{"total":57,"rows":[{"id":"2206.08451","title":"I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences","created":"2022-06-16","cited_by_count":75,"area":null},{"id":"2111.04625","title":"DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories","created":"2021-11-08","cited_by_count":42,"area":null},{"id":"2309.05610","title":"Privacy Side Channels in Machine Learning Systems","created":"2023-09-11","cited_by_count":40,"area":null},{"id":"2107.08909","title":"MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AI","created":"2021-07-19","cited_by_count":35,"area":null},{"id":"2403.09751","title":"What Was Your Prompt? A Remote Keylogging Attack on AI Assistants","created":"2024-03-14","cited_by_count":26,"area":null},{"id":"2201.05889","title":"StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learning","created":"2022-01-15","cited_by_count":23,"area":null},{"id":"2310.07152","title":"No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device ML","created":"2023-10-11","cited_by_count":21,"area":null},{"id":"2201.09186","title":"pvCNN: Privacy-Preserving and Verifiable Convolutional Neural Network Testing","created":"2022-01-23","cited_by_count":20,"area":null},{"id":"2303.09732","title":"Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscation","created":"2023-03-17","cited_by_count":20,"area":"safety"},{"id":"2208.10134","title":"Machine Learning with Confidential Computing: A Systematization of Knowledge","created":"2022-08-22","cited_by_count":15,"area":null},{"id":"2205.10364","title":"Learning to Reverse DNNs from AI Programs Automatically","created":"2022-05-20","cited_by_count":12,"area":null},{"id":"2411.10023","title":"Model Inversion Attacks: A Survey of Approaches and Countermeasures","created":"2024-11-15","cited_by_count":11,"area":null},{"id":"2109.07395","title":"Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel","created":"2021-09-15","cited_by_count":8,"area":null},{"id":"2210.01075","title":"Decompiling x86 Deep Neural Network Executables","created":"2022-10-03","cited_by_count":7,"area":null},{"id":"2110.15444","title":"10 Security and Privacy Problems in Large Foundation Models","created":"2021-10-28","cited_by_count":6,"area":null},{"id":"2205.00199","title":"Cracking White-box DNN Watermarks via Invariant Neuron Transforms","created":"2022-04-30","cited_by_count":6,"area":null},{"id":"2207.10561","title":"Careful What You Wish For: on the Extraction of Adversarially Trained Models","created":"2022-07-21","cited_by_count":6,"area":null},{"id":"2110.11290","title":"Physical Side-Channel Attacks on Embedded Neural Networks: A Survey","created":"2021-10-21","cited_by_count":5,"area":null},{"id":"2111.03308","title":"Confidential Machine Learning Computation in Untrusted Environments: A Systems Security Perspective","created":"2021-11-05","cited_by_count":4,"area":null},{"id":"2208.08569","title":"ObfuNAS: A Neural Architecture Search-based DNN Obfuscation Approach","created":"2022-08-17","cited_by_count":4,"area":null},{"id":"2209.04022","title":"Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directions","created":"2022-09-08","cited_by_count":4,"area":null},{"id":"2308.01193","title":"Mercury: An Automated Remote Side-channel Attack to Nvidia Deep Learning Accelerator","created":"2023-08-02","cited_by_count":4,"area":null},{"id":"2310.01959","title":"Beyond Labeling Oracles: What does it mean to steal ML models?","created":"2023-10-03","cited_by_count":4,"area":null},{"id":"2102.03523","title":"Ownership Verification of DNN Architectures via Hardware Cache Side Channels","created":"2021-02-06","cited_by_count":3,"area":"safety"},{"id":"2104.12623","title":"Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Models","created":"2021-04-26","cited_by_count":3,"area":null},{"id":"2106.11424","title":"HODA: Hardness-Oriented Detection of Model Extraction Attacks","created":"2021-06-21","cited_by_count":3,"area":null},{"id":"2304.03388","title":"InferNet: Exploiting Aggregate GPU Profiles as Side-Channel for DNN Architecture Inference","created":"2023-04-06","cited_by_count":3,"area":null},{"id":"2309.06223","title":"Compiled Models, Built-In Exploits: Uncovering Pervasive Bit-Flip Attack Surfaces in DNN Executables","created":"2023-09-12","cited_by_count":3,"area":null},{"id":"2411.09945","title":"TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Models","created":"2024-11-15","cited_by_count":3,"area":null},{"id":"2501.00798","title":"Make Shuffling Great Again: A Side-Channel