Diffusion models showcased strong capabilities in image synthesis, being used
in many computer vision tasks with great success. To this end, we propose to
explore a new use case, namely to copy black-box classification models without
having access to the original training data, the architecture, and the weights
of the model, \ie~the model is only exposed through an inference API. More
specifically, we can only observe the (soft or hard) labels for some image
samples passed as input to the model. Furthermore, we consider an additional
constraint limiting the number of model calls, mostly focusing our research on
few-call model stealing. In order to solve the model extraction task given the
applied restrictions, we propose the following framework. As training data, we
create a synthetic data set (called proxy data set) by leveraging the ability
of diffusion models to generate realistic and diverse images. Given a maximum
number of allowed API calls, we pass the respective number of samples through
the black-box model to collect labels. Finally, we distill the knowledge of the
black-box teacher (attacked model) into a student model (copy of the attacked
model), harnessing both labeled and unlabeled data generated by the diffusion
model. We employ a novel active self-paced learning framework to make the most
of the proxy data during distillation. Our empirical results on two data sets
confirm the superiority of our framework over two state-of-the-art methods in
the few-call model extraction scenario.

通过借助扩散模型生成逼真多样的图像，我们提出使用一个新的应用案例来复制黑盒分类模型，并在极少数量的调用中进行模型抽取任务，通过使用主动自适应学习框架来蒸馏被攻击模型的知识，我们的实证结果显示，该框架在少量调用模型抽取场景中优于两种现有方法。