mlsanityData to 7 Oct 2026

Increasing the Cost of Model Extraction with Calibrated Proof of Work

arXiv 2201.09243 ↗First posted 23 Jan 2022cs.CR cs.AI cs.CVcited by 21

Not on the map. Why?

Abstract (arXiv)

In model extraction attacks, adversaries can steal a machine learning model exposed via a public API by repeatedly querying it and adjusting their own model based on obtained predictions. To prevent model stealing, existing defenses focus on detecting malicious queries, truncating, or distorting outputs, thus necessarily introducing a tradeoff between robustness and model utility for legitimate users. Instead, we propose to impede model extraction by requiring users to complete a proof-of-work before they can read the model's predictions. This deters attackers by greatly increasing (even up to 100x) the computational effort needed to leverage query access for model extraction. Since we calibrate the effort required to complete the proof-of-work to each query, this only introduces a slight overhead for regular users (up to 2x). To achieve this, our calibration applies tools from differential privacy to measure the information revealed by a query. Our method requires no modification of the victim model and can be applied by machine learning practitioners to guard their publicly exposed models against being easily stolen.

Key facts. Cited by 21 papers in the map (data through 7 Oct 2026). Builds on 29 of its 52 references that are in the map. First posted on arXiv 23 Jan 2022.

Builds on

29 of 52 references.

References · 29

  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2019MixMatch: A Holistic Approach to Semi-Supervised Learningcited by 1,390
  3. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  4. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  5. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  6. 2017Renyi Differential Privacycited by 643
  7. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  8. 2020Generalized ODIN: Detecting Out-of-distribution Image without Learning from Out-of-distribution Datacited by 408
  9. 2016Semi-supervised Knowledge Transfer for Deep Learning from Private Training Datacited by 347
  10. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  11. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  12. 2018Scalable Private Learning with PATEcited by 266
17 more
  1. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  2. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  3. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  4. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  5. 2020Data-Free Model Extractioncited by 121
  6. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  7. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
  8. 2018Exploring Connections Between Active Learning and Model Extractioncited by 84
  9. 2021Proof-of-Learning: Definitions and Practicecited by 81
  10. 2019Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attackscited by 79
  11. 2018Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Datacited by 69
  12. 2019Defending Against Model Stealing Attacks with Adaptive Misinformationcited by 55
  13. 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
  14. 2019A framework for the extraction of Deep Neural Networks by leveraging public datacited by 22
  15. 2019Extraction of Complex DNN Models: Real Threat or Boogeyman?cited by 19
  16. 2021Thief, Beware of What Get You There: Towards Understanding Model Extraction Attackcited by 9
  17. 2021Stateful Detection of Model Extraction Attackscited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 6; 2023: 5; 2024: 4; 2025: 4; 2026: 2.

21 papers.

Sort:

By area:

  1. 2023The False Promise of Imitating Proprietary LLMscited by 254
  2. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  3. 2022Dataset Inference for Self-Supervised Modelscited by 36
  4. 2022On the Difficulty of Defending Self-Supervised Learning against Model Extractioncited by 22
  5. 2022Conflicting Interactions Among Protection Mechanisms for Machine Learning Modelscited by 12
  6. 2024QUEEN: Query Unlearning against Model Extractioncited by 9
  7. 2022On the Robustness of Dataset Inferencecited by 8
  8. 2023Bucks for Buckets (B4B): Active Defenses Against Stealing Encoderscited by 8
  9. 2023Beyond Labeling Oracles: What does it mean to steal ML models?cited by 4
  10. 2023SAME: Sample Reconstruction against Model Extraction Attackscited by 4
  11. 2023FDINet: Protecting against DNN Model Extraction via Feature Distortion Indexcited by 3
  12. 2024Efficient Model-Stealing Attacks Against Inductive Graph Neural Networkscited by 3
9 more
  1. 2025ADAGE: Active Defenses Against GNN Extractioncited by 2
  2. 2024LDPKiT: Superimposing Remote Queries for Privacy-Preserving Distillationcited by 1
  3. 2025Model-Guardian: Protecting against Data-Free Model Stealing Using Gradient Representations and Deceptive Predictionscited by 1
  4. 2025Efficient and Privacy-Preserving Soft Prompt Transfer for LLMscited by 1
  5. 2025LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systemscited by 1
  6. 2026Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypotcited by 1
  7. 2022One Picture is Worth a Thousand Words: A New Wallet Recovery Processcited by 0
  8. 2024Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Themcited by 0
  9. 2026Caliber: Cross-Architecture Extraction-Cost Control for Score-Returning APIscited by 0