mlsanityData to 7 Oct 2026

Data-Free Model Extraction

arXiv 2011.14779 ↗First posted 30 Nov 2020cs.LGcited by 121

Not on the map. Why?

Abstract (arXiv)

Current model extraction attacks assume that the adversary has access to a surrogate dataset with characteristics similar to the proprietary data used to train the victim model. This requirement precludes the use of existing model extraction techniques on valuable models, such as those trained on rare or hard to acquire datasets. In contrast, we propose data-free model extraction methods that do not require a surrogate dataset. Our approach adapts techniques from the area of data-free knowledge transfer for model extraction. As part of our study, we identify that the choice of loss is critical to ensuring that the extracted model is an accurate replica of the victim model. Furthermore, we address difficulties arising from the adversary's limited access to the victim model in a black-box setting. For example, we recover the model's logits from its probability predictions to approximate gradients. We find that the proposed data-free model extraction approach achieves high-accuracy with reasonable query complexity -- 0.99x and 0.92x the victim model accuracy on SVHN and CIFAR-10 datasets given 2M and 20M queries respectively.

Key facts. Cited by 121 papers in the map (data through 7 Oct 2026). First posted on arXiv 30 Nov 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 9; 2022: 17; 2023: 29; 2024: 27; 2025: 25; 2026: 14.

121 papers.

Sort:

By area:

  1. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  2. 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studiescited by 127
  3. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  4. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  5. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  6. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
  7. 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
  8. 2023Lion: Adversarial Distillation of Proprietary Large Language Modelscited by 33
  9. 2021FedZKT: Zero-Shot Knowledge Transfer towards Resource-Constrained Federated Learning with Heterogeneous On-Device Modelscited by 31
  10. 2021Data-Free Knowledge Transfer: A Surveycited by 31
  11. 2023Learning to Retain while Acquiring: Combating Distribution-Shift in Adversarial Data-Free Knowledge Distillationcited by 29
  12. 2023Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Predictioncited by 26
38 more
  1. 2021Watermarking Graph Neural Networks based on Backdoor Attackscited by 25
  2. 2025Integrating LLMs with ITS: Recent Advances, Potentials, Challenges, and Future Directionscited by 23
  3. 2022On the Difficulty of Defending Self-Supervised Learning against Model Extractioncited by 22
  4. 2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 21
  5. 2022Increasing the Cost of Model Extraction with Calibrated Proof of Workcited by 21
  6. 2022Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networkscited by 21
  7. 2023Model Extraction Attacks Revisitedcited by 21
  8. 2023Learning to Learn from APIs: Black-Box Data-Free Meta-Learningcited by 18
  9. 2023Dual Student Networks for Data-Free Model Stealingcited by 17
  10. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17
  11. 2022IDEAL: Query-Efficient Data-Free Learning from Black-box Modelscited by 16
  12. 2022CDFKD-MFS: Collaborative Data-free Knowledge Distillation via Multi-level Feature Sharingcited by 15
  13. 2023Last One Standing: A Comparative Analysis of Security and Privacy of Soft Prompt Tuning, LoRA, and In-Context Learningcited by 13
  14. 2024SLIP: Securing LLMs IP Using Weights Decompositioncited by 13
  15. 2023Marich: A Query-efficient Distributionally Equivalent Model Extraction Attack using Public Datacited by 11
  16. 2023Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attackscited by 10
  17. 2021SoK: Machine Learning Governancecited by 9
  18. 2022Split HE: Fast Secure Inference Combining Split Learning and Homomorphic Encryptioncited by 9
  19. 2023Passive Inference Attacks on Split Learning via Adversarial Regularizationcited by 9
  20. 2024Reliable Model Watermarking: Defending Against Theft without Compromising on Evasioncited by 9
  21. 2024QUEEN: Query Unlearning against Model Extractioncited by 9
  22. 2023Bucks for Buckets (B4B): Active Defenses Against Stealing Encoderscited by 8
  23. 2024A Middle Path for On-Premises LLM Deployment: Preserving Privacy Without Sacrificing Model Confidentialitycited by 8
  24. 2025MISLEADER: Defending against Model Extraction with Ensembles of Distilled Modelscited by 8
  25. 2022Dynamic Data-Free Knowledge Distillation by Easy-to-Hard Learning Strategycited by 7
  26. 2023Robust and IP-Protecting Vertical Federated Learning against Unexpected Quitting of Partiescited by 7
  27. 2024Beyond Slow Signs in High-fidelity Model Extractioncited by 7
  28. 2022Careful What You Wish For: on the Extraction of Adversarially Trained Modelscited by 6
  29. 2022Private and Reliable Neural Network Inferencecited by 6
  30. 2023Continual Learning From a Stream of APIscited by 6
  31. 2023SoK: Pitfalls in Evaluating Black-Box Attackscited by 6
  32. 2023Army of Thieves: Enhancing Black-Box Model Extraction via Ensemble based sample selectioncited by 6
  33. 2023Data-Free Hard-Label Robustness Stealing Attackcited by 6
  34. 2024Locking Machine Learning Models into Hardwarecited by 6
  35. 2023Model Extraction Attacks on Split Federated Learningcited by 5
  36. 2023Bridging the Gap between Decision and Logits in Decision-based Knowledge Distillation for Pre-trained Language Modelscited by 5
  37. 2024AuG-KD: Anchor-Based Mixup Generation for Out-of-Domain Knowledge Distillationcited by 5
  38. 2024Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealingcited by 5

50 most cited of 121 All 121 (JSON)