mlsanityData to 7 Oct 2026

BESA: Boosting Encoder Stealing Attack with Perturbation Recovery

arXiv 2506.04556 ↗First posted 5 Jun 2025cs.CR cs.AIcited by 2

Not on the map. Why?

Abstract (arXiv)

To boost the encoder stealing attack under the perturbation-based defense that hinders the attack performance, we propose a boosting encoder stealing attack with perturbation recovery named BESA. It aims to overcome perturbation-based defenses. The core of BESA consists of two modules: perturbation detection and perturbation recovery, which can be combined with canonical encoder stealing attacks. The perturbation detection module utilizes the feature vectors obtained from the target encoder to infer the defense mechanism employed by the service provider. Once the defense mechanism is detected, the perturbation recovery module leverages the well-designed generative model to restore a clean feature vector from the perturbed one. Through extensive evaluations based on various datasets, we demonstrate that BESA significantly enhances the surrogate encoder accuracy of existing encoder stealing attacks by up to 24.63% when facing state-of-the-art defenses and combinations of multiple defenses.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 31 of its 49 references that are in the map. First posted on arXiv 5 Jun 2025.

Builds on

31 of 49 references.

References · 31

  1. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  2. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  3. 2022A Survey of Machine Unlearningcited by 298
  4. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  5. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 268
  6. 2022Self-supervised Learning of Adversarial Example: Towards Good Generalizations for Deepfake Detectioncited by 172
  7. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  8. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  9. 2020Data-Free Model Extractioncited by 121
  10. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  11. 2022Efficient Self-supervised Learning with Contextualized Target Representations for Vision, Speech and Languagecited by 108
  12. 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
19 more
  1. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  2. 2021EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learningcited by 68
  3. 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermarkcited by 61
  4. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  5. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 34
  6. 2022Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoderscited by 30
  7. 2022An Embarrassingly Simple Backdoor Attack on Self-supervised Learningcited by 30
  8. 2022On the Difficulty of Defending Self-Supervised Learning against Model Extractioncited by 22
  9. 2022StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learningcited by 21
  10. 2023Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Servicecited by 11
  11. 2022Semi-Leak: Membership Inference Attacks Against Semi-supervised Learningcited by 10
  12. 2023Bucks for Buckets (B4B): Active Defenses Against Stealing Encoderscited by 8
  13. 2022DST: Dynamic Substitute Training for Data-free Black-box Attackcited by 7
  14. 202110 Security and Privacy Problems in Large Foundation Modelscited by 5
  15. 2022AWEncoder: Adversarial Watermarking Pre-trained Encoders in Contrastive Learningcited by 4
  16. 2021Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Modelscited by 3
  17. 2023REaaS: Enabling Adversarially Robust Downstream Classifiers via Robust Encoder as a Servicecited by 3
  18. 2023Data-Free Model Extraction Attacks in the Context of Object Detectioncited by 2
  19. 2023SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learningcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 1.

2 papers.

  1. 2025Towards Transparent and Incentive-Compatible Collaboration in Decentralized LLM Multi-Agent Systems: A Blockchain-Driven Approachcited by 11
  2. 2026DiMEx: Breaking the Cold Start Barrier in Data-Free Model Extraction via Latent Diffusion Priorscited by 0