English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Model Stealing (MS) attacks allow an adversary with black-box access to aMachine Learning model to replicate its functionality, compromising theconfidentiality of the model. Such attacks train a clone model by using thepredictions of the target model for different inputs. The effectiveness of suchattacks relies heavily on the availability of data necessary to query thetarget model. Existing attacks either assume partial access to the dataset ofthe target model or availability of an alternate dataset with semanticsimilarities. This paper proposes MAZE -- a data-free model stealing attackusing zeroth-order gradient estimation. In contrast to prior works, MAZE doesnot require any data and instead creates synthetic data using a generativemodel. Inspired by recent works in data-free Knowledge Distillation (KD), wetrain the generative model using a disagreement objective to produce inputsthat maximize disagreement between the clone and the target model. However,unlike the white-box setting of KD, where the gradient information isavailable, training a generator for model stealing requires performingblack-box optimization, as it involves accessing the target model under attack.MAZE relies on zeroth-order gradient estimation to perform this optimizationand enables a highly accurate MS attack. Our evaluation with four datasetsshows that MAZE provides a normalized clone accuracy in the range of 0.91x to0.99x, and outperforms even the recent attacks that rely on partial data (JBDA,clone accuracy 0.13x to 0.69x) and surrogate data (KnockoffNets, clone accuracy0.52x to 0.97x). We also study an extension of MAZE in the partial-data settingand develop MAZE-PD, which generates synthetic data closer to the targetdistribution. MAZE-PD further improves the clone accuracy (0.97x to 1.0x) andreduces the query required for the attack by 2x-24x.

MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimation