mlsanityData to 7 Oct 2026

DiMEx: Breaking the Cold Start Barrier in Data-Free Model Extraction via Latent Diffusion Priors

arXiv 2601.01688 ↗First posted 4 Jan 2026cs.LGcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Model stealing attacks pose an existential threat to Machine Learning as a Service (MLaaS), allowing adversaries to replicate proprietary models for a fraction of their training cost. While Data-Free Model Extraction (DFME) has emerged as a stealthy vector, it remains fundamentally constrained by the "Cold Start" problem: GAN-based adversaries waste thousands of queries converging from random noise to meaningful data. We propose DiMEx, a framework that weaponizes the rich semantic priors of pre-trained Latent Diffusion Models to bypass this initialization barrier entirely. By employing Random Embedding Bayesian Optimization (REMBO) within the generator's latent space, DiMEx synthesizes high-fidelity queries immediately, achieving 52.1 percent agreement on SVHN with just 2,000 queries - outperforming state-of-the-art GAN baselines by over 16 percent. To counter this highly semantic threat, we introduce the Hybrid Stateful Ensemble (HSE) defense, which identifies the unique "optimization trajectory" of latent-space attacks. Our results demonstrate that while DiMEx evades static distribution detectors, HSE exploits this temporal signature to suppress attack success rates to 21.6 percent with negligible latency.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 24 of its 37 references that are in the map. First posted on arXiv 4 Jan 2026.

Builds on

24 of 37 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Extracting Training Data from Diffusion Models30 Jan

Other references · 23

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  3. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  6. 2016Stealing Machine Learning Models via Prediction APIscited by 602
  7. 2019Dreaming to Distill: Data-free Knowledge Transfer via DeepInversioncited by 419
  8. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  9. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  10. 2018Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learningcited by 203
  11. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
  12. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
11 more
  1. 2020Data-Free Model Extractioncited by 121
  2. 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
  3. 2018Exploring Connections Between Active Learning and Model Extractioncited by 84
  4. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  5. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
  6. 2020Black-Box Ripper: Copying black-box models using generative evolutionary algorithmscited by 26
  7. 2023Stealing the Decoding Algorithms of Language Modelscited by 19
  8. 2023Dual Student Networks for Data-Free Model Stealingcited by 17
  9. 2025Examining the Threat Landscape: Foundation Models and Model Stealingcited by 2
  10. 2025BESA: Boosting Encoder Stealing Attack with Perturbation Recoverycited by 2
  11. 2025DeepTracer: Tracing Stolen Model via Deep Coupled Watermarkscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Stealix: Model Stealing via Prompt Evolution
  2. 2025Model-Guardian: Protecting against Data-Free Model Stealing Using Gradient Representations and Deceptive Predictions
  3. 2024SIDE: Surrogate Conditional Data Extraction from Diffusion Models
  4. 2026Greedy Coordinate Diffusion: Effective and Semantically Coherent Adversarial Attacks via Diffusion Guidance
  5. 2024Model Inversion Attacks Through Target-Specific Conditional Diffusion Models
  6. 2024PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamics
  7. 2026DIME: Query-Efficient Framework for Membership Inference on Diffusion Models
  8. 2023Membership Inference Attacks against Diffusion Models