# Can’t Steal? Cont-Steal! Contrastive Stealing Attacks
Against Image Encoders

Zeyang Sha1 Xinlei He1 Ning Yu2 Michael Backes1 Yang Zhang1

1CISPA Helmholtz Center for Information Security 2Salesforce Research

###### Abstract

Unsupervised representation learning techniques have been developing rapidly
to make full use of unlabeled images. They encode images into rich features
that are oblivious to downstream tasks. Behind its revolutionary
representation power, the requirements for dedicated model designs and a
massive amount of computation resources expose image encoders to the risks of
potential model stealing attacks - a cheap way to mimic the well-trained
encoder performance while circumventing the demanding requirements. Yet
conventional attacks only target supervised classifiers given their predicted
labels and/or posteriors, which leaves the vulnerability of unsupervised
encoders unexplored.

In this paper, we first instantiate the conventional stealing attacks against
encoders and demonstrate their severer vulnerability compared with downstream
classifiers. To better leverage the rich representation of encoders, we
further propose Cont-Steal , a contrastive-learning-based attack, and validate
its improved stealing effectiveness in various experiment settings. As a
takeaway, we appeal to our community’s attention to the intellectual property
protection of representation learning techniques, especially to the defenses
against encoder stealing attacks like ours.

##  1 Introduction

Recent years have witnessed the great success of applying deep learning (DL)
to computer vision tasks. Supervised DL models, such as image classifiers,
rely on large-scale labeled datasets to achieve good performance. Yet, with
the increasing diversity of application domains, labeled data in limited
domains turns out the bottleneck against performance improvement of supervised
models. As a revolutionary breakthrough, representation learning [10, 11, 49]
instead targets pre-training powerful encoders that transform unlabeled data
samples into rich representations and are oblivious to downstream tasks or
human supervision. The pre-trained encoders then serve as feature extractors
to facilitate various downstream tasks with improved performance over
classifiers.

Behind its powerful representation, it is non-trivial to obtain a state-of-
the-art image encoder, which involves a massive amount of data, expensive
computation, expert knowledge, and countless failure trials. For instance,
SimCLR [5] uses 128 TPU v3 cores to pre-train a ResNet-50 encoder with a batch
size of 4096. Therefore, such pre-trained encoders are usually established by
big companies (e.g., Google, Facebook, and OpenAI).

Demanding requirements make the intellectual properties of image encoders
valuable while consequently vulnerable to potential model stealing attacks, a
cheap way to mimic the well-trained encoder performance while circumventing
the demanding requirements. It has been shown in previous works that
supervised DL models are susceptible to model stealing attacks [41, 44, 4, 29,
20, 24, 45, 36]. In these attacks, the adversary aims to steal the parameters
or functionalities of target models with only query access to them.
Specifically, the adversary can launch a large number of queries and obtain
the corresponding prediction and/or posterior outputs. With the input-output
pairs, the adversary can then train a surrogate model. A successful model
stealing attack does not only threaten the intellectual property of the target
model but also serves as a stepping stone for further attacks such as
adversarial examples [2, 12, 3, 31, 40, 46], backdoor attacks [34, 33, 6, 21],
and membership inference attacks [37, 26, 27, 35, 32, 38, 17, 16, 19, 25]. So
far, model stealing attacks concentrate on the supervised classifiers, i.e.,
the model responses are prediction posteriors or labels for a specific
downstream task. The vulnerability of unsupervised image encoders is
unfortunately unexplored.

Figure 1: Model stealing attacks against classifiers (previous) v.s. model
stealing attacks against encoders (ours). Previous works aim to steal a whole
classifier using the predicted label or posteriors of a target model. In our
work, we aim to steal the target encoder using its embeddings. The target
encoder ($E_{t}$) is pre-trained and fixed as shown in the solid frame. The
surrogate encoder ($E_{s}$) is trainable by adversary as shown in the dashed
frame.

