{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/marich-a-query-efficient-distributionally","title":"Marich: A Query-efficient Distributionally Equivalent Model Extraction Attack using Public Data","arxiv_id":"2302.08466","date":"2023-02-16","proceeding":null,"authors":["Pratik Karmakar","Debabrota Basu"],"abstract":"We study design of black-box model extraction attacks that can send minimal number of queries from a publicly available dataset to a target ML model through a predictive API with an aim to create an informative and distributionally equivalent replica of the target. First, we define distributionally equivalent and Max-Information model extraction attacks, and reduce them into a variational optimisation problem. The attacker sequentially solves this optimisation problem to select the most informative queries that simultaneously maximise the entropy and reduce the mismatch between the target and the stolen models. This leads to an active sampling-based query selection algorithm, Marich, which is model-oblivious. Then, we evaluate Marich on different text and image data sets, and different models, including CNNs and BERT. Marich extracts models that achieve $\\sim 60-95\\%$ of true model's accuracy and uses $\\sim 1,000 - 8,500$ queries from the publicly available datasets, which are different from the private training datasets. Models extracted by Marich yield prediction distributions, which are $\\sim 2-4\\times$ closer to the target's distribution in comparison to the existing active sampling-based attacks. The extracted models also lead to $84-96\\%$ accuracy under membership inference attacks. Experimental results validate that Marich is query-efficient, and capable of performing task-accurate, high-fidelity, and informative model extraction.","url_abs":"https://arxiv.org/abs/2302.08466v2","url_pdf":"https://arxiv.org/pdf/2302.08466v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"marich-a-query-efficient-distributionally","repo_url":"https://github.com/debabrota-basu/marich","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"model-extraction","task_name":"Model extraction"}],"methods":[{"method_slug":"adam","method_name":"Adam"},{"method_slug":"attention","method_name":"Attention"},{"method_slug":"attention-dropout","method_name":"Attention Dropout"},{"method_slug":"bert","method_name":"BERT"},{"method_slug":"dense-connections","method_name":"Dense Connections"},{"method_slug":"dropout","method_name":"Dropout"},{"method_slug":"layer-normalization","method_name":"Layer Normalization"},{"method_slug":"linear-layer","method_name":"Linear Layer"},{"method_slug":"linear-warmup-with-linear-decay","method_name":"Linear Warmup With Linear Decay"},{"method_slug":"multi-head-attention","method_name":"Multi-Head Attention"},{"method_slug":"residual-connection","method_name":"Residual Connection"},{"method_slug":"softmax","method_name":"Softmax"},{"method_slug":"weight-decay","method_name":"Weight Decay"},{"method_slug":"wordpiece","method_name":"WordPiece"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2302.08466","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2302.08466"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/debabrota-basu/marich","reach":null}],"summary":{"ran_draft_wrong":1,"ran":1,"ran_fixture":2,"ran_honours":1,"unverified":3},"by_repo_kind":{"official":{"samples":8,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"74a351501aaa0c29","entry":"conv_dataset","repo":"debabrota-basu/marich","repo_kind":"official","path":"lr_cnn_res_marich/utils.py","file_url":"https://github.com/debabrota-basu/marich/blob/HEAD/lr_cnn_res_marich/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"74a351501aaa0c29"}},{"code_sha256_prefix":"05a18ee834f7c5ca","entry":"dataset","repo":"debabrota-basu/marich","repo_kind":"official","path":"lr_cnn_res_marich/utils.py","file_url":"https://github.com/debabrota-basu/marich/blob/HEAD/lr_cnn_res_marich/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"05a18ee834f7c5ca"}},{"code_sha256_prefix":"7b5171dd6e96fd3d","entry":"engrad","repo":"debabrota-basu/marich","repo_kind":"official","path":"lr_cnn_res_marich/utils.py","file_url":"https://github.com/debabrota-basu/marich/blob/HEAD/lr_cnn_res_marich/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7b5171dd6e96fd3d"}},{"code_sha256_prefix":"f263fc6ff28fed7b","entry":"entropy_sampling","repo":"debabrota-basu/marich","repo_kind":"official","path":"lr_cnn_res_marich/utils.py","file_url":"https://github.com/debabrota-basu/marich/blob/HEAD/lr_cnn_res_marich/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f263fc6ff28fed7b"}},{"code_sha256_prefix":"2ead12bb8e033cf0","entry":"test","repo":"debabrota-basu/marich","repo_kind":"official","path":"lr_cnn_res_marich/utils.py","file_url":"https://github.com/debabrota-basu/marich/blob/HEAD/lr_cnn_res_marich/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2ead12bb8e033cf0"}},{"code_sha256_prefix":"4fa1b49ac225e2f0","entry":"loss_dep","repo":"debabrota-basu/marich","repo_kind":"official","path":"lr_cnn_res_marich/utils.py","file_url":"https://github.com/debabrota-basu/marich/blob/HEAD/lr_cnn_res_marich/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4fa1b49ac225e2f0"}},{"code_sha256_prefix":"201a46cb9bc3f82b","entry":"marich","repo":"debabrota-basu/marich","repo_kind":"official","path":"lr_cnn_res_marich/utils.py","file_url":"https://github.com/debabrota-basu/marich/blob/HEAD/lr_cnn_res_marich/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"201a46cb9bc3f82b"}},{"code_sha256_prefix":"9454ce73b63ebd3e","entry":"train","repo":"debabrota-basu/marich","repo_kind":"official","path":"lr_cnn_res_marich/utils.py","file_url":"https://github.com/debabrota-basu/marich/blob/HEAD/lr_cnn_res_marich/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9454ce73b63ebd3e"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}