关键词: FGSM, 样本扩充, 模型窃取, 超参数选取, 交叉验证

Abstract: Aiming at the problems of narrow application range, large training data dependence and low prediction accuracy of the model stealing attack method, a model stealing attack method based on FGSM sample expansion was proposed. In this method, a small number of samples were used as the seed set, and the new samples were continuously expanded by the rapid gradient symbol method (FGSM). The boundary of the alternative model was corrected according by the decision of the model to be attacked, and the similarity between the alternative model and the model to be attacked was improved. Combined with the cross-validation of hyperparameters, the model stealing attack was realized by using the increasing training set to train the alternative model. The experimental results on Drebin dataset showed that the consistency and accuracy of the alternative model gradually improved with the increase of iteration rounds, and the detection accuracy of the alternative model trained by this method was better than that of the model stealing methods compared.

Key words: FGSM, sample expansion, model stealing, hyperparameter selection, Cross validation