mlsanityData to 14 Oct 2026

Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoders

arXiv 2201.07513 ↗First posted 19 Jan 2022cs.CR cs.LGcited by 31

Not on the map. Why?

Abstract (arXiv)

Self-supervised representation learning techniques have been developing rapidly to make full use of unlabeled images. They encode images into rich features that are oblivious to downstream tasks. Behind their revolutionary representation power, the requirements for dedicated model designs and a massive amount of computation resources expose image encoders to the risks of potential model stealing attacks - a cheap way to mimic the well-trained encoder performance while circumventing the demanding requirements. Yet conventional attacks only target supervised classifiers given their predicted labels and/or posteriors, which leaves the vulnerability of unsupervised encoders unexplored. In this paper, we first instantiate the conventional stealing attacks against encoders and demonstrate their severer vulnerability compared with downstream classifiers. To better leverage the rich representation of encoders, we further propose Cont-Steal, a contrastive-learning-based attack, and validate its improved stealing effectiveness in various experiment settings. As a takeaway, we appeal to our community's attention to the intellectual property protection of representation learning techniques, especially to the defenses against encoder stealing attacks like ours.

Key facts. Cited by 31 papers in the map (data through 14 Oct 2026). Builds on 49 of its 68 references that are in the map. First posted on arXiv 19 Jan 2022.

Builds on

49 of 68 references.

References · 49

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  3. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  4. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  5. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 12,049
  6. 2015Distilling the Knowledge in a Neural Networkcited by 10,324
  7. 2018Representation Learning with Contrastive Predictive Codingcited by 7,777
  8. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,513
  9. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,403
  10. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  11. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  12. 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,750
37 more
  1. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,349
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  3. 2020Exploring Simple Siamese Representation Learningcited by 2,866
  4. 2020Supervised Contrastive Learningcited by 2,829
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  6. 2019RandAugment: Practical automated data augmentation with a reduced search spacecited by 2,269
  7. 2018Unsupervised Feature Learning via Non-Parametric Instance-level Discriminationcited by 1,845
  8. 2016Adversarial examples in the physical worldcited by 1,769
  9. 2018Unsupervised Representation Learning by Predicting Image Rotationscited by 1,591
  10. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  12. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  13. 2019Contrastive Representation Distillationcited by 748
  14. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  15. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  16. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  17. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  18. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  19. 2020Systematic Evaluation of Privacy Risks of Machine Learning Modelscited by 292
  20. 2019White-box vs Black-box: Bayes Optimal Strategies for Membership Inferencecited by 271
  21. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
  22. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  23. 2019Local Aggregation for Unsupervised Learning of Visual Embeddingscited by 204
  24. 2017Multi-task Self-Supervised Visual Learningcited by 200
  25. 2018Machine Learning with Membership Privacy using Adversarial Regularizationcited by 186
  26. 2018SpotTune: Transfer Learning through Adaptive Fine-tuningcited by 168
  27. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 151
  28. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 139
  29. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 123
  30. 2018Stealing Hyperparameters in Machine Learningcited by 118
  31. 2021Node-Level Membership Inference Attacks Against Graph Neural Networkscited by 84
  32. 2021Practical Blind Membership Inference Attack via Differential Comparisonscited by 78
  33. 2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learningcited by 73
  34. 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
  35. 2021Quantifying and Mitigating Privacy Risks of Contrastive Learningcited by 36
  36. 2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 23
  37. 2020Don't Trigger Me! A Triggerless Backdoor Attack Against Deep Neural Networkscited by 19

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 3; 2023: 11; 2024: 8; 2025: 8; 2026: 1.

31 papers.

Sort:

By area:

  1. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  2. 2022Dataset Inference for Self-Supervised Modelscited by 36
  3. 2023Downstream-agnostic Adversarial Examplescited by 32
  4. 2022Auditing Membership Leakages of Multi-Exit Networkscited by 27
  5. 2024MEA-Defender: A Robust Watermark against Model Extraction Attackcited by 17
  6. 2023Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Servicecited by 11
  7. 2023Bucks for Buckets (B4B): Active Defenses Against Stealing Encoderscited by 8
  8. 2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
  9. 2023A Plot is Worth a Thousand Words: Model Information Stealing Attacks via Scientific Plotscited by 5
  10. 2025Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removalcited by 5
  11. 2023SecurityNet: Assessing Machine Learning Vulnerabilities on Public Modelscited by 4
  12. 2023FDINet: Protecting against DNN Model Extraction via Feature Distortion Indexcited by 3
19 more
  1. 2024Training Data Attribution: Was Your Model Secretly Trained On Data Created By Mine?cited by 3
  2. 2025Clone What You Can't Steal: Black-Box LLM Replication via Logit Leakage and Distillationcited by 3
  3. 2024New Emerged Security and Privacy of Pre-trained Model: a Survey and Outlookcited by 2
  4. 2025Examining the Threat Landscape: Foundation Models and Model Stealingcited by 2
  5. 2025ADAGE: Active Defenses Against GNN Extractioncited by 2
  6. 2025BESA: Boosting Encoder Stealing Attack with Perturbation Recoverycited by 2
  7. 2025Dataset Ownership Verification for Pre-trained Masked Modelscited by 2
  8. 2023SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learningcited by 1
  9. 2024PromptSync: Bridging Domain Gaps in Vision-Language Models through Class-Aware Prototype Alignment and Discriminationcited by 1
  10. 2026Decoder Gradient Shields: A Family of Provable and High-Fidelity Methods Against Gradient-Based Box-Free Watermark Removalcited by 1
  11. 2023DREAM: Domain-free Reverse Engineering Attributes of Black-box Modelcited by 0
  12. 2023Refine, Discriminate and Align: Stealing Encoders via Sample-Wise Prototypes and Multi-Relational Extractioncited by 0
  13. 2023MEAOD: Model Extraction Attack against Object Detectorscited by 0
  14. 2024Imitating the Functionality of Image-to-Image Models Using a Single Examplecited by 0
  15. 2024Pre-trained Encoder Inference: Revealing Upstream Encoders In Downstream Machine Learning Servicescited by 0
  16. 2024Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermarkcited by 0
  17. 2024DREAM: Domain-agnostic Reverse Engineering Attributes of Black-box Modelcited by 0
  18. 2025Rotation, Scale, and Translation Resilient Black-box Fingerprinting for Intellectual Property Protection of EaaS Modelscited by 0
  19. 2025On Stealing Graph Neural Network Modelscited by 0