{"id":"https://openalex.org/W4319878939","doi":"https://doi.org/10.1109/tifs.2023.3244107","title":"Categorical Inference Poisoning: Verifiable Defense Against Black-Box DNN Model Stealing Without Constraining Surrogate Data and Query Times","display_name":"Categorical Inference Poisoning: Verifiable Defense Against Black-Box DNN Model Stealing Without Constraining Surrogate Data and Query Times","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4319878939","doi":"https://doi.org/10.1109/tifs.2023.3244107"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2023.3244107","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3244107","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102909652","display_name":"Haitian Zhang","orcid":"https://orcid.org/0009-0005-9151-7543"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haitian Zhang","raw_affiliation_strings":["School of Electronic Information, Wuhan University, Wuhan, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electronic Information, Wuhan University, Wuhan, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068604294","display_name":"Guang Hua","orcid":"https://orcid.org/0000-0001-5184-4359"},"institutions":[{"id":"https://openalex.org/I115228651","display_name":"Agency for Science, Technology and Research","ror":"https://ror.org/036wvzt09","country_code":"SG","type":"government","lineage":["https://openalex.org/I115228651"]},{"id":"https://openalex.org/I3005327000","display_name":"Institute for Infocomm Research","ror":"https://ror.org/053rfa017","country_code":"SG","type":"facility","lineage":["https://openalex.org/I115228651","https://openalex.org/I3005327000","https://openalex.org/I91275662"]},{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN","SG"],"is_corresponding":false,"raw_author_name":"Guang Hua","raw_affiliation_strings":["Institute for Infocomm Research (I2R), Agency for Science, Technology and Research (A*STAR), Singapore, Singapore","School of Electronic Information, Wuhan University, Wuhan, China"],"raw_orcid":"https://orcid.org/0000-0001-5184-4359","affiliations":[{"raw_affiliation_string":"Institute for Infocomm Research (I2R), Agency for Science, Technology and Research (A*STAR), Singapore, Singapore","institution_ids":["https://openalex.org/I115228651","https://openalex.org/I3005327000"]},{"raw_affiliation_string":"School of Electronic Information, Wuhan University, Wuhan, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101552051","display_name":"Xinya Wang","orcid":"https://orcid.org/0000-0003-2144-9811"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinya Wang","raw_affiliation_strings":["School of Electronic Information, Wuhan University, Wuhan, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electronic Information, Wuhan University, Wuhan, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Hao Jiang","orcid":"https://orcid.org/0000-0002-8533-1612"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Jiang","raw_affiliation_strings":["School of Electronic Information, Wuhan University, Wuhan, China"],"raw_orcid":"https://orcid.org/0000-0002-8533-1612","affiliations":[{"raw_affiliation_string":"School of Electronic Information, Wuhan University, Wuhan, China","institution_ids":["https://openalex.org/I37461747"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5069540177","display_name":"Wen Yang","orcid":"https://orcid.org/0000-0002-3263-8768"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wen Yang","raw_affiliation_strings":["School of Electronic Information, Wuhan University, Wuhan, China"],"raw_orcid":"https://orcid.org/0000-0002-3263-8768","affiliations":[{"raw_affiliation_string":"School of Electronic Information, Wuhan University, Wuhan, China","institution_ids":["https://openalex.org/I37461747"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.4384,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":{"value":0.84400498,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":"18","issue":null,"first_page":"1473","last_page":"1486"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10036","display_name":"Advanced Neural Network Applications","score":0.9620000123977661,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9538000226020813,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8352326154708862},{"id":"https://openalex.org/keywords/surrogate-model","display_name":"Surrogate