Abstract: Aiming at the problems of narrow application range, large training data dependence and low prediction accuracy of the model stealing attack method, a model stealing attack method based on FGSM sample expansion was proposed. In this method, a small number of samples were used as the seed set, and the new samples were continuously expanded by the rapid gradient symbol method (FGSM). The boundary of the alternative model was corrected according by the decision of the model to be attacked, and the similarity between the alternative model and the model to be attacked was improved. Combined with the cross-validation of hyperparameters, the model stealing attack was realized by using the increasing training set to train the alternative model. The experimental results on Drebin dataset showed that the consistency and accuracy of the alternative model gradually improved with the increase of iteration rounds, and the detection accuracy of the alternative model trained by this method was better than that of the model stealing methods compared.

Key words: FGSM, sample expansion, model stealing, hyperparameter selection, Cross validation

摘要： 针对模型窃取攻击方法存在适用范围窄、依赖大量训练数据且窃取的替代模型预测准确率较低等问题，提出了一种基于FGSM样本扩充的模型窃取攻击方法。该方法使用少量样本作为种子集，通过快速梯度符号方法（FGSM）不断扩充样本；根据待攻击模型的决策纠正替代模型边界，提高替代模型与待攻击模型的相近程度;结合超参数交叉验证，利用不断增加的训练集训练替代模型，最终实现模型窃取攻击。在Drebin数据集上的实验结果表明，替代模型的一致率和准确率随着迭代轮次的增加而逐步提高，利用此方法训练的替代模型的检测准确率优于所对比的模型窃取方法。

关键词: FGSM, 样本扩充, 模型窃取, 超参数选取, 交叉验证