mlsanityData to 7 Oct 2026

High Accuracy and High Fidelity Extraction of Neural Networks

arXiv 1909.01838 ↗First posted 3 Sep 2019cs.LG cs.CR stat.MLcited by 208

Not on the map. Why?

Cited by 20 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

In a model extraction attack, an adversary steals a copy of a remotely deployed machine learning model, given oracle prediction access. We taxonomize model extraction attacks around two objectives: *accuracy*, i.e., performing well on the underlying learning task, and *fidelity*, i.e., matching the predictions of the remote victim classifier on any input. To extract a high-accuracy model, we develop a learning-based attack exploiting the victim to supervise the training of an extracted model. Through analytical and empirical arguments, we then explain the inherent limitations that prevent any learning-based strategy from extracting a truly high-fidelity model---i.e., extracting a functionally-equivalent model whose predictions are identical to those of the victim model on all possible inputs. Addressing these limitations, we expand on prior work to develop the first practical functionally-equivalent extraction attack for direct extraction (i.e., without training) of a model's weights. We perform experiments both on academic datasets and a state-of-the-art image classifier trained with 1 billion proprietary images. In addition to broadening the scope of model extraction research, our work demonstrates the practicality of model extraction attacks against production-grade systems.

Key facts. Cited by 208 papers in the map (data through 7 Oct 2026). First posted on arXiv 3 Sep 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 33; 2022: 38; 2023: 41; 2024: 36; 2025: 28; 2026: 32.

208 papers.

Sort:

By area:

  1. 2022Reconstructing Training Data from Trained Neural Networkscited by 129
  2. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  3. 2021Membership Inference Attack on Graph Neural Networkscited by 81
  4. 2021Proof-of-Learning: Definitions and Practicecited by 81
  5. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 80
  6. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  7. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  8. 2023Computationally Budgeted Continual Learning: What Does Matter?cited by 61
  9. 2022Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbationscited by 58
  10. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
  11. 2022"Real Attackers Don't Compute Gradients": Bridging the Gap Between Adversarial ML Research and Practicecited by 55
  12. 2021Membership Inference Attacks Against Recommender Systemscited by 52
38 more
  1. 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
  2. 2021Survey: Leakage and Privacy at Inference Timecited by 44
  3. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  4. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  5. 2021DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memoriescited by 42
  6. 2024Extracting Prompts by Inverting LLM Outputscited by 40
  7. 2022Dataset Inference for Self-Supervised Modelscited by 36
  8. 2021Quantifying and Mitigating Privacy Risks of Contrastive Learningcited by 35
  9. 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
  10. 2021Property Inference Attacks Against GANscited by 32
  11. 2022DualCF: Efficient Model Extraction Attack from Counterfactual Explanationscited by 31
  12. 2023Students Parrot Their Teachers: Membership Inference on Model Distillationcited by 31
  13. 2022Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoderscited by 30
  14. 2022Machine Learning for Microcontroller-Class Hardware: A Reviewcited by 28
  15. 2022Hardness of Noise-Free Learning for Two-Hidden-Layer Neural Networkscited by 27
  16. 2021Black-Box Dissector: Towards Erasing-based Hard-Label Model Stealing Attackcited by 25
  17. 2022On the Difficulty of Defending Self-Supervised Learning against Model Extractioncited by 22
  18. 2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 21
  19. 2022Increasing the Cost of Model Extraction with Calibrated Proof of Workcited by 21
  20. 2022Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networkscited by 21
  21. 2023No Privacy Left Outside: On the (In-)Security of TEE-Shielded DNN Partition for On-Device MLcited by 21
  22. 2023Model Extraction Attacks Revisitedcited by 21
  23. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 20
  24. 2023Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscationcited by 20
  25. 2024GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Searchcited by 20
  26. 2022Exploring Inconsistent Knowledge Distillation for Object Detection with Data Augmentationcited by 19
  27. 2021Honest-but-Curious Nets: Sensitive Attributes of Private Inputs Can Be Secretly Coded into the Classifiers' Outputscited by 18
  28. 2023Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Datacited by 18
  29. 2023False Claims against Model Ownership Resolutioncited by 17
  30. 2023Polynomial Time Cryptanalytic Extraction of Neural Network Modelscited by 17
  31. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  32. 2021Membership Inference Attacks are Easier on Difficult Problemscited by 16
  33. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  34. 2021Teacher Model Fingerprinting Attacks Against Transfer Learningcited by 15
  35. 2022Differentially Private Counterfactuals via Functional Mechanismcited by 13
  36. 2023Securing Distributed SGD against Gradient Leakage Threatscited by 13
  37. 2023Last One Standing: A Comparative Analysis of Security and Privacy of Soft Prompt Tuning, LoRA, and In-Context Learningcited by 13
  38. 2024SLIP: Securing LLMs IP Using Weights Decompositioncited by 13

50 most cited of 208 All 208 (JSON)