Enhancing Data-Free Model Stealing Attack on Robust Models

Machine Learning Model Deployment as a Service (MLaaS) has surged in popularity, offering substantial business value. However, the significant resources and costs required to train models have raised concerns about Model Stealing Attacks (MSAs), where attackers create a clone model to replicate the knowledge of a victim model without access to its parameters. In data-free MSA, attackers also lack access to the training data for the victim model. In this setting, existing MSA methods rely on Generative Adversarial Networks (GANs) to generate images to query the victim model. However, GANs are known to suffer from model collapse, resulting in limited diversity in generated images. The lack of diversity in generated images will significantly impact the accuracy of the clone model, especially in stealing robust models trained with adversarial training. Recent studies have demonstrated that Denoising Diffusion Probabilistic Models (DDPMs) outperform GANs in generating images with greater diversity. In our data-free MSA framework, using DDPM as the generator to steal robust models significantly increases the effectiveness, improving the accuracy of the clone model from 21.34% to 60.23% compared to the GANs-based approach DFME, and requires fewer queries. We further use denoise diffusion GANs to address the problem of low sampling speed of DDPM, while retaining the advantage of its high sample diversity and obtaining better results.