提出高效查询生成方法,用更少查询实现更精准的模型盗取。
Exploring Query Efficient Data Generation towards Data-free Model Stealing in Hard Label Setting
- 设计双损失函数,让生成样本均匀贴近目标模型决策边界。
- 每查询获取多条监督信息,显著减少所需查询次数。
- 在真实云服务场景下表现优于现有方法,适合对抗性攻击研究者。
数据无关的模型盗取旨在不访问目标模型结构、参数或训练数据的情况下,复制其功能到替代模型中。攻击者仅能获取目标模型对生成样本的预测结果。一旦替代模型行为与目标模型高度一致,攻击者可利用其白盒特性实施后续恶意操作(如对抗攻击)。现有协作博弈框架方法常生成高置信度样本,导致替代模型难以准确模仿目标模型行为。本文提出新型数据无关模型盗取方法——查询高效数据生成(QEDG),引入两种不同损失函数,确保生成样本在多个类别上紧密且均匀地逼近目标模型决策边界。针对现有方法每查询仅提供一条监督信息的局限,提出无需额外查询的样本增强机制,实现更多监督信息获取。基于理论分析,采用一致性率指标更准确评估替代模型与目标模型的相似性。大量实验验证了该方法的有效性,在真实MLaaS场景及五个数据集上均以更少查询取得优于当前最优方法的性能。
原文摘要 · Abstract (English)
Data-free model stealing involves replicating the functionality of a target model into a substitute model without accessing the target model's structure, parameters, or training data. The adversary can only access the target model's predictions for generated samples. Once the substitute model closely approximates the behavior of the target model, attackers can exploit its white-box characteristics for subsequent malicious activities, such as adversarial attacks. Existing methods within cooperative game frameworks often produce samples with high confidence for the prediction of the substitute model, which makes it difficult for the substitute model to replicate the behavior of the target model. This paper presents a new data-free model stealing approach called Query Efficient Data Generation (\textbf{QEDG}). We introduce two distinct loss functions to ensure the generation of sufficient samples that closely and uniformly align with the target model's decision boundary across multiple classes. Building on the limitation of current methods, which typically yield only one piece of supervised information per query, we propose the query-free sample augmentation that enables the acquisition of additional supervised information without increasing the number of queries. Motivated by theoretical analysis, we adopt the consistency rate metric, which more accurately evaluates the similarity between the substitute and target models. We conducted extensive experiments to verify the effectiveness of our proposed method, which achieved better performance with fewer queries compared to the state-of-the-art methods on the real \textbf{MLaaS} scenario and five datasets.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。