Given that image encoders deliver remarkable performance in various downstream
tasks, a successful model stealing attack against them would severely threaten
the intellectual properties of model owners to a larger extent. Also, because
the responses of encoders are the image representations in higher dimensions
and with rich information compared to classifiers’ posteriors or labels, it is
unclear whether or not encoders are vulnerable to conventional attacks.
Moreover, it is also unclear whether or not there exist more effective model
stealing attacks against image encoders.

Our Work. To fill this gap, we pioneer the systematic investigation of model
stealing attacks against image encoders. See Figure 1 for an overview and a
comparison with previous works. More specifically, we focus on encoders of
contrastive learning, which is one of the most cutting-edge unsupervised
representation learning strategies that unleash the information of unlabeled
data.

We first instantiate the conventional stealing attacks against encoders and
expose their vulnerability. Given an image input, the target encoder outputs
its representation (referred to as embedding). Similar to model stealing
attacks against classifiers, we consider the embedding as the “ground truth”
label to guide the training procedure of a surrogate encoder on the adversary
side. To measure the effectiveness of stealing attacks, we train an extra
linear layer for the target and surrogate encoders towards the same downstream
classification task. Preferably, the surrogate model should achieve both high
classification accuracy and high agreement with the target predictions.

We evaluate our attacks on six datasets against four contrastive learning
encoders. Our results demonstrate that the conventional attacks are more
effective against encoders than against downstream classifiers. For instance,
when we steal the downstream classifier pre-trained by SimCLR on CIFAR10 (with
posteriors as its responses) using CIFAR100 as the surrogate dataset, the
adversary can only achieve an agreement of $0.4026$. The agreement, however,
increases to $0.6790$ instead when we steal its encoder (with the embedding as
its responses).

Also, we observe that the attack against the encoder is less dependent on the
dataset used to train the surrogate encoder, i.e., the surrogate dataset. Take
the SimCLR pre-trained target encoder on CIFAR10 as an example, compared to
the surrogate dataset being CIFAR10, when the surrogate dataset is STL10, the
agreement drops by $0.5563$ if the target model is a classifier with the
predicted label as its response. In comparison, the agreement drops by only
$0.1694$ when the target model is an encoder with the embedding as its
response. This can be credited to the fact that the robust and generalizable
representations in the embeddings benefit the surrogate encoder more in
mimicking the functionality of the target encoder.

Despite its encouraging performance, conventional attacks are not the most
suitable ones against encoders. This is because they treat each image-
embedding pair individually without interacting across pairs. Different
embeddings are beneficial to each other as they can serve as anchors to better
locate the position of the other embeddings in their space. Contrastive
learning [42, 47, 14, 5, 13, 7, 22] is a straightforward idea to achieve this
goal. It is formulated to enforce the embeddings of different augmentations of
the same images closer, and those of different images further.

In a similar spirit, we propose Cont-Steal , a contrastive-learning-based
model stealing attack against the encoder. The goal of Cont-Steal is to
enforce the surrogate embedding of an image close to its target embedding
(defined as a positive pair), and also push away embeddings of different
images irrespective of being generated by the target or the surrogate encoders
(defined as negative pairs).

Comprehensive evaluation shows that Cont-Steal outperforms the conventional
model stealing attack against encoders to a large extent. For instance, when
CIFAR100 is the target dataset, Cont-Steal achieves an agreement of $0.5623$
on SimCLR pre-trained encoder with surrogate dataset being STL10, while the
conventional attack only achieves $0.3384$ agreement. Also, Cont-Steal is more
query-efficient and dataset-independent. For instance, when the target encoder
is MoCo pre-trained on CIFAR10, the gap of attack performance between
different surrogate datasets is $0.2844$ with the conventional attacks while
only $0.1499$ with Cont-Steal . This is because Cont-Steal leverages higher-
order information across samples to mimic the functionality of target encoder.
As a takeaway, our attack further exposes the severe vulnerability of pre-
trained encoders. We appeal to our community’s attention to the intellectual
property protection of representation learning techniques, especially to the
defenses against encoder stealing attacks like ours.

Our Contributions. In summary, we make the following contributions:

  * •

We pioneer the investigation of the vulnerability of unsupervised image
encoders against model stealing attacks. We discover that encoders are more
vulnerable than classifiers.

