Black-Box Dissector: Towards Erasing-Based Hard-Label Model Stealing Attack

Deep Residual Learning for Image Recognition

He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works

Densely Connected Convolutional Networks

Huang, G., Liu, Z., Van Der Maaten, L., & Weinberger, K. Q. (2017) · 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2017.243 · Cited by 48,566 · see citing works

ImageNet Large Scale Visual Recognition Challenge

Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., et al. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0816-y · Cited by 39,380 · see citing works

Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization

Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017) · 2017 IEEE International Conference on Computer Vision (ICCV) · doi:10.1109/iccv.2017.74 · Cited by 24,513 · see citing works

Learning Multiple Layers of Features from Tiny Images

Krizhevsky, A. (2024) · doi:10.57702/zp44cu3g · Cited by 23,890 · see citing works

Learning Deep Features for Discriminative Localization

Zhou, B., Khosla, A., Lapedriza, A., Oliva, A., & Torralba, A. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.319 · Cited by 11,428 · see citing works

Intriguing properties of neural networks

Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., & Fergus, R. (2013) · arXiv · doi:10.48550/arxiv.1312.6199 · Cited by 8,143 · see citing works

Random Erasing Data Augmentation

Zhong, Z., Zheng, L., Kang, G., Li, S., & Yang, Y. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.7000 · Cited by 3,617 · see citing works

Practical Black-Box Attacks against Machine Learning

Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017) · Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security · doi:10.1145/3052973.3053009 · Cited by 3,495 · see citing works

A Sequential Algorithm for Training Text Classifiers

Lewis, D. D., & Gale, W. A. (1994) · SIGIR ’94 · doi:10.1007/978-1-4471-2099-5_1 · Cited by 1,208 · see citing works

Knockoff Nets: Stealing Functionality of Black-Box Models

Orekondy, T., Schiele, B., & Fritz, M. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00509 · Cited by 549 · see citing works

The NIPS workshop on Deep Learning and Unsupervised Feature Learning

Raiko, T., Valpola, H., & LeCun, Y. (2011) · Cited by 204 · see citing works

DaST: Data-Free Substitute Training for Adversarial Attacks

Zhou, M., Wu, J., Liu, Y., Liu, S., & Zhu, C. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00031 · Cited by 178 · see citing works

MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimation

Kariyappa, S., Prakash, A., & Qureshi, M. K. (2021) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr46437.2021.01360 · Cited by 157 · see citing works

CloudLeak: Large-Scale Deep Learning Models Stealing Through Adversarial Examples

Yu, H., Yang, K., Zhang, T., Tsai, Y.-Y., Ho, T.-Y., & Jin, Y. (2020) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.24178 · Cited by 141 · see citing works

ActiveThief: Model Extraction Using Active Learning and Unannotated Public Data

Pal, S., Gupta, Y., Shukla, A., Kanade, A., Shevade, S., & Ganapathy, V. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i01.5432 · Cited by 128 · see citing works

Defending Against Model Stealing Attacks With Adaptive Misinformation

Kariyappa, S., & Qureshi, M. K. (2020) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr42600.2020.00085 · Cited by 117 · see citing works

InverseNet: Augmenting Model Extraction Attacks with Training Data Inversion

Gong, X., Chen, Y., Yang, W., Mei, G., & Wang, Q. (2021) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2021/336 · Cited by 52 · see citing works

Learning to Learn Transferable Attack

Fang, S., Li, J., Lin, X., & Ji, R. (2022) · AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI)) · doi:10.1609/aaai.v36i1.19936 · Cited by 19 · see citing works

Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey

Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works

I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences

Oliynyk, D., Mayer, R. L., & Rauber, A. (2023) · ACM Computing Surveys · doi:10.1145/3595292 · Cited by 137 · see citing works

Towards Data-Free Model Stealing in a Hard Label Setting

Sanyal, S., Addepalli, S., & Babu, R. V. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01485 · Cited by 85 · see citing works

Adversarial Attacks on Large Language Model-Based System and Mitigating Strategies: A Case Study on ChatGPT

Liu, B., Xiao, B., Jiang, X., Cen, S., He, X., & Dou, W. (2023) · Security and Communication Networks · doi:10.1155/2023/8691095 · Cited by 49 · see citing works

MEA-Defender: A Robust Watermark against Model Extraction Attack

Lv, P., Ma, H., Chen, K., Zhou, J., Zhang, S., Liang, R., Zhu, S., Li, P., & Zhang, Y. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00099 · Cited by 26 · see citing works

An Overview of Trustworthy AI: Advances in IP Protection, Privacy-preserving Federated Learning, Security Verification, and GAI Safety Alignment

