STDatav2: Accessing Efficient Black-Box Stealing for Adversarial Attacks

On account of the extreme settings, stealing the black-box model without its training data is difficult in practice. On this topic, along the lines of data diversity, this paper substantially makes the following improvements based on our conference version (dubbed STDatav1, short for Surrogate Training Data). First, to mitigate the undesirable impacts of the potential mode collapse while training the generator, we propose the joint-data optimization scheme, which utilizes both the synthesized data and the proxy data to optimize the surrogate model. Second, we propose the self-conditional data synthesis framework, an interesting effort that builds the pseudo-class mapping framework via grouping class information extraction to hold the class-specific constraints while holding the diversity. Within this new framework, we inherit and integrate the class-specific constraints of STDatav1 and design a dual cross-entropy loss to fit this new framework. Finally, to facilitate comprehensive evaluations, we perform experiments on four commonly adopted datasets, and a total of eight kinds of models are employed. These assessments witness the considerable performance gains compared to our early work and demonstrate the competitive ability and promising potential of our approach.

I. Introduction

Benefiting from the large-scale labeled data, revolutionary breakthroughs have been achieved by Deep Neural Networks (DNNs) in various computer vision tasks [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11]. These advanced researches have injected vitality into the study of pattern recognition technology, and set off a research upsurge that last for more than ten years. However, there also exists a non-negligible safety concern in DNNs, i.e., the adversarial vulnerability of DNNs-based methods [12], [13], which means that adding human-imperceptible perturbations to clean images can mislead the excellent trained models to a large extent. Given this great security concern, more attention across different fields has been paid to the community of adversarial learning to disclose the principle behind this issue [14], [15], [16], [17], [18], [19], [20], [21], [22], where one of the important topics is to study how to attack the DNN-based models.