  * •

We propose Cont-Steal , the first contrastive learning-based stealing attack
against encoders that outperforms the conventional attacks to a large extent.

  * •

Extensive evaluation shows that the advantageous performance of Cont-Steal is
consistently amplified in various settings, especially when the adversary
suffers from zero information of the target dataset, limited amount of data,
or restricted query budgets.

##  2 Background

Supervised learning, as one of the most important machine learning paradigms,
has been widely used in many ML scenarios such as classification and
regression. In this paper, we consider classification tasks. Given a dataset
$\mathcal{D}=(\mathbf{X},\mathbf{Y})$ where $\mathbf{X}$ is a set of data
samples and $\mathbf{Y}$ is the corresponding labels for these samples, the
goal of an ML model $\mathcal{M}$ is to directly map each data sample
$x\in\mathbf{X}$ to its corresponding label $y\in\mathbf{Y}$. Models trained
by supervised learning are powerful; however, the success of supervised
learning often relies on large amount of high-quality labeled data.

Different from labeled data which is often hard and expensive to collect,
unlabeled data is generated at every moment. To better leverage the unlabeled
data, self-supervised learning has been introduced. Concretely, the goal of
self-supervised learning is to pre-train a powerful encoder using a large
amount of unlabeled data. Then, the pre-trained encoder can be used to build
classifiers for many downstream tasks using only a small amount of labeled
data.

###  2.1 Pre-training Encoders

The encoder can be considered as a feature extractor that generates a
representation (embedding) for a given input. To pre-train the encoder, self-
supervised learning leverages only the unlabeled data and generates the
optimization goal in an unsupervised manner to optimize the encoder. We then
introduce four popular self-supervised learning algorithms considered in this
paper, i.e., SimCLR [5], MoCo [14], BYOL [13], and SimSiam [7].

SimCLR [5]. SimCLR has two major components, a base encoder $f(\cdot)$ and a
projection head $g(\cdot)$. To be more specific, given a mini-batch of $N$
unlabeled images, SimCLR first generates two augmented views of each image
with data augmentation, resulting in $2N$ samples. We consider $(x_{i},x_{j})$
as a positive pair if both $x_{i}$ and $x_{j}$ are the augmented views of the
same image, and otherwise a negative pair. For a given sample $x_{i}$, we can
obtain its representation from the base encoder: $h_{i}=f(x_{i})$. Then, the
representation is projected into a smaller space using the projection head,
which is a Multi-layer Perceptron (MLP): $z_{i}=g(h_{i})$. SimCLR leverages
contrastive loss to optimize the whole model including the base encoder and
the projection head. Formally, for each positive pair $(x_{i},x_{j})$, the
contrastive loss can be defined as follows:

$\ell(i,j)=-\log\frac{e^{sim\left({z}_{i},{z}_{j}\right)/\tau}}{\sum_{k=1,k\neq
i}^{2N}e^{sim\left({z}_{i},{z}_{k}\right)/\tau}}$ (1)

where $sim(\cdot,\cdot)$ represents the cosine similarity between two vectors
and $\tau$ is a temperature parameter.

The final contrastive loss for a mini-batch is calculated over the $2N$
samples, which can be defined as the following:

$\mathcal{L}_{contrastive}=\frac{1}{2N}\sum_{k=1}^{N}[\ell(2k-1,2k)+\ell(2k,2k-1)]$
(2)

Here, $2k-1$ and $2k$ are the indices for each positive pair.

Once the model is trained, we discard the projection head and only use the
encoder with an extra linear layer to perform the downstream task.

MoCo [14]. MoCo is made up of three components, i.e., an encoder $h(\cdot)$, a
momentum encoder $h_{m}(\cdot)$, and a dictionary $Q$. Note that the momentum
encoder has the same architecture as the encoder, but is updated with a
momentum factor, which means that it updates much slower than the encoder. The
dictionary $Q$ is basically a queue to store several previous mini-batch
samples’ representations generated by the momentum encoder. Similar to SimCLR,
MoCo generates $2N$ augmented views for a mini-batch of $N$ samples. Given two
augmented inputs $(x_{i},x_{j})$ as a positive pair, we feed them into the
encoder and momentum encoder to generate the representation vectors $h(x_{i})$
and $h_{m}(x_{j})$, respectively.

