mlsanityData to 7 Oct 2026

Stateful Detection of Model Extraction Attacks

arXiv 2107.05166 ↗First posted 12 Jul 2021cs.LG cs.AI cs.CRcited by 8

Not on the map. Why?

Abstract (arXiv)

Machine-Learning-as-a-Service providers expose machine learning (ML) models through application programming interfaces (APIs) to developers. Recent work has shown that attackers can exploit these APIs to extract good approximations of such ML models, by querying them with samples of their choosing. We propose VarDetect, a stateful monitor that tracks the distribution of queries made by users of such a service, to detect model extraction attacks. Harnessing the latent distributions learned by a modified variational autoencoder, VarDetect robustly separates three types of attacker samples from benign samples, and successfully raises an alarm for each. Further, with VarDetect deployed as an automated defense mechanism, the extracted substitute models are found to exhibit poor performance and transferability, as intended. Finally, we demonstrate that even adaptive attackers with prior knowledge of the deployment of VarDetect, are detected by it.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Builds on 20 of its 36 references that are in the map. First posted on arXiv 12 Jul 2021.

Builds on

20 of 36 references.

References · 20

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  4. 2013Auto-Encoding Variational Bayescited by 3,980
  5. 2016Adversarial examples in the physical worldcited by 1,762
  6. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  7. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  8. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  9. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  10. 2019On Evaluating Adversarial Robustnesscited by 442
  11. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  12. 2019Deep Learning for Anomaly Detection: A Surveycited by 357
8 more
  1. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  2. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
  3. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  4. 2018Adversarial Active Learning for Deep Networks: a Margin Based Approachcited by 155
  5. 2018Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Datacited by 69
  6. 2017Model Extraction Warning in MLaaS Paradigmcited by 39
  7. 2019Extraction of Complex DNN Models: Real Threat or Boogeyman?cited by 19
  8. 2018Defending Against Adversarial Attacks by Leveraging an Entire GANcited by 4

Built on by

Cited by year

Citing papers per year: 2022: 2; 2023: 5; 2024: 0; 2025: 1.

8 papers.

  1. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  2. 2023Privacy Side Channels in Machine Learning Systemscited by 38
  3. 2022Increasing the Cost of Model Extraction with Calibrated Proof of Workcited by 21
  4. 2023Marich: A Query-efficient Distributionally Equivalent Model Extraction Attack using Public Datacited by 11
  5. 2023MalProtect: Stateful Defense Against Adversarial Query Attacks in ML-based Malware Detectioncited by 8
  6. 2025ATOM: A Framework of Detecting Query-Based Model Extraction Attacks for Graph Neural Networkscited by 8
  7. 2023FDINet: Protecting against DNN Model Extraction via Feature Distortion Indexcited by 3
  8. 2023Pareto-Secure Machine Learning (PSML): Fingerprinting and Securing Inference Serving Systemscited by 2