{"id":"https://openalex.org/W4385080307","doi":"https://doi.org/10.1109/sp46215.2023.10179406","title":"D-DAE: Defense-Penetrating Model Extraction Attacks","display_name":"D-DAE: Defense-Penetrating Model Extraction Attacks","publication_year":2023,"publication_date":"2023-05-01","ids":{"openalex":"https://openalex.org/W4385080307","doi":"https://doi.org/10.1109/sp46215.2023.10179406"},"language":"en","primary_location":{"id":"doi:10.1109/sp46215.2023.10179406","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179406","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5015275781","display_name":"Yanjiao Chen","orcid":"https://orcid.org/0000-0002-1382-0679"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanjiao Chen","raw_affiliation_strings":["Wuhan University,School of Computer Science,China","School of Computer Science, Wuhan University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Wuhan University,School of Computer Science,China","institution_ids":["https://openalex.org/I37461747"]},{"raw_affiliation_string":"School of Computer Science, Wuhan University, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038756883","display_name":"Rui Guan","orcid":"https://orcid.org/0000-0003-0862-2368"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Rui Guan","raw_affiliation_strings":["Wuhan University,School of Mathematics and Statistics,China","School of Mathematics and Statistics, Wuhan University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Wuhan University,School of Mathematics and Statistics,China","institution_ids":["https://openalex.org/I37461747"]},{"raw_affiliation_string":"School of Mathematics and Statistics, Wuhan University, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046712504","display_name":"Xueluan Gong","orcid":"https://orcid.org/0000-0003-2190-8117"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xueluan Gong","raw_affiliation_strings":["Wuhan University,School of Computer Science,China","School of Computer Science, Wuhan University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Wuhan University,School of Computer Science,China","institution_ids":["https://openalex.org/I37461747"]},{"raw_affiliation_string":"School of Computer Science, Wuhan University, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046878222","display_name":"Jianshuo Dong","orcid":null},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianshuo Dong","raw_affiliation_strings":["Wuhan University,School of Cyber Science and Engineering,China","School of Cyber Science and Engineering, Wuhan University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Wuhan University,School of Cyber Science and Engineering,China","institution_ids":["https://openalex.org/I37461747"]},{"raw_affiliation_string":"School of Cyber Science and Engineering, Wuhan University, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101986288","display_name":"Meng Xue","orcid":"https://orcid.org/0000-0003-4745-6526"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Meng Xue","raw_affiliation_strings":["Wuhan University,School of Computer Science,China","School of Computer Science, Wuhan University, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Wuhan University,School of Computer Science,China","institution_ids":["https://openalex.org/I37461747"]},{"raw_affiliation_string":"School of Computer Science, Wuhan University, China","institution_ids":["https://openalex.org/I37461747"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I37461747"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":19,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"382","last_page":"399"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9882000088691711,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11307","display_name":"Domain Adaptation and Few-Shot Learning","score":0.9623000025749207,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8322241306304932},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.6511735320091248},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.5843832492828369},{"id":"https://openalex.org/keywords/generative-model","display_name":"Generative model","score":0.5321658849716187},{"id":"https://openalex.org/keywords/property","display_name":"Property (philosophy)","score":0.4952675402164459},{"id":"https://openalex.org/keywords/black-box","display_name":"Black box","score":0.49467918276786804},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.4804615378379822},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.46199965476989746},{"id":"https://openalex.org/keywords/mnist-database","display_name":"MNIST database","score":0.4299634099006653},{"id":"https://openalex.org/keywords/generative-grammar","display_name":"Generative grammar","score":0.34053725004196167},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3308870196342468},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3053266406059265},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.1747637689113617}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8322241306304932},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.6511735320091248},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.5843832492828369},{"id":"https://openalex.org/C167966045","wikidata":"https://www.wikidata.org/wiki/Q5532625","display_name":"Generative model","level":3,"score":0.5321658849716187},{"id":"https://openalex.org/C189950617","wikidata":"https://www.wikidata.org/wiki/Q937228","display_name":"Property (philosophy)","level":2,"score":0.4952675402164459},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.49467918276786804},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.4804615378379822},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.46199965476989746},{"id":"https://openalex.org/C190502265","wikidata":"https://www.wikidata.org/wiki/Q17069496","display_name":"MNIST