model","score":0.7563341856002808},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.6646780371665955},{"id":"https://openalex.org/keywords/categorical-variable","display_name":"Categorical variable","score":0.581345796585083},{"id":"https://openalex.org/keywords/black-box","display_name":"Black box","score":0.5761488676071167},{"id":"https://openalex.org/keywords/reliability","display_name":"Reliability (semiconductor)","score":0.5554696321487427},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4328910708427429},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.4272739589214325},{"id":"https://openalex.org/keywords/deep-neural-networks","display_name":"Deep neural networks","score":0.42725670337677},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3989695608615875},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3731077313423157},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.3164486885070801}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8352326154708862},{"id":"https://openalex.org/C131675550","wikidata":"https://www.wikidata.org/wiki/Q7646884","display_name":"Surrogate model","level":2,"score":0.7563341856002808},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.6646780371665955},{"id":"https://openalex.org/C5274069","wikidata":"https://www.wikidata.org/wiki/Q2285707","display_name":"Categorical variable","level":2,"score":0.581345796585083},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.5761488676071167},{"id":"https://openalex.org/C43214815","wikidata":"https://www.wikidata.org/wiki/Q7310987","display_name":"Reliability (semiconductor)","level":3,"score":0.5554696321487427},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4328910708427429},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.4272739589214325},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.42725670337677},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3989695608615875},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3731077313423157},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.3164486885070801},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0},{"id":"https://openalex.org/C163258240","wikidata":"https://www.wikidata.org/wiki/Q25342","display_name":"Power (physics)","level":2,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2023.3244107","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2023.3244107","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.7200000286102295}],"awards":[{"id":"https://openalex.org/G1995900981","display_name":null,"funder_award_id":"62272347","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3009946070","display_name":null,"funder_award_id":"U19B2004","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G580184601","display_name":null,"funder_award_id":"2022YF-B2901202","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":62,"referenced_works":["https://openalex.org/W12634471","https://openalex.org/W2006267758","https://openalex.org/W2112796928","https://openalex.org/W2145607950","https://openalex.org/W2165698076","https://openalex.org/W2579318729","https://openalex.org/W2603766943","https://openalex.org/W2750384547","https://openalex.org/W2808195004","https://openalex.org/W2901114541","https://openalex.org/W2919115771","https://openalex.org/W2934843808","https://openalex.org/W2946363484","https://openalex.org/W2947942370","https://openalex.org/W2963303354","https://openalex.org/W2963465081","https://openalex.org/W2966187620","https://openalex.org/W2969695741","https://openalex.org/W2973414778","https://openalex.org/W2997146418","https://openalex.org/W3035379805","https://openalex.org/W3053555102","https://openalex.org/W3083615244","https://openalex.org/W3103932910","https://openalex.org/W3104224589","https://openalex.org/W3118608800","https://openalex.org/W3127260909","https://openalex.org/W3141043040","https://openalex.org/W3156011647","https://openalex.org/W3164111940","https://openalex.org/W3168455774","https://openalex.org/W3173859330","https://openalex.org/W3174136778","https://openalex.org/W3175685622","https://openalex.org/W3178659068","https://openalex.org/W3185788529","https://openalex.org/W3200953672","https://openalex.org/W3205597769","https://openalex.org/W3206880386","https://openalex.org/W4230172274","https://openalex.org/W4293846201","https://openalex.org/W4313172341","https://openalex.org/W6684191040","https://openalex.org/W6728622933","https://openalex.org/W6739868092","https://openalex.org/W6743688258","https://openalex.org/W6745891213","https://openalex.org/W6747838042","https://openalex.org/W6752760542","https://openalex.org/W6757615711","https://openalex.org/W6766253520","https://openalex.org/W6766821575","https://openalex.org/W6770411749","https://openalex.org/W6772101090","https://openalex.org/W6774150056","https://openalex.org/W6775078712","https://openalex.org/W6784323503","https://openalex.org/W6784730007","https://openalex.org/W6787972765","https://openalex.org/W6790544463","https://openalex.org/W6802647179","https://openalex.org/W6803950395"],"related_works":["https://openalex.org/W4225799919","https://openalex.org/W2341136212","https://openalex.org/W4312822655","https://openalex.org/W4377865163","https://openalex.org/W4312601715","https://openalex.org/W4298185893","https://openalex.org/W3157170264","https://openalex.org/W2896078964","https://openalex.org/W4281399026","https://openalex.org/W2897842727"],"abstract_inverted_index":{"Deep":[0],"Neural":[1],"Network":[2],"(DNN)":[3],"models":[4,21],"have":[5,49],"offered":[6],"powerful":[7],"solutions":[8],"for":[9,26,129,135],"a":[10,86,119,179,182,198],"wide":[11],"range":[12],"of":[13],"tasks,":[14],"but":[15,103,264],"the":[16,61,92,107,113,139,162,188,212,225,279],"cost":[17],"to":[18,178,207,218],"develop":[19],"such":[20],"is":[22,292],"nontrivial,":[23],"which":[24,91,174],"calls":[25],"effective":[27],"model":[28,37,89,239,261],"protection.":[29],"Although":[30],"black-box":[31,44,254],"distribution":[32],"can":[33,39,54,105,237,246],"mitigate":[34],"some":[35],"threats,":[36],"functionality":[38],"still":[40],"be":[41,55],"stolen":[42],"via":[43],"surrogate":[45,52,108,223,255],"attacks.":[46],"Recent":[47],"studies":[48],"shown":[50],"that":[51,244],"attacks":[53,256,270],"launched":[56],"in":[57,90,222,233],"several":[58],"ways,":[59],"while":[60,235],"existing":[62,280],"defense":[63,288],"methods":[64],"commonly":[65],"assume":[66,85],"attackers":[67],"with":[68,271],"insufficient":[69],"in-distribution":[70],"(ID)":[71],"data":[72,99,110],"and":[73,84,100,133,149,161,170,181,204,259,274,285],"restricted":[74],"attacking":[75],"strategies.":[76],"In":[77,138,187,209],"this":[78],"paper,":[79],"we":[80,117],"relax":[81],"these":[82],"constraints":[83],"practical":[87],"threat":[88],"adversary":[93],"not":[94,247],"only":[95,248],"has":[96],"sufficient":[97,272],"ID":[98,148,193,228,273],"query":[101],"times":[102],"also":[104,265],"adjust":[106],"training":[109],"labeled":[111],"by":[112,197],"victim":[114],"model.":[115],"Then,":[116],"propose":[118],"two-step":[120],"categorical":[121],"inference":[122],"poisoning":[123,128,134,141,190,216,229],"(CIP)":[124],"framework,":[125],"featuring":[126],"both":[127,236],"performance":[130,220,251],"degradation":[131,221],"(PPD)":[132],"backdooring":[136],"(PBD).":[137],"first":[140,213],"step,":[142,191],"incoming":[143],"queries":[144,194],"are":[145,164,175,195,205],"classified":[146,166],"into":[147,167],"(out-of-distribution)":[150],"OOD":[151,159,215],"ones":[152],"using":[153],"an":[154],"energy":[155],"score":[156,201],"(ES)":[157],"based":[158],"detector,":[160],"latter":[163],"further":[165,230],"high":[168],"ES":[169,172],"low":[171],"ones,":[173],"subsequently":[176],"passed":[177,206],"strong":[180],"weak":[183],"PPD":[184],"process,":[185],"respectively.":[186],"second":[189,226],"difficult":[192],"detected":[196],"proposed":[199],"reliability":[200],"(RS)":[202],"measurement":[203],"PBD.":[208],"doing":[210],"so,":[211],"step":[214,227],"leads":[217],"substantial":[219],"models,":[224],"embeds":[231],"backdoors":[232],"them,":[234],"preserve":[238],"fidelity.":[240],"Extensive":[241],"experiments":[242],"confirm":[243],"CIP":[245],"achieve":[249],"promising":[250],"against":[252,268],"state-of-the-art":[253],"like":[257],"KnockoffNets":[258],"data-free":[260],"extraction":[262],"(DFME)":[263],"work":[266],"well":[267],"stronger":[269],"deceptive":[275,286],"data,":[276],"better":[277],"than":[278],"dynamic":[281],"adversarial":[282],"watermarking":[283],"(DAWN)":[284],"perturbation":[287],"methods.":[289],"PyTorch":[290],"code":[291],"available":[293],"athttps://github.com/Hatins/CIP_master.git.":[294]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}