mlsanityData to 14 Oct 2026

I Stolenly Swear That I Am Up to (No) Good: Design and Evaluation of Model Stealing Attacks

arXiv 2508.21654 ↗First posted 29 Aug 2025cs.CR cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Model stealing attacks endanger the confidentiality of machine learning models offered as a service. Although these models are kept secret, a malicious party can query a model to label data samples and train their own substitute model, violating intellectual property. While novel attacks in the field are continually being published, their design and evaluations are not standardised, making it challenging to compare prior works and assess progress in the field. This paper is the first to address this gap by providing recommendations for designing and evaluating model stealing attacks. To this end, we study the largest group of attacks that rely on training a substitute model -- those attacking image classification models. We propose the first comprehensive threat model and develop a framework for attack comparison. Further, we analyse attack setups from related works to understand which tasks and models have been studied the most. Based on our findings, we present best practices for attack development before, during, and beyond experiments and derive an extensive list of open research questions regarding the evaluation of model stealing attacks. Our findings and recommendations also transfer to other problem domains, hence establishing the first generic evaluation methodology for model stealing attacks.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 61 of its 102 references that are in the map. First posted on arXiv 29 Aug 2025.

Builds on

61 of 102 references.

References · 61

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,324
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  5. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,442
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  7. 2013Intriguing properties of neural networkscited by 5,155
  8. 2020Knowledge Distillation: A Surveycited by 1,603
  9. 2016Adversarial Machine Learning at Scalecited by 936
  10. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  11. 2019Big Transfer (BiT): General Visual Representation Learningcited by 769
  12. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
38 more
  1. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  2. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  3. 2019On Evaluating Adversarial Robustnesscited by 447
  4. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 446
  5. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
  6. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  7. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
  8. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 165
  9. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 139
  10. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  11. 2020Data-Free Model Extractioncited by 124
  12. 2020Stealing Links from Graph Neural Networkscited by 115
  13. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  14. 2018Model Reconstruction from Model Explanationscited by 86
  15. 2022I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defencescited by 75
  16. 2019Bypassing Backdoor Detection Algorithms in Deep Learningcited by 74
  17. 2018Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Datacited by 70
  18. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  19. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 58
  20. 2023FACET: Fairness in Computer Vision Evaluation Benchmarkcited by 58
  21. 2024A Safe Harbor for AI Evaluation and Red Teamingcited by 47
  22. 2018Stealing Neural Networks via Timing Side Channelscited by 43
  23. 2021Zero-Shot Knowledge Distillation from a Decision-Based Black-Box Modelcited by 37
  24. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 37
  25. 2021Undistillable: Making A Nasty Teacher That CANNOT teach studentscited by 36
  26. 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
  27. 2019Open DNN Box by Power Side-Channel Attackcited by 28
  28. 2020Black-Box Ripper: Copying black-box models using generative evolutionary algorithmscited by 26
  29. 2020ES Attack: Model Stealing against Deep Neural Networks without Data Hurdlescited by 25
  30. 2021Black-Box Dissector: Towards Erasing-based Hard-Label Model Stealing Attackcited by 25
  31. 2019Adversarial Model Extraction on Graph Neural Networkscited by 23
  32. 2021Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examplescited by 23
  33. 2019A framework for the extraction of Deep Neural Networks by leveraging public datacited by 22
  34. 2022Machine Learning Security in Industry: A Quantitative Surveycited by 21
  35. 2023Dual Student Networks for Data-Free Model Stealingcited by 17
  36. 2023Towards more Practical Threat Models in Artificial Intelligence Securitycited by 17
  37. 2018Query-Efficient Black-Box Attack by Active Learningcited by 15
  38. 2023Marich: A Query-efficient Distributionally Equivalent Model Extraction Attack using Public Datacited by 11

50 most cited of 61 All 61 (JSON)

Built on by

Not cited yet.