Zheng, Y., Chang, C.-H., Huang, S.-H., Chen, P., & Picek, S. (2024) · IEEE Journal on Emerging and Selected Topics in Circuits and Systems · doi:10.1109/jetcas.2024.3477348 · Cited by 27 · see citing works

Artificial intelligence based classification for waste management: A survey based on taxonomy, classification & future direction

Yevle, D. V., & Mann, P. S. (2025) · Computer Science Review · doi:10.1016/j.cosrev.2024.100723 · Cited by 23 · see citing works

Aha! Adaptive History-driven Attack for Decision-based Black-box Models

Li, J., Ji, R., Chen, P., Zhang, B., Hong, X., Zhang, R., Li, S., Li, J., Huang, F., & Wu, Y. (2021) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv48922.2021.01586 · Cited by 21 · see citing works

Learning to Learn Transferable Attack

Fang, S., Li, J., Lin, X., & Ji, R. (2022) · AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI)) · doi:10.1609/aaai.v36i1.19936 · Cited by 19 · see citing works

Examining Responsibility and Deliberation in AI Impact Statements and Ethics Reviews

Liu, D., Nanayakkara, P., Sakha, S. A., Abuhamad, G., Blodgett, S. L., Diakopoulos, N. A., Hullman, J. R., & Eliassi‐Rad, T. (2022) · Proceedings of the AAAI/ACM Conference on AI Ethics and Society · doi:10.1145/3514094.3534155 · Cited by 14 · see citing works

AugSteal: Advancing Model Steal With Data Augmentation in Active Learning Frameworks

Gao, L., Liu, W., Liu, K., & Wu, J. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3384841 · Cited by 13 · see citing works

Data-Free Hard-Label Robustness Stealing Attack

Yuan, X., Chen, K., Huang, W. T., Zhang, J., Zhang, W., & Yu, N. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i7.28510 · Cited by 11 · see citing works

Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealing

Zhao, Y., Deng, X., Liu, Y., Pei, X., Xia, J., & Chen, W. (2024) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52733.2024.02295 · Cited by 10 · see citing works

Army of Thieves: Enhancing Black-Box Model Extraction via Ensemble based sample selection

Jindal, A., Goyal, V., Anand, S., & Arora, C. (2024) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv57701.2024.00378 · Cited by 9 · see citing works

DDSG-GAN: Generative Adversarial Network with Dual Discriminators and Single Generator for Black-Box Attacks

Wang, F., Ma, Z., Zhang, X., Li, Q., & Wang, C. (2023) · Mathematics · doi:10.3390/math11041016 · Cited by 7 · see citing works

Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-view Data

Li, Y., Maharana, S. K., & Guo, Y. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-73650-6_16 · Cited by 6 · see citing works

Efficient Model Extraction by Data Set Stealing, Balancing, and Filtering

Yang, P., Wu, Q., & Zhang, X. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3304345 · Cited by 5 · see citing works

MeaeQ: Mount Model Extraction Attacks with Efficient Queries

Dai, C., Lv, M., Li, K., & Wei, Z. (2023) · Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2023.emnlp-main.781 · Cited by 5 · see citing works

Assessing Risk of Stealing Proprietary Models for Medical Imaging Tasks

Raj, A., Swaika, H., Varma, D., & Arora, C. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-72120-5_10 · Cited by 3 · see citing works

A Method for Extracting Black Box Models Based on Interpretable Attention

Gao, L., Tian, H., & Liu, K. (2025) · Expert Systems · doi:10.1111/exsy.70084 · Cited by 3 · see citing works

When Gradient Descent Meets Derivative-Free Optimization: A Match Made in Black-Box Scenario

Han, C., Cui, L., Zhu, R., Wang, J., Chen, N., Sun, Q., Li, X., & Gao, M. (2023) · Findings of the Association for Computational Linguistics: ACL (Findings of ACL) · doi:10.18653/v1/2023.findings-acl.55 · Cited by 3 · see citing works

ModelLock: Locking Your Model With a Spell

Gao, Y., Sun, Y., Ma, X., Wu, Z., & Jiang, Y. (2024) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3664647.3685507 · Cited by 3 · see citing works

Enhance Model Stealing Attack via Label Refining

Wang, Y., & Lin, X. (2022) · International Conference on Intelligent Computing and Signal Processing (ICSP) · doi:10.1109/icsp54964.2022.9778562 · Cited by 3 · see citing works

Dual stage black-box adversarial attack against vision transformer

Wang, F., Shao, M., Meng, L., & Liu, F. (2024) · International Journal of Machine Learning and Cybernetics · doi:10.1007/s13042-024-02097-4 · Cited by 2 · see citing works