The contrastive loss used to optimize the model can be formulated as follows:

$\ell(i,j)=-\log\frac{e^{sim\left(h(x_{i}),h_{m}(x_{j})\right)/\tau}}{e^{sim\left(h(x_{i}),h_{m}(x_{j})\right)/\tau}+\sum_{k\in
Q}e^{sim\left(h(x_{i}),k\right)/\tau}}$ (3)

The final contrastive loss is calculated over all N positive pairs. For each
mini-batch, the dictionary would enqueue the N representations by the momentum
encoder and dequeue the oldest N representations.

BYOL [13]. Different from SimCLR and MoCo, BOYL does not require negative
pairs. Specifically, BYOL has two neural networks, i.e., the online and target
networks. The online network has three components including an encoder
$h_{o}(\cdot)$, a projector $g_{o}(\cdot)$, and a predictor $q_{o}(\cdot)$.
The target network has the same architecture as the online network but without
the predictor (i.e., an encoder $h_{t}(\cdot)$ and a projector
$g_{t}(\cdot)$). For a given input sample $x$, BYOL also generates two
augmented views $(x_{i},x_{j})$ and feeds $x_{i}$ and $x_{j}$ to the online
network and the target network, respectively. The optimization goal is to make
the output of the online network $q_{o}(g_{o}(h_{o}(x_{i})))$ to be as similar
as the output of the target network $g_{t}(h_{t}(x_{j}))$. BYOL first
normalizes the two outputs and leverages MSE as the loss function to optimize
only the online network. Then, the target network uses a weighted moving
average of the online network to update its parameters. Once the model is
trained, we only leverage the encoder of the online network with an extra
linear layer to perform the downstream task.

SimSiam [7]. SimSiam takes Siamese networks as its architecture to train the
model. Concretely, a Siamese network has two sub-networks that share the same
parameters. In SimSiam, each sub network has an encoder $h(\cdot)$ and a
projection head $g(\cdot)$. For two augmented views $x_{i}$ and $x_{j}$
generated from $x$, SimSiam feeds $x_{i}$ and $x_{j}$ into the two sub
networks, generating $h(x_{i})$, $g(h(x_{i}))$,$h(x_{j})$, and $g(h(x_{j}))$,
respectively.

Formally, the loss of SimSiam can be defined as follows:

$\ell=-\frac{(sim(h(x_{i}),g(h(x_{j})))+sim(h(x_{j}),(g(h(x_{i})))))}{2}$ (4)

where $sim(\cdot)$ denotes the cosine similarity. Note that to avoid the
collapsing solutions, i.e., model outputs the same for all inputs, SimSiam
leverages stop gradient to one sub-network and shows that it is an important
operation to prevent the collapsing.

Supervised Encoders. Besides the encoder pre-trained in a self-supervised
manner, we also consider the encoder trained in a supervised way. Concretely,
we first train a whole classifier for a specific task. Then, we remove the
last linear layer and consider the rest of the model as the (supervised)
encoder.

###  2.2 Training Downstream Classifiers

Once the encoder is trained, it can serve as a feature extractor to many
downstream tasks. Concretely, given a downstream labeled dataset, we first
query the encoder with each sample to obtain its representation. Then, those
representations serve as the input to train a linear layer with their
corresponding labels. Note that we freeze the encoder and train only the
linear layer in this phase. The whole classifier consists of two parts, i.e.,
the encoder and the linear layer, where the encoder is used to generate the
representation and the linear layer leverages the representation to give a
concrete prediction. Our evaluation also shows that the encoder trained by
self-supervised learning is more effective in various downstream tasks
compared to supervised learning (see Section 5 for more details).

##  3 Threat Model

In this work, for the encoder pre-trained with images, we consider image
classification as the downstream task. We refer to the encoder as the target
encoder. Then we treat both the encoder and the linear layer trained for the
downstream task together as the target model. We first introduce the
adversary’s goal and then characterize different background knowledge that the
adversary might have.

