Model Stealing on CIFAR-10 (test)
91.24Synthetic Accuracy (Data-Free)DFMS-SL
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| DFMS-SLHard Label=false, Black-Box=true, Data-Free=true, Victim Model=ResNet-34, Clone Model=ResNet-182022.04 | 91.24 | 95.59 | 93.96 | 90.88 | |
| DFMEHard Label=false, Black-Box=true, Data-Free=true, Victim Model=ResNet-34, Clone Model=ResNet-182022.04 | 88.1 | 95.5 | — | — | |
| DFMS-HLHard Label=true, Black-Box=true, Data-Free=true, Victim Model=ResNet-18, Clone Model=ResNet-182022.04 | 85.92 | 93.83 | 90.51 | 83.37 | |
| DFMS-HLHard Label=true, Black-Box=true, Data-Free=true, Victim Model=ResNet-34, Clone Model=ResNet-182022.04 | 84.51 | 95.59 | 92.06 | 85.53 | |
| ZSKDHard Label=false, Black-Box=false, Data-Free=true, Victim Accuracy=82.50, Victim Model Architecture=AlexNet, Clone Model Architecture=AlexNet-half2022.04 | 69.5 | — | — | — | |
| DFMS-HLHard Label=true, Black-Box=true, Data-Free=true, Victim Accuracy=80.18, Victim Model Architecture=AlexNet, Clone Model Architecture=AlexNet-half2022.04 | 67.03 | — | 74.27 | 70.57 | |
| DFMS-HLHard Label=true, Black-Box=true, Data-Free=true, Victim Accuracy=82.52, Victim Model Architecture=AlexNet, Clone Model Architecture=AlexNet-half2022.04 | 65.7 | — | 76.02 | 71.36 | |
| ZSDB3KDHard Label=true, Black-Box=true, Data-Free=true, Victim Accuracy=79.30, Victim Model Architecture=AlexNet, Clone Model Architecture=AlexNet-half2022.04 | 59.46 | — | 59.46 | 59.46 | |
| ZSDB3KDHard Label=true, Black-Box=true, Data-Free=true, Victim Model=ResNet-18, Clone Model=ResNet-182022.04 | 50.18 | 93.65 | — | — | |
| MAZEHard Label=false, Black-Box=true, Data-Free=true, Victim Model=ResNet-34, Clone Model=ResNet-182022.04 | 45.6 | 95.5 | — | — | |
| Black-Box RipperHard Label=false, Black-Box=true, Data-Free=true, Victim Accuracy=82.50, Victim Model Architecture=AlexNet, Clone Model Architecture=AlexNet-half2022.04 | — | — | 76.5 | 77.9 | |
| DeGANHard Label=false, Black-Box=false, Data-Free=true, Victim Accuracy=82.50, Victim Model Architecture=AlexNet, Clone Model Architecture=AlexNet-half2022.04 | — | — | 76.3 | 72.6 | |
| KnockoffNetsHard Label=false, Black-Box=true, Data-Free=false, Victim Accuracy=82.50, Victim Model Architecture=AlexNet, Clone Model Architecture=AlexNet-half2022.04 | — | — | 65.7 | 46.6 |