mlsanityData to 7 Oct 2026

Data-Free Hard-Label Robustness Stealing Attack

arXiv 2312.05924 ↗First posted 10 Dec 2023cs.CV cs.CR cs.LGcited by 6

Not on the map. Why?

Abstract (arXiv)

The popularity of Machine Learning as a Service (MLaaS) has led to increased concerns about Model Stealing Attacks (MSA), which aim to craft a clone model by querying MLaaS. Currently, most research on MSA assumes that MLaaS can provide soft labels and that the attacker has a proxy dataset with a similar distribution. However, this fails to encapsulate the more practical scenario where only hard labels are returned by MLaaS and the data distribution remains elusive. Furthermore, most existing work focuses solely on stealing the model accuracy, neglecting the model robustness, while robustness is essential in security-sensitive scenarios, e.g., face-scan payment. Notably, improving model robustness often necessitates the use of expensive techniques such as adversarial training, thereby further making stealing robustness a more lucrative prospect. In response to these identified gaps, we introduce a novel Data-Free Hard-Label Robustness Stealing (DFHL-RS) attack in this paper, which enables the stealing of both model accuracy and robustness by simply querying hard labels of the target model without the help of any natural data. Comprehensive experiments demonstrate the effectiveness of our method. The clone model achieves a clean accuracy of 77.86% and a robust accuracy of 39.51% against AutoAttack, which are only 4.71% and 8.40% lower than the target model on the CIFAR-10 dataset, significantly exceeding the baselines. Our code is available at: https://github.com/LetheSec/DFHL-RS-Attack.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 39 of its 49 references that are in the map. First posted on arXiv 10 Dec 2023.

Builds on

39 of 49 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  6. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  7. 2016Wide Residual Networkscited by 3,057
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  10. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  11. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  12. 2016Stealing Machine Learning Models via Prediction APIscited by 602
27 more
  1. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  2. 2018Adversarially Robust Generalization Requires More Datacited by 318
  3. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  4. 2021Improving Robustness using Generated Datacited by 233
  5. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
  6. 2019Data-Free Learning of Student Networkscited by 203
  7. 2017Data-Free Knowledge Distillation for Deep Neural Networkscited by 136
  8. 2019Zero-shot Knowledge Transfer via Adversarial Belief Matchingcited by 129
  9. 2019Adversarially Robust Distillationcited by 124
  10. 2020Data-Free Model Extractioncited by 121
  11. 2019Zero-Shot Knowledge Distillation in Deep Networkscited by 119
  12. 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
  13. 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
  14. 2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 77
  15. 2021Contrastive Model Inversion for Data-Free Knowledge Distillationcited by 66
  16. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
  17. 2021Reliable Adversarial Distillation with Unreliable Teacherscited by 55
  18. 2021Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Aheadcited by 40
  19. 2021Zero-Shot Knowledge Distillation from a Decision-Based Black-Box Modelcited by 37
  20. 2022Robust and Resource-Efficient Data-Free Knowledge Distillation by Generative Pseudo Replaycited by 35
  21. 2021Preventing Catastrophic Forgetting and Distribution Mismatch in Knowledge Distillation via Synthetic Datacited by 32
  22. 2022Momentum Adversarial Distillation: Handling Large Distribution Shifts in Data-Free Knowledge Distillationcited by 31
  23. 2020Black-Box Ripper: Copying black-box models using generative evolutionary algorithmscited by 26
  24. 2021Black-Box Dissector: Towards Erasing-based Hard-Label Model Stealing Attackcited by 25
  25. 2020ES Attack: Model Stealing against Deep Neural Networks without Data Hurdlescited by 24
  26. 2023Dual Student Networks for Data-Free Model Stealingcited by 17
  27. 2020Attacking and Defending Machine Learning Applications of Public Cloudcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 2; 2026: 2.

6 papers.

  1. 2024ModelLock: Locking Your Model With a Spellcited by 6
  2. 2025HoneypotNet: Backdoor Attacks Against Model Extractioncited by 5
  3. 2024Adversarial Attacks and Defenses in Fault Detection and Diagnosis: A Comprehensive Benchmark on the Tennessee Eastman Processcited by 2
  4. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  5. 2025FERD: Fairness-Enhanced Data-Free Robustness Distillationcited by 0
  6. 2026Diverse Image Priors for Black-box Data-free Knowledge Distillationcited by 0