BESA: Boosting Encoder Stealing Attack with Perturbation Recovery

2025/06/05 by Xuhao Ren, Haotian Liang, Ren, Xuhao +9 · 1 citation
Computer Science · Engineering · #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Physical Unclonable Functions (PUFs) and Hardware Security #Smart Grid Security and Resilience

paper · pdf · doi:10.48550/arxiv.2506.04556

openalex publication_date 2025/06/05 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

To boost the encoder stealing attack under the perturbation-based defense that hinders the attack performance, we propose a boosting encoder stealing attack with perturbation recovery named BESA. It aims to overcome perturbation-based defenses. The core of BESA consists of two modules: perturbation detection and perturbation recovery, which can be combined with canonical encoder stealing attacks. The perturbation detection module utilizes the feature vectors obtained from the target encoder to infer the defense mechanism employed by the service provider. Once the defense mechanism is detected, the perturbation recovery module leverages the well-designed generative model to restore a clean feature vector from the perturbed one. Through extensive evaluations based on various datasets, we demonstrate that BESA significantly enhances the surrogate encoder accuracy of existing encoder stealing attacks by up to 24.63% when facing state-of-the-art defenses and combinations of multiple defenses.

Citations

• Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Service
• Bucks for Buckets (B4B): Active Defenses Against Stealing Encoders
• Data-Free Model Extraction Attacks in the Context of Object Detection
• SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learning
• Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermark
• REaaS: Enabling Adversarially Robust Downstream Classifiers via Robust Encoder as a Service
• Efficient Self-supervised Learning with Contextualized Target Representations for Vision, Speech and Language
• An Embarrassingly Simple Backdoor Attack on Self-supervised Learning
• A Survey of Machine Unlearning
• Semi-Leak: Membership Inference Attacks Against Semi-supervised Learning
• On the Difficulty of Defending Self-Supervised Learning against Model Extraction
• DST: Dynamic Substitute Training for Data-free Black-box Attack
• Self-supervised Learning of Adversarial Example: Towards Good Generalizations for Deepfake Detection
• SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoders
• Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoders
• StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learning
• 10 Security and Privacy Problems in Large Foundation Models
• Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction
• EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning
• BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning
• Backdoor Attacks on Self-Supervised Learning
• Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Models
• Data-Free Model Extraction
• MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimation
• Entangled Watermarks as a Defense against Model Extraction
• Knockoff Nets: Stealing Functionality of Black-Box Models
• PRADA: Protecting against DNN Model Stealing Attacks
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Stealing Machine Learning Models via Prediction APIs
• Practical Black-Box Attacks against Machine Learning

Cited by

• Towards Transparent and Incentive-Compatible Collaboration in Decentralized LLM Multi-Agent Systems: A Blockchain-Driven Approach

Related

• StolenEncoder: Stealing Pre-trained Encoders in Self-supervised Learning
• Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoders
• Downstream-agnostic Adversarial Examples
• An integrated Auto Encoder-Block Switching defense approach to prevent adversarial attacks
• Semantic Preserving Adversarial Attack Generation with Autoencoder and Genetic Algorithm