Adversary’s Goal. Following previous work [20, 24, 36], we taxonomize the
adversary’s goal into two dimensions, i.e., theft and reconnaissance. The
theft adversary aims to build a surrogate encoder that has similar performance
on the downstream tasks as the target encoder. By doing this, the adversary
can compromise the intellectual property of the model owner as the target
encoder may require dedicated model designs and a massive amount of data as
well as computation resources [5, 14, 13, 7]. Different from the thief
adversary, the goal of the reconnaissance adversary is to construct a
surrogate encoder that behaves similarly to the target encoder. In other
words, with any input, the outputs from the target and surrogate encoder used
for the same downstream task should have a high agreement. In this case, the
surrogate encoder not only faithfully “copies” the behaviors of the target
encoder, but also serves as a stepping stone to conduct other attacks. For
instance, it can be used to infer sensitive information about the training
data [41, 37, 35] or be used to craft adversarial examples [30] or conduct
backdoor attacks [21] without taking the risks of being detected by querying
the target model.

Adversary’s Background Knowledge. We categorize the adversary’s background
knowledge into two dimensions, i.e., the knowledge of the target encoder, and
the distribution of the surrogate dataset.

Regarding knowledge of the target encoder, we assume that the adversary only
has black-box access to it, which means that they can only query the target
encoder with an input image and obtain the corresponding output, i.e., the
embedding of the input image. Also, we first assume the target encoder’s
architecture is known to the adversary, which is possible as the model
architectures of popular encoders are often accessible online, e.g., through
research publication or technical reports. We then relax this assumption by
leveraging different model architectures to the surrogate encoders and our
evaluation shows that the attacks are still effective.

Regarding the surrogate dataset that is used to train the surrogate encoder,
we consider three cases. First, we assume the adversary has the same training
dataset as the target encoder. However, such assumption may be hard to achieve
as such datasets are usually private and protected by the model owner.
Therefore, we relax our assumption by assuming the adversary has no
information about the exact training dataset of the target encoder but only
knows the categories of the training dataset, i.e., the adversary can collect
their own surrogate dataset from the Internet that has the same categories as
the target encoder’s training dataset. In a more extreme case, we assume that
the adversary has totally no information about the target encoder’s training
dataset, which means that they can only use a different distribution dataset
to conduct the model stealing attacks. We later show that the adversary can
still launch effective model stealing attacks against the target encoder given
a surrogate dataset that is distributed differently compared to the target
dataset.

Note that we also compare our attacks against the encoders to the traditional
model stealing attacks that focus on the whole classifier (which has an
encoder and a linear layer). If the attack is targeting a whole classifier, we
assume the adversary may obtain the posteriors or the predicted label for an
input image.

##  4 Model Stealing Attacks

In this section, we first describe the conventional attacks against the
classifiers and how to conduct such attacks against the encoders. Then, we
propose a novel contrastive stealing framework Cont-Steal to steal the
encoders more effectively.

###  4.1 Conventional Attacks Against Classifiers

The basic idea of model stealing is to use the target classifier’s output as
ground truth to guide the training procedure of the surrogate classifier. The
adversary takes two steps to conduct the model stealing attacks against the
target classifier.

Obtain the Surrogate Dataset. To conduct model stealing attacks, the adversary
first needs to obtain a surrogate dataset. Based on the knowledge of the
target classifier’s training dataset (target dataset), we consider three
cases. If the adversary has full knowledge of the target dataset, they can
directly leverage the target dataset itself as the surrogate dataset. If the
adversary only knows the categories of the target dataset, they can build the
surrogate dataset by collecting the same categories of images from the
Internet. In the worst case, the adversary has no knowledge of the target
dataset, which means that they can only construct the surrogate dataset which
is distributed differently from the target dataset.

