充分利用每一个真实样本：超像素样本梯度模型窃取
Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealing
AI总结：
本文提出超像素样本梯度窃取方法（SPSG），通过模仿受害者模型的低方差块级梯度而非像素级梯度，在有限真实样本约束下高效估计样本梯度，显著提升了模型窃取的准确率、一致性和对抗成功率。
摘要：
模型窃取（MS）涉及查询和观察机器学习模型的输出以窃取其能力。查询数据的质量至关重要，然而获取大量真实数据用于MS通常具有挑战性。最近的工作通过使用生成模型减少了对真实数据的依赖。然而，当需要高维查询数据时，由于高昂的查询成本和模型崩溃的风险，这些方法是不切实际的。在这项工作中，我们提出使用样本梯度（SG）来增强每个真实样本的效用，因为SG为受害者模型的决策边界提供了关键指导。然而，在模型窃取场景中利用SG面临两个挑战：1. 像素级梯度估计需要大量查询且易受防御影响。2. 样本梯度的估计存在显著方差。本文提出了超像素样本梯度窃取（SPSG），用于在有限真实样本约束下进行模型窃取。其基本思想是模仿受害者模型的低方差块级梯度而非像素级梯度，SPSG通过两步实现高效的样本梯度估计。首先，我们对查询图像执行块级扰动以估计图像不同区域的平均梯度。然后，我们通过阈值策略过滤梯度以降低方差。详尽的实验表明，在相同数量的真实样本下，SPSG在准确率、一致性和对抗成功率上显著超越当前最先进的MS方法。代码可在 https://github.com/zyl123456aB/SPSG_attack 获取。
英文摘要：
Model stealing (MS) involves querying and observing the output of a machine learning model to steal its capabilities. The quality of queried data is crucial, yet obtaining a large amount of real data for MS is often challenging. Recent works have reduced reliance on real data by using generative models. However, when high-dimensional query data is required, these methods are impractical due to the high costs of querying and the risk of model collapse. In this work, we propose using sample gradients (SG) to enhance the utility of each real sample, as SG provides crucial guidance on the decision boundaries of the victim model. However, utilizing SG in the model stealing scenario faces two challenges: 1. Pixel-level gradient estimation requires extensive query volume and is susceptible to defenses. 2. The estimation of sample gradients has a significant variance. This paper proposes Superpixel Sample Gradient stealing (SPSG) for model stealing under the constraint of limited real samples. With the basic idea of imitating the victim model's low-variance patch-level gradients instead of pixel-level gradients, SPSG achieves efficient sample gradient estimation through two steps. First, we perform patch-wise perturbations on query images to estimate the average gradient in different regions of the image. Then, we filter the gradients through a threshold strategy to reduce variance. Exhaustive experiments demonstrate that, with the same number of real samples, SPSG achieves accuracy, agreements, and adversarial success rate significantly surpassing the current state-of-the-art MS methods. Codes are available at https://github.com/zyl123456aB/SPSG_attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
