Enhancing Data-Free Robustness Stealing Attack via Boundary Data Generation

With the continuous development of Machine Learning as a Service (MLaaS), model stealing has become an emerging problem in machine learning security in recent years. In model stealing, one typically obtains the soft labels of model queries and a proxy dataset as prior knowledge, but this scenario is highly idealised. How to steal models without data and hard labels is a pressing problem that needs to be solved. The current mainstream of model stealing attack methods mainly focus on stealing the accuracy of the model and overlook the robustness of the model. However, robustness is essential in security applications such as facial recognition and secure payment scenarios. Moreover, building robust models usually requires costly adversarial training and fine-tuning, making these models the primary targets for theft. To address these issues, in this paper, we propose a new data-free robustness stealing method under data-free conditions from the perspective of data generation, thereby better shaping the classification boundary data to optimise the accuracy and robustness of the models. Through testing, our method achieved clean accuracy and robust accuracy of 53.69% and 21.0%, respectively, under the more complex CIFAR-100 dataset classification. These results are only 3.06% and 3.94% different from the target model, respectively, showing a significant improvement over recent research.