Train the Surrogate Classifier. To train the surrogate classifier, the
adversary can first query the target classifier with the surrogate dataset,
then leverage the responses from the target model as the guidance to train the
surrogate classifier. Concretely, the loss function $L_{MS}$ of model stealing
can be defined as follows:

$\displaystyle L_{MS}$
$\displaystyle=\sum_{k=1}^{N}l(M_{T}(x_{k}),M_{S}(x_{k}))$ (5)

where $M_{T}(\cdot)$/$M_{S}(\cdot)$ denotes the target/surrogate classifier
and $N$ denotes the total number of samples on the surrogate dataset. If the
response of the target classifier is the predicted label (posteriors), we
leverage Cross-Entropy (MSE) as the loss following previous work [30, 29, 24,
20].

###  4.2 Conventional Attacks Against Encoders

The adversary takes two steps to conduct the model stealing attacks against
the target encoder and one step for further evaluation.

Obtain the Surrogate Dataset. The adversary first constructs their surrogate
dataset based on their knowledge of the target dataset, which is the same as
Section 4.1.

Train the Surrogate Encoder. Slightly different from the classifier, the
response of the encoder is an embedding, which is a feature vector. In this
case, the adversary can still leverage a similar loss function to optimize the
surrogate encoder, which can be defined as follows:

$\displaystyle L_{MS}$
$\displaystyle=\sum_{k=1}^{N}l(h_{T}(x_{k}),h_{S}(x_{k}))$ (6)

where $h_{T}(\cdot)$/$h_{S}(\cdot)$ is the target/surrogate encoder, $N$ is
the total number of samples on the surrogate dataset, and $l(\cdot)$ is the
MSE loss.

Apply the Surrogate Encoder to Downstream Tasks. To evaluate the effectiveness
of model stealing attacks against the encoder, the adversary can leverage the
same downstream task to both the target and surrogate encoders. Concretely,
the adversary trains an extra linear layer for the target and surrogate
encoders, respectively. Note that we refer to the target/surrogate encoder and
the extra linear layer as the target/surrogate classifiers. Then, the
adversary quantifies the attack effectiveness by measuring the performance of
the target/surrogate classifier on the downstream tasks as shown in Section
4.1.

###  4.3 Cont-Steal Attacks Against Encoders

To better leverage the rich information from the embeddings, we propose Cont-
Steal , a contrastive learning-based model stealing attacks against encoders,
which leverages contrastive learning to enhance the stealing performance.
Concretely, Cont-Steal aims to enforce the surrogate embedding of an image to
get close to its target embedding (defined as a positive pair), and also push
away embeddings of different images regardless of being generated by the
target or the surrogate encoders (defined as negative pairs). There are three
steps for the adversary to conduct contrastive stealing attacks against
encoders and one step for further evaluation.

Obtain the Surrogate Dataset. The adversary follows the same strategy as
Section 4.1 to obtain the surrogate dataset.

Data Augmentation. Our proposed Cont-Steal leverages data augmentation to
transform an input image into its two augmented views. In this paper, we
leverage RandAugment [9] as the augmentation method, which is made up of a
group of advanced augmentation operations. Concretely, we set $n=2$ and $m=14$
following Cubuk et al. [9] where $n$ denotes the number of transformations to
a given sample and $m$ represents the magnitude of global distortion.

Train the Surrogate Encoder. Instead of querying the encoders with the
original images, the adversary queries the encoders with the augmented views
of them. Concretely, for an input image $x_{i}$, we generate two augmented
views of it, i.e., $\widetilde{x}_{i,s}$ and $\widetilde{x}_{i,t}$, where
$\widetilde{x}_{i,s}$/$\widetilde{x}_{i,t}$ is used to query the
surrogate/target encoder. We consider
$(\widetilde{x}_{i,s},\widetilde{x}_{j,t})$ as a positive pair if $i=j$, and
otherwise a negative pair.

