Boundary Sampling for Efficient Model Extraction

Abstract

This work proposes a novel data-free model extraction attack that substantially outperforms current methods in efficiency, accuracy, and overall effectiveness. Conventional black-box attacks depend heavily on treating the victim model as an oracle to label a large number of samples, primarily within high-confidence regions. This strategy not only demands an excessive number of queries but also often leads to the extraction of models with lower accuracy and limited transferability. In contrast, our method shifts focus to sampling low-confidence regions (along the decision boundaries) and leverages an evolutionary algorithm to enhance the sampling process. This approach dramatically reduces the query requirement by a factor of 10x to 600x, while also increasing the accuracy of the extracted model. Furthermore, our method achieves improved boundary alignment, significantly enhancing the transferability of adversarial examples from the extracted model to the victim, increasing the attack success rate from an average of 60% to 82%. Remarkably, these improvements are accomplished under a strict black-box scenario with soft-label (class-probability) query access, and no prior knowledge of the target model’s architecture or data distribution. Finally, we offer extensions to the algorithm to enable it to work on complex models: with high resolution, many classes, and even models with class imbalance such as anomaly detectors. Our attack is thoroughly evaluated on multiple image datasets with varying resolutions and is benchmarked against many state-of-the-art model extraction techniques. Additionally, to illustrate the versatility and robustness of our method, we conduct extensive experiments on four tabular datasets that vary in class numbers and sizes.