Title: BESA: Boosting Encoder Stealing Attack with Perturbation Recovery Show Chinese title

Title: 基于扰动恢复的编码器窃取攻击增强：BESA

Abstract: To boost the encoder stealing attack under the perturbation-based defense that hinders the attack performance, we propose a boosting encoder stealing attack with perturbation recovery named BESA. It aims to overcome perturbation-based defenses. The core of BESA consists of two modules: perturbation detection and perturbation recovery, which can be combined with canonical encoder stealing attacks. The perturbation detection module utilizes the feature vectors obtained from the target encoder to infer the defense mechanism employed by the service provider. Once the defense mechanism is detected, the perturbation recovery module leverages the well-designed generative model to restore a clean feature vector from the perturbed one. Through extensive evaluations based on various datasets, we demonstrate that BESA significantly enhances the surrogate encoder accuracy of existing encoder stealing attacks by up to 24.63\% when facing state-of-the-art defenses and combinations of multiple defenses. Show Chinese abstract

Abstract: 为了提升针对基于扰动的防御（这种防御会削弱攻击性能）的编码器窃取攻击，我们提出了一种名为BESA的带有扰动恢复功能的增强型编码器窃取攻击方法。 其目标是克服基于扰动的防御机制。 BESA的核心由两个模块组成：扰动检测和扰动恢复，这两个模块可以与传统的编码器窃取攻击结合使用。 扰动检测模块利用从目标编码器获得的特征向量来推断服务提供商所使用的防御机制。 一旦检测到防御机制，扰动恢复模块就会利用精心设计的生成模型从被扰动的特征向量中恢复出一个干净的特征向量。 通过在多种数据集上的广泛评估，我们证明了当面对最先进的防御措施以及多种防御组合时，BESA能够显著提高现有编码器窃取攻击的替代编码器准确性，最大提升幅度可达24.63%。