mlsanityData to 14 Oct 2026

PRADA: Protecting against DNN Model Stealing Attacks

arXiv 1805.02628 ↗First posted 7 May 2018cs.CRcited by 165

Not on the map. Why?

Cited by 23 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Machine learning (ML) applications are increasingly prevalent. Protecting the confidentiality of ML models becomes paramount for two reasons: (a) a model can be a business advantage to its owner, and (b) an adversary may use a stolen model to find transferable adversarial examples that can evade classification by the original model. Access to the model can be restricted to be only via well-defined prediction APIs. Nevertheless, prediction APIs still provide enough information to allow an adversary to mount model extraction attacks by sending repeated queries via the prediction API. In this paper, we describe new model extraction attacks using novel approaches for generating synthetic queries, and optimizing training hyperparameters. Our attacks outperform state-of-the-art model extraction in terms of transferability of both targeted and non-targeted adversarial examples (up to +29-44 percentage points, pp), and prediction accuracy (up to +46 pp) on two datasets. We provide take-aways on how to perform effective model extraction attacks. We then propose PRADA, the first step towards generic and effective detection of DNN model extraction attacks. It analyzes the distribution of consecutive API queries and raises an alarm when this distribution deviates from benign behavior. We show that PRADA can detect all prior model extraction attacks with no false positives.

Key facts. Cited by 165 papers in the map (data through 14 Oct 2026). First posted on arXiv 7 May 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 26; 2022: 31; 2023: 39; 2024: 24; 2025: 24; 2026: 21.

165 papers.

Sort:

By area:

  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  2. 2023The False Promise of Imitating Proprietary LLMscited by 263
  3. 2023Protecting Language Generation Models via Invisible Watermarkingcited by 90
  4. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermarkcited by 84
  5. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  6. 2023Bag of Tricks for Training Data Extraction from Language Modelscited by 70
  7. 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 66
  8. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 61
  9. 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
  10. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 46
  11. 2021Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Modelscited by 46
  12. 2021Survey: Leakage and Privacy at Inference Timecited by 44
38 more
  1. 2023Privacy Side Channels in Machine Learning Systemscited by 40
  2. 2021The Threat of Offensive AI to Organizationscited by 38
  3. 2021Undistillable: Making A Nasty Teacher That CANNOT teach studentscited by 36
  4. 2022Dataset Inference for Self-Supervised Modelscited by 36
  5. 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
  6. 2022DualCF: Efficient Model Extraction Attack from Counterfactual Explanationscited by 32
  7. 2022Distillation-Resistant Watermarking for Model Protection in NLPcited by 30
  8. 2021Black-Box Dissector: Towards Erasing-based Hard-Label Model Stealing Attackcited by 25
  9. 2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 23
  10. 2022On the Difficulty of Defending Self-Supervised Learning against Model Extractioncited by 22
  11. 2022Increasing the Cost of Model Extraction with Calibrated Proof of Workcited by 21
  12. 2022How to Steer Your Adversary: Targeted and Efficient Model Stealing Defenses with Gradient Redirectioncited by 21
  13. 2022Machine Learning Security in Industry: A Quantitative Surveycited by 21
  14. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 21
  15. 2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device MLcited by 21
  16. 2023Model Extraction Attacks Revisitedcited by 21
  17. 2023False Claims against Model Ownership Resolutioncited by 17
  18. 2024MEA-Defender: A Robust Watermark against Model Extraction Attackcited by 17
  19. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  20. 2022Poisoning Attacks and Defenses on Artificial Intelligence: A Surveycited by 16
  21. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  22. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  23. 2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 14
  24. 2021AdvParams: An Active DNN Intellectual Property Protection Technique via Adversarial Perturbation Based Parameter Encryptioncited by 13
  25. 2022Cosine Model Watermarking Against Ensemble Distillationcited by 13
  26. 2022Conflicting Interactions Among Protection Mechanisms for Machine Learning Modelscited by 12
  27. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 12
  28. 2023Marich: A Query-efficient Distributionally Equivalent Model Extraction Attack using Public Datacited by 11
  29. 2023Stateful Defenses for Machine Learning Models Are Not Yet Secure Against Black-box Attackscited by 11
  30. 2021SoK: Machine Learning Governancecited by 10
  31. 2022ezDPS: An Efficient and Zero-Knowledge Machine Learning Inference Pipelinecited by 10
  32. 2023Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoningcited by 10
  33. 2025CEGA: A Cost-Effective Approach for Graph-Based Model Extraction and Acquisitioncited by 10
  34. 2022A Survey on XAI for 5G and Beyond Security: Technical Aspects, Challenges and Research Directionscited by 9
  35. 2023AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Modelscited by 9
  36. 2024QUEEN: Query Unlearning against Model Extractioncited by 9
  37. 2021Model Extraction and Defenses on Generative Adversarial Networkscited by 8
  38. 2021Stateful Detection of Model Extraction Attackscited by 8

50 most cited of 165 All 165 (JSON)