用扩散模型先验突破数据无关模型窃取的冷启动难题
DiMEx: Breaking the Cold Start Barrier in Data-Free Model Extraction via Latent Diffusion Priors
- 利用预训练扩散模型的语义先验，在潜在空间生成高质量初始样本
- 仅用2000次查询在SVHN上达到52.1%准确率，比顶尖GAN方法高16%以上
- 提出时序特征防御机制，可将攻击成功率压至21.6%，适合防御服务端模型
模型窃取攻击对机器学习即服务（MLaaS）构成根本性威胁，使攻击者能以极低成本复现专有模型。尽管数据无关模型提取（DFME）已成为隐蔽攻击手段，但始终受限于“冷启动”问题：基于GAN的攻击需数千次查询才能从随机噪声收敛到有效数据。本文提出DiMEx框架，通过在生成器潜在空间中采用随机嵌入贝叶斯优化（REMBO），利用预训练潜扩散模型的丰富语义先验，直接生成高保真查询样本，实现仅2000次查询下在SVHN数据集上达到52.1%的匹配度，较现有最先进GAN基线提升超16%。为应对这一高度语义化的威胁，我们进一步提出混合状态集成（HSE）防御机制，通过识别潜在空间攻击的独特“优化轨迹”，有效抑制攻击成功率至21.6%，且延迟可忽略不计。
原文摘要 · Abstract (English)
Model stealing attacks pose an existential threat to Machine Learning as a Service (MLaaS), allowing adversaries to replicate proprietary models for a fraction of their training cost. While Data-Free Model Extraction (DFME) has emerged as a stealthy vector, it remains fundamentally constrained by the "Cold Start" problem: GAN-based adversaries waste thousands of queries converging from random noise to meaningful data. We propose DiMEx, a framework that weaponizes the rich semantic priors of pre-trained Latent Diffusion Models to bypass this initialization barrier entirely. By employing Random Embedding Bayesian Optimization (REMBO) within the generator's latent space, DiMEx synthesizes high-fidelity queries immediately, achieving 52.1 percent agreement on SVHN with just 2,000 queries - outperforming state-of-the-art GAN baselines by over 16 percent. To counter this highly semantic threat, we introduce the Hybrid Stateful Ensemble (HSE) defense, which identifies the unique "optimization trajectory" of latent-space attacks. Our results demonstrate that while DiMEx evades static distribution detectors, HSE exploits this temporal signature to suppress attack success rates to 21.6 percent with negligible latency.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。