mlsanityData to 14 Oct 2026

Exploring Connections Between Active Learning and Model Extraction

arXiv 1811.02054 ↗First posted 5 Nov 2018cs.LG cs.CR stat.MLcited by 85

Not on the map. Why?

Abstract (arXiv)

Machine learning is being increasingly used by individuals, research institutions, and corporations. This has resulted in the surge of Machine Learning-as-a-Service (MLaaS) - cloud services that provide (a) tools and resources to learn the model, and (b) a user-friendly query interface to access the model. However, such MLaaS systems raise privacy concerns such as model extraction. In model extraction attacks, adversaries maliciously exploit the query interface to steal the model. More precisely, in a model extraction attack, a good approximation of a sensitive or proprietary model held by the server is extracted (i.e. learned) by a dishonest user who interacts with the server only via the query interface. This attack was introduced by Tramer et al. at the 2016 USENIX Security Symposium, where practical attacks for various models were shown. We believe that better understanding the efficacy of model extraction attacks is paramount to designing secure MLaaS systems. To that end, we take the first step by (a) formalizing model extraction and discussing possible defense strategies, and (b) drawing parallels between model extraction and established area of active learning. In particular, we show that recent advancements in the active learning domain can be used to implement powerful model extraction attacks, and investigate possible defense strategies.

Key facts. Cited by 85 papers in the map (data through 14 Oct 2026). First posted on arXiv 5 Nov 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 17; 2022: 21; 2023: 17; 2024: 11; 2025: 9; 2026: 10.

85 papers.

Sort:

By area:

  1. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 116
  2. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  3. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  4. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 61
  5. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 58
  6. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 56
  7. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 55
  8. 2021Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!cited by 53
  9. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 46
  10. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 45
  11. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  12. 2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
38 more
  1. 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
  2. 2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 23
  3. 2022Increasing the Cost of Model Extraction with Calibrated Proof of Workcited by 21
  4. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 21
  5. 2023Model Extraction Attacks Revisitedcited by 21
  6. 2024Poison-splat: Computation Cost Attack on 3D Gaussian Splattingcited by 18
  7. 2022SoK: The Impact of Unlabelled Data in Cyberthreat Detectioncited by 15
  8. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 12
  9. 2023Marich: A Query-efficient Distributionally Equivalent Model Extraction Attack using Public Datacited by 11
  10. 2023Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Servicecited by 11
  11. 2021SoK: Machine Learning Governancecited by 10
  12. 2022ezDPS: An Efficient and Zero-Knowledge Machine Learning Inference Pipelinecited by 10
  13. 2021Hitting the Target: Stopping Active Learning at the Cost-Based Optimumcited by 9
  14. 2022ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networkscited by 9
  15. 2023AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Modelscited by 9
  16. 2021Model Extraction and Defenses on Generative Adversarial Networkscited by 8
  17. 2021GAL: Gradient Assisted Learning for Decentralized Multi-Organization Collaborationscited by 8
  18. 2026On Protecting Agentic Systems' Intellectual Property via Watermarkingcited by 8
  19. 2021Evaluating the Cybersecurity Risk of Real World, Machine Learning Production Systemscited by 6
  20. 202110 Security and Privacy Problems in Large Foundation Modelscited by 6
  21. 2023MeaeQ: Mount Model Extraction Attacks with Efficient Queriescited by 6
  22. 2023Army of Thieves: Enhancing Black-Box Model Extraction via Ensemble based sample selectioncited by 6
  23. 2023Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidencecited by 5
  24. 2023Fault Injection and Safe-Error Attack for Extraction of Embedded Neural Network Modelscited by 5
  25. 2022AWEncoder: Adversarial Watermarking Pre-trained Encoders in Contrastive Learningcited by 4
  26. 2022Privacy of Autonomous Vehicles: Risks, Protection Methods, and Future Directionscited by 4
  27. 2023Beyond Labeling Oracles: What does it mean to steal ML models?cited by 4
  28. 2023SAME: Sample Reconstruction against Model Extraction Attackscited by 4
  29. 2024Efficient and Effective Model Extractioncited by 4
  30. 2025GRID: Protecting Training Graph from Link Stealing Attacks on GNN Modelscited by 4
  31. 2025RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service Copyright Protectioncited by 4
  32. 2021HODA: Hardness-Oriented Detection of Model Extraction Attackscited by 3
  33. 2022Adversarial Machine Learning Threat Analysis and Remediation in Open Radio Access Network (O-RAN)cited by 3
  34. 2023Active Cost-aware Labeling of Streaming Datacited by 3
  35. 2023FDINet: Protecting against DNN Model Extraction via Feature Distortion Indexcited by 3
  36. 2023The Power of MEME: Adversarial Malware Creation with Model-Based Reinforcement Learningcited by 3
  37. 2024TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Modelscited by 3
  38. 2026An Embarrassingly Simple Detector for Model Extraction Attacks in Large Language Model API Trafficcited by 3

50 most cited of 85 All 85 (JSON)