database","level":3,"score":0.4299634099006653},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.34053725004196167},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3308870196342468},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3053266406059265},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.1747637689113617},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/sp46215.2023.10179406","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179406","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7799999713897705,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":44,"referenced_works":["https://openalex.org/W1515851193","https://openalex.org/W1686810756","https://openalex.org/W1821462560","https://openalex.org/W1873763122","https://openalex.org/W1945616565","https://openalex.org/W1959608418","https://openalex.org/W2108598243","https://openalex.org/W2117876524","https://openalex.org/W2147800946","https://openalex.org/W2194775991","https://openalex.org/W2603766943","https://openalex.org/W2734358244","https://openalex.org/W2750384547","https://openalex.org/W2808195004","https://openalex.org/W2963303354","https://openalex.org/W2963470657","https://openalex.org/W2963857521","https://openalex.org/W2969695741","https://openalex.org/W2972997402","https://openalex.org/W2973414778","https://openalex.org/W2996610304","https://openalex.org/W2997146418","https://openalex.org/W3007318395","https://openalex.org/W3035379805","https://openalex.org/W3096831136","https://openalex.org/W3103932910","https://openalex.org/W3107725882","https://openalex.org/W3118608800","https://openalex.org/W3119841746","https://openalex.org/W3141043040","https://openalex.org/W3152758407","https://openalex.org/W3174136778","https://openalex.org/W3178659068","https://openalex.org/W4229977739","https://openalex.org/W4299301436","https://openalex.org/W6628547770","https://openalex.org/W6638523607","https://openalex.org/W6640425456","https://openalex.org/W6640963894","https://openalex.org/W6685943642","https://openalex.org/W6743688258","https://openalex.org/W6760237559","https://openalex.org/W6772101090","https://openalex.org/W6790889838"],"related_works":["https://openalex.org/W4365211920","https://openalex.org/W4293874330","https://openalex.org/W3014948380","https://openalex.org/W2805380858","https://openalex.org/W4394785709","https://openalex.org/W2978098801","https://openalex.org/W4289105138","https://openalex.org/W4310699748","https://openalex.org/W2906272760","https://openalex.org/W4380551139"],"abstract_inverted_index":{"Recent":[0],"studies":[1],"show":[2],"that":[3,20,219],"machine":[4],"learning":[5,147],"models":[6],"are":[7,96],"vulnerable":[8],"to":[9,49,57,76,88,173,192],"model":[10,19,30,66,80,114,225,230],"extraction":[11,67,81,115,231],"attacks,":[12,41],"where":[13],"the":[14,23,34,51,62,73,97,124,127,132,137,148,152,174,179,183,187,199,223,228,239,253],"adversary":[15],"builds":[16],"a":[17,27,42,78,141,163,194],"substitute":[18,224],"achieves":[21],"almost":[22],"same":[24],"performance":[25,63],"of":[26,44,64,94,99,154,178,227,241,247,255],"black-box":[28],"victim":[29,35,125,180],"simply":[31],"via":[32],"querying":[33],"model.":[36,181],"To":[37],"defend":[38],"against":[39],"such":[40],"series":[43],"methods":[45],"have":[46,170],"been":[47],"proposed":[48],"disrupt":[50],"query":[52,121,158,196,201],"results":[53,122],"before":[54],"returning":[55],"them":[56],"potential":[58],"attackers,":[59],"greatly":[60],"degrading":[61],"existing":[65,229],"attacks.In":[68],"this":[69],"paper,":[70],"we":[71,169],"make":[72],"first":[74],"attempt":[75],"develop":[77],"defense-penetrating":[79],"attack":[82],"framework,":[83],"named":[84],"D-DAE,":[85],"which":[86,108],"aims":[87],"break":[89],"disruption-based":[90],"defenses.":[91,249],"The":[92,160],"linchpins":[93],"D-DAE":[95,220,256],"design":[98,140],"two":[100],"modules,":[101],"i.e.,":[102],"disruption":[103,106,128,143,188],"detection":[104,129,144],"and":[105,156,215,245,268],"recovery,":[107],"can":[109,221],"be":[110],"integrated":[111],"with":[112,203],"generic":[113],"attacks.":[116],"More":[117],"specifically,":[118],"after":[119],"obtaining":[120],"from":[123,198],"model,":[126],"module":[130,190],"infers":[131],"defense":[133,185],"mechanism":[134],"adopted":[135],"by":[136,233,265],"defender.":[138],"We":[139,250],"meta-learning-based":[142],"algorithm":[145,161],"for":[146],"fundamental":[149],"differences":[150],"between":[151],"distributions":[153],"disrupted":[155,200],"undisrupted":[157],"results.":[159],"features":[162],"good":[164],"generalization":[165],"property":[166],"even":[167],"if":[168],"no":[171],"access":[172],"original":[175],"training":[176],"dataset":[177],"Given":[182],"detected":[184],"mechanism,":[186],"recovery":[189],"tries":[191],"restore":[193],"clean":[195],"result":[197,202],"well-designed":[204],"generative":[205],"models.":[206],"Our":[207],"extensive":[208],"evaluations":[209],"on":[210],"MNIST,":[211],"FashionMNIST,":[212],"CIFAR-10,":[213],"GTSRB,":[214],"ImageNette":[216],"datasets":[217],"demonstrate":[218],"enhance":[222],"accuracy":[226],"attacks":[232],"as":[234,236],"much":[235],"82.24%":[237],"in":[238,257,261],"face":[240],"4":[242],"state-of-the-art":[243],"defenses":[244,260],"combinations":[246],"multiple":[248],"also":[251],"verify":[252],"effectiveness":[254],"penetrating":[258],"unknown":[259],"real-world":[262],"APIs":[263],"hosted":[264],"Microsoft":[266],"Azure":[267],"Face++.":[269]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":8},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}