Data to 7 Oct 2026

Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks

arXiv 1906.10908 ↗First posted 26 Jun 2019cs.LG cs.CR cs.CVcited by 79

Not on the map. Why?

Abstract (arXiv)

High-performance Deep Neural Networks (DNNs) are increasingly deployed in many real-world applications e.g., cloud prediction APIs. Recent advances in model functionality stealing attacks via black-box access (i.e., inputs in, predictions out) threaten the business model of such applications, which require a lot of time, money, and effort to develop. Existing defenses take a passive role against stealing attacks, such as by truncating predicted information. We find such passive defenses ineffective against DNN stealing attacks. In this paper, we propose the first defense which actively perturbs predictions targeted at poisoning the training objective of the attacker. We find our defense effective across a wide range of challenging datasets and DNN model stealing attacks, and additionally outperforms existing defenses. Our defense is the first that can withstand highly accurate model stealing attacks for tens of thousands of queries, amplifying the attacker's error rate up to a factor of 85× with minimal impact on the utility for benign users.

Key facts. Cited by 79 papers in the map (data through 7 Oct 2026). First posted on arXiv 26 Jun 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 12; 2022: 18; 2023: 14; 2024: 10; 2025: 16; 2026: 9.

79 papers.

Sort:

By area:

2023The False Promise of Imitating Proprietary LLMscited by 254
2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 63
2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
2021Undistillable: Making A Nasty Teacher That CANNOT teach studentscited by 36
2022Dataset Inference for Self-Supervised Modelscited by 36
2021Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Releasecited by 35
2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
2025SynthID-Image: Image watermarking at internet scalecited by 26
2021Black-Box Dissector: Towards Erasing-based Hard-Label Model Stealing Attackcited by 25
2022On the Difficulty of Defending Self-Supervised Learning against Model Extractioncited by 22

38 more

2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 21
2022Increasing the Cost of Model Extraction with Calibrated Proof of Workcited by 21
2022How to Steer Your Adversary: Targeted and Efficient Model Stealing Defenses with Gradient Redirectioncited by 21
2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device MLcited by 21
2023Model Extraction Attacks Revisitedcited by 21
2022Conflicting Interactions Among Protection Mechanisms for Machine Learning Modelscited by 12
2024Trustworthy Distributed AI Systems: Robustness, Privacy, and Governancecited by 12
2024A Large-Scale Exploit Instrumentation Study of AI/ML Supply Chain Attacks in Hugging Face Modelscited by 12
2022On the Effectiveness of Dataset Watermarking in Adversarial Settingscited by 11
2022ezDPS: An Efficient and Zero-Knowledge Machine Learning Inference Pipelinecited by 10
2023Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attackscited by 10
2021SoK: Machine Learning Governancecited by 9
2023Security Considerations in AI-Robotics: A Survey of Current Methods, Challenges, and Opportunitiescited by 9
2024QUEEN: Query Unlearning against Model Extractioncited by 9
2024Model Stealing for Any Low-Rank Language Modelcited by 9
2022On the Robustness of Dataset Inferencecited by 8
2025MISLEADER: Defending against Model Extraction with Ensembles of Distilled Modelscited by 8
2022Private, Efficient, and Accurate: Protecting Models Trained by Multi-party Learning with Differential Privacycited by 7
2023Robust and IP-Protecting Vertical Federated Learning against Unexpected Quitting of Partiescited by 7
2022Careful What You Wish For: on the Extraction of Adversarially Trained Modelscited by 6
2022HAPI: A Large-scale Longitudinal Dataset of Commercial ML API Predictionscited by 6
202110 Security and Privacy Problems in Large Foundation Modelscited by 5
2024Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealingcited by 5
2025HoneypotNet: Backdoor Attacks Against Model Extractioncited by 5
2025Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removalcited by 5
2021Fingerprinting Multi-exit Deep Neural Network Models via Inference Timecited by 4
2023A Plot is Worth a Thousand Words: Model Information Stealing Attacks via Scientific Plotscited by 4
2023Beyond Labeling Oracles: What does it mean to steal ML models?cited by 4
2026CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attackscited by 4
2021Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Modelscited by 3
2022TinyMLOps: Operational Challenges for Widespread Edge AI Adoptioncited by 3
2023FDINet: Protecting against DNN Model Extraction via Feature Distortion Indexcited by 3
2024Stealthy Imitation: Reward-guided Environment-free Policy Stealingcited by 3
2024TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Modelscited by 3
2025Towards Undistillable Models by Minimizing Conditional Mutual Informationcited by 3
2021"What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Modelscited by 2
2021HODA: Hardness-Oriented Detection of Model Extraction Attackscited by 2
2023Pareto-Secure Machine Learning (PSML): Fingerprinting and Securing Inference Serving Systemscited by 2

50 most cited of 79 All 79 (JSON)