STMS: An Out-Of-Distribution Model Stealing Method Based on Causality

Yang, Y., Chen, X., Zhao, Z., Xuan, Y., Tang, B., & Li, X. (2024) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn60899.2024.10650104 · Cited by 2 · see citing works

Constructing Surrogate Models in Machine Learning Using Combinatorial Testing and Active Learning

Shree, S., Khadka, K., Lei, Y., Kacker, R. N., & Kuhn, D. R. (2024) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3691620.3695532 · Cited by 4 · see citing works

Adaptive Sampling Technique for Building Knockoff Text Sentiment Models

Pham, X.-C., Hoang, T.-N., Do, V.-B., & Tran, C.-T. (2024) · RIVF International Conference on Computing and Communication Technologies (RIVF) · doi:10.1109/rivf64335.2024.11009072 · Cited by 2 · see citing works

Attackers Can Do Better: Over- and Understated Factors of Model Stealing Attacks

Oliynyk, D., Mayer, R. L., & Rauber, A. (2025) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml64287.2025.00016 · Cited by 1 · see citing works

Efficient Black-Box Adversarial Attacks with Training Surrogate Models Towards Speaker Recognition Systems

Wang, F., Song, R., Li, Q., & Wang, C. (2024) · Lecture notes in computer science · doi:10.1007/978-981-97-0808-6_15 · Cited by 1 · see citing works

Enhancing Data-Free Robustness Stealing Attack via Boundary Data Generation

Ma, X., Guo, W., Ge, P., Chen, Y., Yue, Q., & Zhang, Y. (2024) · IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData) · doi:10.1109/ithings-greencom-cpscom-smartdata-cybermatics62450.2024.00105

Efficient Model Extraction via Boundary Sampling

Dor, M. B., & Mirsky, Y. (2024) · doi:10.1145/3689932.3694756

Knockoff Branch: Model Stealing Attack via Adding Neurons in the Pre-Trained Model

Hung, L.-Y., & Ku, C. (2025) · IEEE Winter Conference on Applications of Computer Vision · doi:10.1109/wacv61041.2025.00686

Unveiling Deep Learning Models: Leveraging Active Learning and High-Confidence Feature Extraction in Model Stealing

Liu, L., Wang, L., Gu, C., Ma, H., Wang, J., & Liu, W. (2025) · International Conference on Advanced Algorithms and Control Engineering (ICAACE) · doi:10.1109/icaace65325.2025.11019087

Do More With Less: Architecture-Agnostic and Data-Free Extraction Attack Against Tabular Model

Jin, Y., Yin, W., & Tang, F. (2025) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2025.3620636

Neural networks security under realistic scenario

Maho, T. (2023) · doi:10.70675/690e25b2z1fb9z4d7fza6cbzcb09e2b773cf

StolenLoRA: Exploring LoRA Extraction Attacks via Synthetic Data

Wang, Y., Teng, Y., Wang, Y., & Ma, X. L. (2025) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51701.2025.00032

Vision-Language Semantics Guided Model Extraction Attack via Long-Horizon Contrastive Prompt Learning

Ma, R., Ma, Y., Ren, M., Zhu, D., Liu, H., & Tan, Y. (2026) · Mobile Networks and Applications · doi:10.1007/s11036-026-02503-x

RegexStealer: A Directed-Acyclic-Graph-Based Regex Stealing Against Web Application Firewalls

Li, D., Ling, X., Chen, X., Wu, C., Liu, X., & Khan, M. K. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3737638

AugSteal: Advancing Model Steal With Data Augmentation in Active Learning Frameworks

Gao, L., Liu, W., Liu, K., & Wu, J. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3384841 · Cited by 13 · see citing works

An attack framework for stealing black-box based on active semi-supervised learning

Gao, L., Wang, Y., Liu, W., & Liu, K. (2023) · International Conference on Advanced Electronic Materials, Computers and Software Engineering (AEMCSE) · doi:10.1117/12.3004553

Automatic Selection Attacks Framework for Hard Label Black-Box Models

Liu, X., Li, X., Zheng, D., Bai, J., Peng, Y., & Zhang, S. (2022) · IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) · doi:10.1109/infocomwkshps54753.2022.9797988 · Cited by 1 · see citing works

Data-Free Hard-Label Robustness Stealing Attack

Yuan, X., Chen, K., Huang, W. T., Zhang, J., Zhang, W., & Yu, N. (2024) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v38i7.28510 · Cited by 11 · see citing works

The best defense is a good offense: Countering black box attacks by predicting slightly wrong labelsPreprint

Kilcher, Y., & Hofmann, T. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.05475 · Cited by 1 · see citing works