Resistant Fisher-Yates Algorithm for Protecting Neural Networks","created":"2025-01-01","cited_by_count":3,"area":null},{"id":"2507.16872","title":"CompLeak: Deep Learning Model Compression Exacerbates Privacy Leakage","created":"2025-07-22","cited_by_count":3,"area":null},{"id":"2305.08034","title":"DNN-Defender: A Victim-Focused In-DRAM Defense Mechanism for Taming Adversarial Weight Attack on DNNs","created":"2023-05-14","cited_by_count":2,"area":null},{"id":"2307.14751","title":"FLARE: Fingerprinting Deep Reinforcement Learning Agents using Universal Adversarial Masks","created":"2023-07-27","cited_by_count":2,"area":null},{"id":"2308.05127","title":"Data-Free Model Extraction Attacks in the Context of Object Detection","created":"2023-08-09","cited_by_count":2,"area":null},{"id":"2503.19142","title":"Activation Functions Considered Harmful: Recovering Neural Network Weights through Controlled Channels","created":"2025-03-24","cited_by_count":2,"area":null},{"id":"2503.23748","title":"THEMIS: Towards Practical Intellectual Property Protection for Post-Deployment On-Device Deep Learning Models","created":"2025-03-31","cited_by_count":2,"area":"safety"},{"id":"2510.00151","title":"Stealing AI Model Weights Through Covert Communication Channels","created":"2025-09-30","cited_by_count":2,"area":null},{"id":"2108.12579","title":"Power-Based Attacks on Spatial DNN Accelerators","created":"2021-08-28","cited_by_count":1,"area":null},{"id":"2403.02870","title":"Precise Extraction of Deep Learning Models via Side-Channel Attacks on Edge/Endpoint Devices","created":"2024-03-05","cited_by_count":1,"area":null},{"id":"2411.13459","title":"SoK: A Systems Perspective on Compound AI Threats and Countermeasures","created":"2024-11-20","cited_by_count":1,"area":null},{"id":"2505.08793","title":"Onboard Optimization and Learning: A Survey","created":"2025-05-07","cited_by_count":1,"area":null},{"id":"2203.14803","title":"MixNN: A design for protecting deep learning models","created":"2022-03-28","cited_by_count":0,"area":null},{"id":"2207.09539","title":"Revealing Secrets From Pre-trained Models","created":"2022-07-19","cited_by_count":0,"area":null},{"id":"2208.01113","title":"On the Evaluation of User Privacy in Deep Neural Networks using Timing Side Channel","created":"2022-08-01","cited_by_count":0,"area":null},{"id":"2304.01990","title":"Side Channel-Assisted Inference Leakage from Machine Learning-based ECG Classification","created":"2023-04-04","cited_by_count":0,"area":null},{"id":"2304.06017","title":"Exploiting Logic Locking for a Neural Trojan Attack on Machine Learning Accelerators","created":"2023-04-12","cited_by_count":0,"area":null},{"id":"2307.10997","title":"DREAM: Domain-free Reverse Engineering Attributes of Black-box Model","created":"2023-07-20","cited_by_count":0,"area":null},{"id":"2311.00579","title":"Revealing CNN Architectures via Side-Channel Analysis in Dataflow-based Inference Accelerators","created":"2023-11-01","cited_by_count":0,"area":null},{"id":"2311.01205","title":"Attacking Graph Neural Networks with Bit Flips: Weisfeiler and Lehman Go Indifferent","created":"2023-11-02","cited_by_count":0,"area":null},{"id":"2402.11953","title":"Stealing the Invisible: Unveiling Pre-Trained CNN Models through Adversarial Examples and Timing Side-Channels","created":"2024-02-19","cited_by_count":0,"area":null},{"id":"2412.05842","title":"DREAM: Domain-agnostic Reverse Engineering Attributes of Black-box Model","created":"2024-12-08","cited_by_count":0,"area":null},{"id":"2505.06315","title":"Threat Modeling for AI: The Case for an Asset-Centric Approach","created":"2025-05-08","cited_by_count":0,"area":null},{"id":"2509.22060","title":"Decoding Deception: Understanding Automatic Speech Recognition Vulnerabilities in Evasion and Poisoning Attacks","created":"2025-09-26","cited_by_count":0,"area":null},{"id":"2603.25403","title":"Shape and Substance: Dual-Layer Side-Channel Attacks on Local Vision-Language Models","created":"2026-03-26","cited_by_count":0,"area":"mllm"},{"id":"2604.18716","title":"TrEEStealer: Stealing Decision Trees via Enclave Side Channels","created":"2026-04-20","cited_by_count":0,"area":null},{"id":"2606.10091","title":"SoK: Colluding Adversaries in Machine Learning Pipelines","created":"2026-06-08","cited_by_count":0,"area":null},{"id":"2608.02995","title":"SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channels","created":"2026-08-04","cited_by_count":0,"area":"inference"}],"next_cursor":null}