Given a mini-batch of $N$ samples, we generate $N$ augmented views as the
input of the target encoder and another $N$ augmented views as the input of
the surrogate encoders. Concretely, the loss of Cont-Steal can be formulated
as follows:

$\displaystyle
D^{+}_{encoder}=exp(sim(e_{s}(\widetilde{x}_{i,s}),e_{t}(\widetilde{x}_{i,t}))/\tau))$
(7)

$\displaystyle D^{-}_{encoder}$
$\displaystyle=\sum_{k=1}^{N}(exp(sim(e_{s}(\widetilde{x}_{i,s}),e_{t}(\widetilde{x}_{k,t}))/\tau))$
(8)

$\displaystyle D^{-}_{self}$ $\displaystyle=\sum_{k=1}^{N}\mathbbm{1}_{[k\neq
i]}(exp(sim(e_{s}(\widetilde{x}_{i,s}),e_{s}(\widetilde{x}_{k,s}))/\tau))$ (9)
$\displaystyle l(i)=-log$
$\displaystyle\frac{D^{+}_{encoder}}{D^{-}_{encoder}+D^{-}_{self}}$ (10)

$\displaystyle L_{Cont-Steal}$ $\displaystyle=\frac{\sum_{k=1}^{N}l(k)}{N}$
(11)

where $e_{s}(\cdot)$ and $e_{t}(\cdot)$ denotes the surrogate and target
encoder, $sim(u,v)=u^{T}v/||u||||v||$ represents the cosine similarity between
$u$ and $v$, and $\tau$ is parameter to control the temperature.

As illustrated in Figure 2, conventional attack treats each embedding
individually without interacting across pairs. However, different embeddings
are beneficial to each other as they can serve as anchors to better locate the
position of the other embeddings in their space. Cont-Steal maximizes Equation
7, i.e., the similarity of embeddings generated from the target and surrogate
encoders for a positive pair $(\widetilde{x}_{i,s},\widetilde{x}_{i,t})$
(orange arrows in Figure 2). For the embedding generated from the target and
surrogate encoders for a any pair $(\widetilde{x}_{i,s},\widetilde{x}_{j,t})$,
contrastive stealing aims to make them more distant (green arrows in Figure
2). Besides, as pointed out by Chen et al. [5], contrastive learning benefits
larger negative samples. To achieve this goal, we also consider the embeddings
generated from the surrogate encoder for augmented views of different images,
i.e., $(\widetilde{x}_{i,s},\widetilde{x}_{j,s})$, as negative pairs minimize
their similarity (blue arrows in Figure 2). We later show that such design can
enhance the performance of contrastive stealing (see Table 1).

Figure 2: Conventional attack (top) vs. Cont-Steal (bottom) against encoders.
Conventional attack applies MSE loss to approximate target embeddings for each
sample individually. Cont-Steal (bottom) introduces data augmentation and
interacts across multiple samples: associating target/surrogate embeddings of
the same images closer and repulsing those of different images farther away.
The target encoder ($E_{t}$) is pre-trained and fixed as shown in the solid
frame. The surrogate encoder ($E_{s}$) is trainable by adversary as shown in
the dashed frame.

input : Surrogate training dataset $D_{surrogate}^{train}$, target encoder
$E_{t}$, surrogate encoder $E_{s}$

1 _Initialize $E_{s}$’s parameters_;

2 for  _$each$ $epoch$_ do

3 for  _$each$ $batch$_ do

4 Sample a batch with N training data samples $x_{1},x_{2},\cdots,x_{N}$ from
$D_{surrogate}^{train}$ Generate augmented data samples:
$(\widetilde{x}_{1,t},\widetilde{x}_{1,s}),(\widetilde{x}_{2,t},\widetilde{x}_{2,s}),\cdots,(\widetilde{x}_{N,t},\widetilde{x}_{N,s})$,
where $\widetilde{x}_{k,t}$ and $\widetilde{x}_{k,s}$ are the two augmented
views of $x_{k}$ Feed $\widetilde{x}_{k,t}$ to $E_{t}$ and $\widetilde{x}_{k}$
to $E_{s}$ to calculate the contrastive steal loss: $L_{Cont-
Steal}=\frac{\sum_{k=1}^{N}l(k)}{N}$ Optimize $E_{s}$’s parameters with the
contrastive steal loss $L_{Cont-Steal}$

5 end for

6

7 end for

return _Surrogate encoder $E_{s}$_

Algorithm 1 The training process of Cont-Steal.

