目的 模型功能窃取攻击是人工智能安全领域的核心问题之一，目的是利用有限的与目标模型有关的信息训练出性能接近的克隆模型，从而实现模型的功能窃取。针对此类问题，一类经典的工作是基于生成模型的方法，这类方法利用生成器生成的图像作为查询数据，在同一查询数据下对两个模型预测结果的一致性进行约束，从而进行模型学习。然而此类方法生成器生成的数据常常是人眼不可辨识的图像，不含有任何语义信息，导致目标模型的输出缺乏有效指导性。针对上述问题，提出一种新的模型窃取攻击方法，实现对图像分类器的有效功能窃取。方法 借助真实的图像数据，利用生成对抗网络(generative adversarial net，GAN)使生成器生成的数据接近真实图像，加强目标模型输出的物理意义。同时，为了提高克隆模型的性能，基于对比学习的思想，提出一种新的损失函数进行网络优化学习。结果 在两个公开数据集CIFAR-10(Canadian Institute for Advanced Research-10)和SVHN(street view house numbers)的实验结果表明，本文方法能够取得良好的功能窃取效果。在CIFAR-10数据集上，相比目前较先进的方法，本文方法的窃取精度提高了5%。同时，在相同的查询代价下，本文方法能够取得更好的窃取效果，有效降低了查询目标模型的成本。结论 本文提出的模型窃取攻击方法，从数据真实性的角度出发，有效提高了针对图像分类器的模型功能窃取攻击效果，在一定程度上降低了查询目标模型代价。

Objective Current model stealing attack issue is a sub-field in artificial intelligence (AI) security.It tends to steal privacy information of the target model including its structures,parameters and functionality.Our research is focused on the model functionality stealing attacks.We target a deep learning based multi-classifier model and train a clone model to replicate the functionality of the black-box target classifier.Currently,most of stealing-functionality-attacks are oriented on querying data.These methods replicate the black-box target classifier by analyzing the querying data and the response from the target model.The kind of attacks based on generative models is popular and these methods have obtained promising results in functionality stealing.However,there are two main challenges to be faced as mentioned below:first,target image classifiers are trained on real images in common.Since these methods do not use ground truth data to supervise the training phase of generative models,the generated images are distorted to noise images rather than real images.In other words,the image data used by these methods is with few sematic information,leading to that the prediction of target model is with few effective guidance for the training of the clone model.Such images restrict the effect of training the clone model.Second,to train the generative model,it is necessary to initiate multiple queries to the target classifier.A severe burden is bear on query budgets.Since the target model is a black-box model,we need to use its approximated gradient to obtain generator via zero-gradient estimation.Hence,the generator cannot obtain accurate gradient information for updating itself.Method We try to utilize the generative adversarial nets (GAN) and the contrastive learning to steal target classifier functionality.The key aspect of our research is on the basis of the GAN-based prior information extraction of ground truth images on public datasets,aiming to make the prediction from the target classifier model be with effective guidance for the training of the clone model.To make the generated images more realistic,the public datasets are introduced to supervise the training of the generator.To enhance the effectiveness of generative models,we adopt deep convolutional GAN (DCGAN) as the backbone,where the generator and discriminator are composed of convolutional layers both with non-linear activation functions.To update the generator,we illustrate the target model derived gradient information via zero-order gradient evaluation for the training of clone model.Simultaneously,we leverage the public dataset to guide the training of the GAN,aiming to make the generator obtain the information of ground truth images.In other words,the public dataset plays a role as a regularization term.Its application constrains the solution space for the generator.In this way,the generator can produce approximated ground truth images to make the prediction of the target model produce more physical information for manipulating the clone model training.To reduce the query budgets,we pre-train the GAN on public datasets to make it obtain prior information of real images before training the clone model.Our method can make the generator learn better for the training need of clone model in comparison with previous approaches of the random-initialized generator training.To expand the Objective function of training clone model,we introduce contrastive learning to the model stealing attacks area.Traditional model functionality stealing attack methods train the clone model only by maximizing the similarity of predictions from two models to one image.Here,we use the contrastive learning manner to consider the diversity of predictions from two models to different images.The positive pair consists of the predictions from two models to one image and the negative pair is made up with the predictions from two models to two different images.To measure the diversity of two predictions,we attempt to use cosine similarity to represent the similarity of two predictions.Then,we use the InfoNCE loss function to achieve the similarity maximization of positive pairs and diversity maximization of negative pairs at the same time.Result To demonstrate the performances of our methods,we carry out model functionality stealing attacks on two different black-box target classifiers.The two classifiers of Canadian Insititute for Advanced Research-10(CIFAR-10) and street view house numbers (SVHN) are presented.Each of model structure is based on ResNet-34 and the structures of clone models are based on resnet-18 both.The used public datasets are not be overlapped with the training datasets of target classifiers.We test them on CIFAR-10 and SVHN test datasets following our trained clone models.The accuracy results of these clone models are 92.3% and 91.8% of each.Normalized clone accuracy is achieved 0.97 × and 0.98 × of each.Specially,our result can achieve 5% improvements for the CIFAR-10 target model in terms of normalized clone accuracy over the data-free model extraction (DFME).Our method achieves promising results for reducing querying budgets as well.To make the accuracy of clone model reach 85% on the CIFAR-10 test datasets,DFME is required to spend 8.6 M budgets.But,our method spends 5.8 M budgets only,which is 2.8 M smaller than DFME.Our method is required to spend 9.4 M budgets for reaching the 90% accuracy,which is not half enough to the DFME of 20 M budgets.These results demonstrate that our method improve the performances of functionality stealing attack methods based on generative models.It is beneficial for reducing the query budgets as well.Conclusion We propose a novel model functionality stealing attack method,which trains the clone model guided by prior information of ground truth images and the contrastive learning manner.The experimental results show that our optimized model has its potentials and the querying budgets can be reduced effectively.