mlsanityData to 7 Oct 2026

Defending against Model Stealing via Verifying Embedded External Features

arXiv 2112.03476 ↗First posted 7 Dec 2021cs.CR cs.AI cs.CVcited by 44

Not on the map. Why?

Abstract (arXiv)

Obtaining a well-trained model involves expensive data collection and training procedures, therefore the model is a valuable intellectual property. Recent studies revealed that adversaries can `steal' deployed models even when they have no training samples and can not get access to the model parameters or structures. Currently, there were some defense methods to alleviate this threat, mostly by increasing the cost of model stealing. In this paper, we explore the defense from another angle by verifying whether a suspicious model contains the knowledge of defender-specified external features. Specifically, we embed the external features by tempering a few training samples with style transfer. We then train a meta-classifier to determine whether a model is stolen from the victim. This approach is inspired by the understanding that the stolen models should contain the knowledge of features learned by the victim model. We examine our method on both CIFAR-10 and ImageNet datasets. Experimental results demonstrate that our method is effective in detecting different types of model stealing simultaneously, even if the stolen model is obtained via a multi-stage stealing process. The codes for reproducing main results are available at Github (https://github.com/zlh-thu/StealingVerification).

Key facts. Cited by 44 papers in the map (data through 7 Oct 2026). Builds on 43 of its 59 references that are in the map. First posted on arXiv 7 Dec 2021.

Builds on

43 of 59 references.

References · 43

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 4,993
  6. 2016Wide Residual Networkscited by 3,057
  7. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
  8. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  9. 2017Arbitrary Style Transfer in Real-time with Adaptive Instance Normalizationcited by 1,998
  10. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  11. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  12. 2016Universal adversarial perturbationscited by 774
31 more
  1. 2020Image Segmentation Using Deep Learning: A Surveycited by 659
  2. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  3. 2019Deep Learning for 3D Point Clouds: A Surveycited by 557
  4. 2020Backdoor Learning: A Surveycited by 412
  5. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  6. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  7. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  8. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  9. 2020Large image datasets: A pyrrhic win for computer vision?cited by 237
  10. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  11. 2020Blind Backdoors in Deep Learning Modelscited by 174
  12. 2019Stolen Memories: Leveraging Model Memorization for Calibrated White-Box Membership Inferencecited by 168
  13. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  14. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  15. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  16. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  17. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  18. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  19. 2020Feature Inference Attack on Model Predictions in Vertical Federated Learningcited by 105
  20. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  21. 2019Data-Free Adversarial Distillationcited by 90
  22. 2018Exploring Connections Between Active Learning and Model Extractioncited by 84
  23. 2021Backdoor Attack in the Physical Worldcited by 82
  24. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 73
  25. 2020Backdoor Attack against Speaker Verificationcited by 62
  26. 2019Defending Against Model Stealing Attacks with Adaptive Misinformationcited by 55
  27. 2020Passport-aware Normalization for Deep Model Protectioncited by 42
  28. 2017Model Extraction Warning in MLaaS Paradigmcited by 39
  29. 2020Optical Flow Distillation: Towards Efficient and Stable Video Style Transfercited by 34
  30. 2020Joint Item Recommendation and Attribute Inference: An Adaptive Graph Convolutional Network Approachcited by 30
  31. 2020Open-sourced Dataset Protection via Backdoor Watermarkingcited by 30

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 5; 2023: 11; 2024: 15; 2025: 10; 2026: 3.

44 papers.

Sort:

By area:

  1. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  2. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  3. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
  4. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Modelscited by 42
  5. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  6. 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attributioncited by 35
  7. 2023A Survey on ChatGPT: AI-Generated Contents, Challenges, and Solutionscited by 34
  8. 2023HuRef: HUman-REadable Fingerprint for Large Language Modelscited by 32
  9. 2022Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networkscited by 21
  10. 2022MOVE: Effective and Harmless Ownership Verification via Embedded External Featurescited by 20
  11. 2023Does Few-shot Learning Suffer from Backdoor Attacks?cited by 19
  12. 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 17
32 more
  1. 2023GrOVe: Ownership Verification of Graph Neural Networks using Embeddingscited by 16
  2. 2024MEA-Defender: A Robust Watermark against Model Extraction Attackcited by 16
  3. 2025Model Provenance Testing for Large Language Modelscited by 15
  4. 2023Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attackscited by 10
  5. 2023Towards Robust Model Watermark via Reducing Parametric Vulnerabilitycited by 10
  6. 2023Wide Flat Minimum Watermarking for Robust Ownership Verification of GANscited by 10
  7. 2023Fake the Real: Backdoor Attack on Deep Speech Classification via Voice Conversioncited by 9
  8. 2024Ungeneralizable Examplescited by 9
  9. 2024Neural Lineagecited by 9
  10. 2024Model Stealing for Any Low-Rank Language Modelcited by 9
  11. 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprintcited by 8
  12. 2025DuFFin: A Dual-Level Fingerprinting Framework for LLMs IP Protectioncited by 8
  13. 2024Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealingcited by 5
  14. 2025HoneypotNet: Backdoor Attacks Against Model Extractioncited by 5
  15. 2023Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Triggercited by 4
  16. 2024DeepEclipse: How to Break White-Box DNN-Watermarking Schemescited by 4
  17. 2023FDINet: Protecting against DNN Model Extraction via Feature Distortion Indexcited by 3
  18. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systemscited by 3
  19. 2024Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Datacited by 2
  20. 2024Lazy Layers to Make Fine-Tuned Diffusion Models More Traceablecited by 2
  21. 2024Sample Correlation for Fingerprinting Deep Face Recognitioncited by 2
  22. 2025Holmes: Towards Effective and Harmless Model Ownership Verification to Personalized Large Vision Models via Decoupling Common Featurescited by 2
  23. 2025TED++: Submanifold-Aware Backdoor Detection via Layerwise Tubular-Neighbourhood Screeningcited by 2
  24. 2025Model-Guardian: Protecting against Data-Free Model Stealing Using Gradient Representations and Deceptive Predictionscited by 1
  25. 2025ActiveMark: on watermarking of visual foundation models via massive activationscited by 1
  26. 2024Binary Linear Tree Commitment-based Ownership Protection for Distributed Machine Learningcited by 0
  27. 2024A2-DIDM: Privacy-preserving Accumulator-enabled Auditing for Distributed Identity of DNN Modelcited by 0
  28. 2024DeepCore: Simple Fingerprint Construction for Differentiating Homologous and Piracy Modelscited by 0
  29. 2024Bounding-box Watermarking: Defense against Model Extraction Attacks on Object Detectorscited by 0
  30. 2025NWaaS: A Non-Intrusive and Privacy-Preserving Watermarking-as-a-Service System with Adaptive Resource Schedulingcited by 0
  31. 2026Detecting Semantic Backdoors in a Mystery Shopping Scenariocited by 0
  32. 2026RandMark: On Random Watermarking of Visual Foundation Modelscited by 0