Enhance Model Stealing Attack via Label Refining

With machine learning models being increasingly deployed, model stealing attacks have raised an increasing interest. Extracting decision-based models is a more challenging task with the information of class similarity missing. In this paper, we propose a novel and effective model stealing method as Label Refining via Feature Distance (LRFD), to re-dig the class similarity. Specifically, since the information of class similarity can be represented by the distance between samples from different classes in the feature space, we design a soft label construction module inspired by the prototype learning, and transfer the knowledge in the soft label to the substitution model. Extensive experiments conducted on four widely-used datasets consistently demonstrate that our method yields a model with significantly greater functional similarity to the victim model.