STDatav2: Accessing Efficient Black-Box Stealing for Adversarial Attacks

Area of Science:

• Machine Learning
• Artificial Intelligence
• Cybersecurity

Background:

• Stealing black-box models without training data is challenging due to extreme settings.
• Existing methods like Surrogate Training Data (STDatav1) face limitations such as potential mode collapse and maintaining data diversity.

Purpose of the Study:

• To improve the effectiveness of surrogate model training for black-box model stealing.
• To mitigate mode collapse and enhance data diversity and class-specific constraints in surrogate data generation.

Main Methods:

• Proposed a joint-data optimization scheme using both synthesized and proxy data to train the surrogate model.
• Introduced a self-conditional data synthesis framework with pseudo-class mapping for class-specific constraints and diversity.
• Integrated STDatav1's class-specific constraints and designed a dual cross-entropy loss function.

Main Results:

• Demonstrated considerable performance gains compared to the previous STDatav1.
• Evaluations on four datasets using eight models confirmed the approach's competitive ability and potential.
• The proposed methods effectively addressed mode collapse and maintained data diversity and class-specific constraints.

Conclusions:

• The enhanced surrogate training approach offers significant improvements for black-box model stealing.
• The joint-data optimization and self-conditional synthesis framework represent a promising advancement in the field.
• This work provides a robust method for generating high-quality surrogate data, advancing research in model privacy and security.