467_CR3","unstructured":"Beetham J, Kardan N, Mian A, et al (2023) Dual student networks for data-free model stealing"},{"key":"467_CR4","doi-asserted-by":"publisher","unstructured":"Binici K, Pham NT, Mitra T, et al (2022) Preventing catastrophic forgetting and distribution mismatch in knowledge distillation via synthetic data. In: Proceedings of the IEEE\/CVF winter conference on applications of computer vision 663\u2013671. https:\/\/doi.org\/10.1109\/WACV51458.2022.00368","DOI":"10.1109\/WACV51458.2022.00368"},{"key":"467_CR5","first-page":"14835","volume":"34","author":"K Choi","year":"2021","unstructured":"Choi K, Hong D, Park N et al (2021) Qimera: Data-free quantization with synthetic boundary supporting samples. Adv Neural Inf Process Syst 34:14835\u201314847","journal-title":"Adv Neural Inf Process Syst"},{"key":"467_CR6","doi-asserted-by":"publisher","unstructured":"Dietterich TG (2000) Ensemble methods in machine learning. In: International workshop on multiple classifier systems, Springer 1\u201315. https:\/\/doi.org\/10.1007\/3-540-45014-9_1","DOI":"10.1007\/3-540-45014-9_1"},{"issue":"1","key":"467_CR7","doi-asserted-by":"publisher","first-page":"35","DOI":"10.1186\/s42400-023-00171-y","volume":"6","author":"K Fan","year":"2023","unstructured":"Fan K, Zhang W, Liu G et al (2023) Fmsa: a meta-learning framework-based fast model stealing attack technique against intelligent network intrusion detection systems. Cybersecurity 6(1):35. https:\/\/doi.org\/10.1186\/s42400-023-00171-y","journal-title":"Cybersecurity"},{"key":"467_CR8","doi-asserted-by":"publisher","unstructured":"Gen\u00e7 D, \u00d6zuysal M, Tomur E (2023) A taxonomic survey of model extraction attacks. In: 2023 IEEE International Conference on Cyber Security and Resilience (CSR), IEEE 200\u2013205. https:\/\/doi.org\/10.1109\/CSR57506.2023.10224959","DOI":"10.1109\/CSR57506.2023.10224959"},{"issue":"4","key":"467_CR9","doi-asserted-by":"publisher","first-page":"4853","DOI":"10.1007\/s40747-024-01412-4","volume":"10","author":"J Hao","year":"2024","unstructured":"Hao J, Huang K, Chen C et al (2024) Dual-student knowledge distillation for visual anomaly detection. Complex Intel Syst 10(4):4853\u20134865. https:\/\/doi.org\/10.1007\/s40747-024-01412-4","journal-title":"Complex Intel Syst"},{"key":"467_CR10","doi-asserted-by":"publisher","unstructured":"He K, Zhang X, Ren S, et al (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition 770\u2013778. https:\/\/doi.org\/10.1109\/CVPR.2016.90","DOI":"10.1109\/CVPR.2016.90"},{"key":"467_CR11","unstructured":"Hinton G, Vinyals O, Dean J (2015) Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531"},{"key":"467_CR12","doi-asserted-by":"publisher","unstructured":"Jiang S, He Y, Zhang R, et al (2024) Dfds: Data-free dual substitutes hard-label black-box adversarial attack. In: International Conference on Knowledge Science, Engineering and Management, Springer 274\u2013285. https:\/\/doi.org\/10.1007\/978-981-97-5498-4_21","DOI":"10.1007\/978-981-97-5498-4_21"},{"key":"467_CR13","doi-asserted-by":"publisher","unstructured":"Jindal A, Goyal V, Anand S, et al (2024) Army of thieves: Enhancing black-box model extraction via ensemble based sample selection. In: Proceedings of the IEEE\/CVF Winter Conference on Applications of Computer Vision 3823\u20133832. https:\/\/doi.org\/10.1109\/WACV57701.2024.00378","DOI":"10.1109\/WACV57701.2024.00378"},{"key":"467_CR14","doi-asserted-by":"publisher","unstructured":"Kariyappa S, Prakash A, Qureshi MK (2021) Maze: Data-free model stealing attack using zeroth-order gradient estimation. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition 13814\u201313823. https:\/\/doi.org\/10.1109\/CVPR46437.2021.01360","DOI":"10.1109\/CVPR46437.2021.01360"},{"key":"467_CR15","first-page":"72412","volume":"36","author":"P Karmakar","year":"2023","unstructured":"Karmakar P, Basu D (2023) Marich: A query-efficient distributionally equivalent model extraction attack. Adv Neural Inf Process Syst 36:72412\u201372445","journal-title":"Adv Neural Inf Process Syst"},{"key":"467_CR16","unstructured":"Krizhevsky A, Hinton G, et al (2009) Learning multiple layers of features from tiny images"},{"issue":"6","key":"467_CR17","doi-asserted-by":"publisher","first-page":"84","DOI":"10.1145\/3065386","volume":"60","author":"A Krizhevsky","year":"2017","unstructured":"Krizhevsky A, Sutskever I, Hinton GE (2017) Imagenet classification with deep convolutional neural networks. Commun ACM 60(6):84\u201390","journal-title":"Commun ACM"},{"issue":"7","key":"467_CR18","first-page":"3","volume":"7","author":"Y Le","year":"2015","unstructured":"Le Y, Yang X (2015) Tiny imagenet visual recognition challenge. CS 231N 7(7):3","journal-title":"CS 231N"},{"issue":"11","key":"467_CR19","doi-asserted-by":"publisher","first-page":"2278","DOI":"10.1109\/5.726791","volume":"86","author":"Y LeCun","year":"1998","unstructured":"LeCun Y, Bottou L, Bengio Y et al (1998) Gradient-based learning applied to document recognition. Proc IEEE 86(11):2278\u20132324. https:\/\/doi.org\/10.1109\/5.726791","journal-title":"Proc IEEE"},{"key":"467_CR20","doi-asserted-by":"publisher","unstructured":"Lin Z, Xu K, Fang C, et al (2023) Quda: Query-limited data-free model extraction. In: Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security 913\u2013924. https:\/\/doi.org\/10.1145\/3579856.3590336","DOI":"10.1145\/3579856.3590336"},{"key":"467_CR21","unstructured":"Liu Y, Wen R, Backes M, et al (2024) Efficient data-free model stealing with label diversity. arXiv preprint arXiv:2404.00108"},{"key":"467_CR22","unstructured":"Netzer Y, Wang T, Coates A, et al (2011) Reading digits in natural images with unsupervised feature learning. In: NIPS workshop on deep learning and unsupervised feature learning, Granada 4"},{"key":"467_CR23","doi-asserted-by":"publisher","unstructured":"Ni T, Hu H (2023) Knowledge distillation by multiple student instance interaction. In: 2023 International Conference on Pattern Recognition, Machine Vision and Intelligent Algorithms (PRMVIA), IEEE 193\u2013200. https:\/\/doi.org\/10.1109\/PRMVIA58252.2023.00038","DOI":"10.1109\/PRMVIA58252.2023.00038"},{"issue":"14s","key":"467_CR24","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3595292","volume":"55","author":"D Oliynyk","year":"2023","unstructured":"Oliynyk D, Mayer R, Rauber A (2023) I know what you trained last summer: A survey on stealing machine learning models and defences. ACM Comput Surv 55(14s):1\u201341. https:\/\/doi.org\/10.1145\/3595292","journal-title":"ACM Comput Surv"},{"key":"467_CR25","doi-asserted-by":"publisher","unstructured":"Orekondy T, Schiele B, Fritz M (2019) Knockoff nets: Stealing functionality of black-box models. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition 4954\u20134963. https:\/\/doi.org\/10.1109\/CVPR.2019.00509","DOI":"10.1109\/CVPR.2019.00509"},{"key":"467_CR26","doi-asserted-by":"publisher","unstructured":"Ribeiro M, Grolinger K, Capretz MA (2015) Mlaas: Machine learning as a service. In: 2015 IEEE 14th international conference on machine learning and applications (ICMLA), IEEE 896\u2013902. https:\/\/doi.org\/10.1109\/ICMLA.2015.152","DOI":"10.1109\/ICMLA.2015.152"},{"key":"467_CR27","doi-asserted-by":"publisher","unstructured":"Rosenthal J, Enouen E, Pham HV, et al (2023) Disguide: Disagreement-guided data-free model extraction. In: Proceedings of the AAAI Conference on Artificial Intelligence 9614\u20139622. https:\/\/doi.org\/10.1609\/aaai.v37i8.26150","DOI":"10.1609\/aaai.v37i8.26150"},{"key":"467_CR28","doi-asserted-by":"publisher","unstructured":"Sanyal S, Addepalli S, Babu RV (2022) Towards data-free model stealing in a hard label setting. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition 15284\u201315293. https:\/\/doi.org\/10.1109\/CVPR52688.2022.01485","DOI":"10.1109\/CVPR52688.2022.01485"},{"key":"467_CR29","unstructured":"Schaul T, Quan J, Antonoglou I, et al (2015) Prioritized experience replay. arXiv preprint arXiv:1511.05952"},{"key":"467_CR30","unstructured":"Tram\u00e8r F, Zhang F, Juels A, et al (2016) Stealing machine learning models via prediction $$\\{$$APIs$$\\}$$. In: 25th USENIX security symposium (USENIX Security 16) 601\u2013618"},{"key":"467_CR31","doi-asserted-by":"publisher","unstructured":"Truong JB, Maini P, Walls RJ, et al (2021) Data-free model extraction. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition 4771\u20134780. https:\/\/doi.org\/10.1109\/CVPR46437.2021.00474","DOI":"10.1109\/CVPR46437.2021.00474"},{"key":"467_CR32","unstructured":"Wang Z (2021) Zero-shot knowledge distillation from a decision-based black-box model. In: International conference on machine learning, PMLR 10675\u201310685"},{"key":"467_CR33","doi-asserted-by":"publisher","unstructured":"Yang Y, Chen X, Xuan Y, et al (2024) Dualcos: Query-efficient data-free model stealing with dual clone networks and optimal samples. In: 2024 IEEE International Conference on Multimedia and Expo (ICME), IEEE 1\u20136. https:\/\/doi.org\/10.1109\/ICME57554.2024.10688153","DOI":"10.1109\/ICME57554.2024.10688153"},{"key":"467_CR34","doi-asserted-by":"crossref","unstructured":"Yin H, Molchanov P, Alvarez JM, et al (2020) Dreaming to distill: Data-free knowledge transfer via deepinversion. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition 8715\u20138724","DOI":"10.1109\/CVPR42600.2020.00874"},{"key":"467_CR35","doi-asserted-by":"crossref","unstructured":"Yuan L, Chen Y, Wang T, et al (2021) Tokens-to-token vit: Training vision transformers from scratch on imagenet. In: Proceedings of the IEEE\/CVF international conference on computer vision 558\u2013567. DOI: https:\/\/doi.org\/2101.11986","DOI":"10.1109\/ICCV48922.2021.00060"},{"issue":"5","key":"467_CR36","doi-asserted-by":"publisher","first-page":"1258","DOI":"10.1109\/TETCI.2022.3147508","volume":"6","author":"X Yuan","year":"2022","unstructured":"Yuan X, Ding L, Zhang L et al (2022) Es attack: Model stealing against deep neural networks without data hurdles. IEEE Trans Emerg Topics Comput Intel 6(5):1258\u20131270. https:\/\/doi.org\/10.1109\/TETCI.2022.3147508","journal-title":"IEEE Trans Emerg Topics Comput Intel"},{"key":"467_CR37","doi-asserted-by":"crossref","unstructured":"Zhang J, Li B, Xu J, et al (2022) Towards efficient data free black-box adversarial attack. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition 15115\u201315125","DOI":"10.1109\/CVPR52688.2022.01469"},{"key":"467_CR38","doi-asserted-by":"publisher","unstructured":"Zhao Y, Deng X, Liu Y, et al (2024) Fully exploiting every real sample: Superpixel sample gradient model stealing. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition 24316\u201324325. https:\/\/doi.org\/10.1109\/CVPR52733.2024.02295","DOI":"10.1109\/CVPR52733.2024.02295"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00467-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-025-00467-1","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-025-00467-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T02:01:21Z","timestamp":1773021681000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1186\/s42400-025-00467-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,9]]},"references-count":38,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["467"],"URL":"https:\/\/doi.org\/10.1186\/s42400-025-00467-1","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,9]]},"assertion":[{"value":"6 April 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 August 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 March 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"Not applicable.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}}],"article-number":"40"}}