mlsanityData to 7 Oct 2026

Knockoff Nets: Stealing Functionality of Black-Box Models

arXiv 1812.02766 ↗First posted 6 Dec 2018cs.CV cs.CR cs.LGcited by 285

Not on the map. Why?

Cited by 31 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Machine Learning (ML) models are increasingly deployed in the wild to perform a wide range of tasks. In this work, we ask to what extent can an adversary steal functionality of such "victim" models based solely on blackbox interactions: image in, predictions out. In contrast to prior work, we present an adversary lacking knowledge of train/test data used by the model, its internals, and semantics over model outputs. We formulate model functionality stealing as a two-step approach: (i) querying a set of input images to the blackbox model to obtain predictions; and (ii) training a "knockoff" with queried image-prediction pairs. We make multiple remarkable observations: (a) querying random images from a different distribution than that of the blackbox training data results in a well-performing knockoff; (b) this is possible even when the knockoff is represented using a different architecture; and (c) our reinforcement learning approach additionally improves query sample efficiency in certain settings and provides performance gains. We validate model functionality stealing on a range of datasets and tasks, as well as on a popular image analysis API where we create a reasonable knockoff for as little as 30.

Key facts. Cited by 285 papers in the map (data through 7 Oct 2026). First posted on arXiv 6 Dec 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 47; 2022: 50; 2023: 63; 2024: 49; 2025: 41; 2026: 35.

285 papers.

Sort:

By area:

  1. 2023The False Promise of Imitating Proprietary LLMscited by 254
  2. 2021Graph Unlearningcited by 129
  3. 2021Explainable AI (XAI): A Systematic Meta-Survey of Current Challenges and Future Opportunitiescited by 125
  4. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  5. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  6. 2021Proof-of-Learning: Definitions and Practicecited by 81
  7. 2023Protecting Language Generation Models via Invisible Watermarkingcited by 81
  8. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 80
  9. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Modelscited by 79
  10. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  11. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  12. 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermarkcited by 61
38 more
  1. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
  2. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
  3. 2021Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!cited by 51
  4. 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
  5. 2022SoK: Let the Privacy Games Begin! A Unified Treatment of Data Inference Privacy in Machine Learningcited by 47
  6. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  7. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  8. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  9. 2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
  10. 2021Zero-Shot Knowledge Distillation from a Decision-Based Black-Box Modelcited by 37
  11. 2021Quantifying and Mitigating Privacy Risks of Contrastive Learningcited by 35
  12. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 34
  13. 2021ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detectioncited by 33
  14. 2021FedIPR: Ownership Verification for Federated Deep Neural Network Modelscited by 33
  15. 2023Lion: Adversarial Distillation of Proprietary Large Language Modelscited by 33
  16. 2021Property Inference Attacks Against GANscited by 32
  17. 2022A Comprehensive Survey on Trustworthy Recommender Systemscited by 32
  18. 2022DualCF: Efficient Model Extraction Attack from Counterfactual Explanationscited by 31
  19. 2023Students Parrot Their Teachers: Membership Inference on Model Distillationcited by 31
  20. 2022Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoderscited by 30
  21. 2022Distillation-Resistant Watermarking for Model Protection in NLPcited by 29
  22. 2021Delving into Data: Effectively Substitute Training for Black-box Attackcited by 27
  23. 2025SynthID-Image: Image watermarking at internet scalecited by 26
  24. 2021Black-Box Dissector: Towards Erasing-based Hard-Label Model Stealing Attackcited by 25
  25. 2021Watermarking Graph Neural Networks based on Backdoor Attackscited by 25
  26. 2022On the Difficulty of Defending Self-Supervised Learning against Model Extractioncited by 22
  27. 2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 21
  28. 2022Increasing the Cost of Model Extraction with Calibrated Proof of Workcited by 21
  29. 2022How to Steer Your Adversary: Targeted and Efficient Model Stealing Defenses with Gradient Redirectioncited by 21
  30. 2022Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networkscited by 21
  31. 2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device MLcited by 21
  32. 2023Model Extraction Attacks Revisitedcited by 21
  33. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 20
  34. 2023Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscationcited by 20
  35. 2021"Adversarial Examples" for Proof-of-Learningcited by 19
  36. 2023Stealing the Decoding Algorithms of Language Modelscited by 19
  37. 2023False Claims against Model Ownership Resolutioncited by 17
  38. 2023Dual Student Networks for Data-Free Model Stealingcited by 17

50 most cited of 285 All 285 (JSON)