Algorithm 1 presents the training process of contrastive stealing. In each
batch, given $N$ training samples, we first generate $2N$ augmented views and
feed target encoder and surrogate encoder with different views generated by
the same samples. Then, we optimize the surrogate encoder by minimizing
$L_{Cont-Steal}$.

Apply the Surrogate Encoder to Downstream Tasks. We follow Section 4.2 to
evaluate the effectiveness of model stealing on downstream tasks.

##  5 Experiments

In this section, we first describe the experimental setup in Section 5.1. Then
we show the performance of the target encoders on the downstream tasks in
Section 5.2. Next, we summarize the performance of conventional attacks
against classifiers and encoders in Section 5.3. Lastly, we evaluate the
performance of Cont-Steal and conduct ablation studies to demonstrate its
effectiveness under different settings in Section 5.4.

###  5.1 Experimental Setup

Datasets. We leverage four image datasets to conduct our experiments.

  * •

CIFAR10 [1]: This dataset contains $50,000$ training images and 10,000 testing
images in $10$ classes. Each image in this dataset has the size of $32\times
32\times 3$.

  * •

CIFAR100 [1]: This dataset consists of $100$ classes of images where each
class has $500$ training images and 100 testing images. The size of each image
is $32\times 32\times 3$.

  * •

STL10 [8]: This is a 10-classes dataset where each class contains 500 labeled
training images and 800 labeled testing images. Besides, it also contains
100,000 unlabeled images. The size of each image is $96\times 96\times 3$.

  * •

Wild Datasets: We also consider a more realistic scenario where the adversary
only knows the classes of the dataset that is used to train the target
encoder. Then, the adversary can collect the images from the Internet based on
the given classes. In this way, we obtain three datasets, namely Wild-CIFAR0,
Wild-CIFAR00, and Wild-STL10. Wild-CIFAR0 and Wild-STL10 contain $12,035$
images where each class has roughly $1,200$ images. Wild-CIFAR00 contains
$54,778$ images where each class has roughly 540 images. We apply center crop
and resize all images to $32\times 32\times 3$.

Pre-training Target Encoders. We use CIFAR10, CIFAR100, and STL10 as our
target encoder’s pre-training datasets. In particular, when CIFAR10 and
CIFAR100 are used to pre-train the encoders, we use their training images
(manually mask the labels); when STL10 is used to pre-train the encoders, we
use both of its training images and unlabeled images. We use SimCLR, MoCo,
BYOL, and SimSiam to train a ResNet18 [15] as our target encoders. In
particular, we also adopt the conventional supervised learning method to train
our target encoders to increase the diversity of target models. Specifically,
we first use the conventional supervised learning method to train the whole
classifier for image classification. Then, we consider the classifier before
the last layer as our conventional supervised target encoders. Our
implementation is based on a PyTorch framework of contrastive
learning.111https://github.com/vturrisi/solo-learn We train our encoders for
$400$ epochs with the Adam [23] optimizer and initial learning rate $0.001$.

Training Downstream Classifiers. We use the pre-trained encoders to train
extra linear layers as the classifiers using the above-mentioned datasets as
well. In order to simplify the experimental process, we use the same dataset
as the target encoders to train the downstream classifiers. For example, if
the encoder is pre-trained on CIFAR10, then we also use CIFAR10 to train its
linear layer. When training the linear layer, the encoders’ parameters are
frozen following previous work [5, 17, 21]. We train our downstream
classifiers for $100$ epochs with the initial learning rate of $3e^{-4}$. We
use cross-entropy loss to optimize the linear layer’s parameters.

Note that to evaluate the attack performance against encoders, we train the
linear layers for both target and surrogate encoders on the same downstream
task, i.e., with the same dataset used to pre-train the target encoder.

Evaluation Metrics. We use agreement and accuracy to evaluate the model
stealing attack’s performance. The agreement will evaluate the similarity of
surrogate encoders and target encoders in downstream tasks. The accuracy will
evaluate the practicality of surrogate encodes on downstream tasks.

  1. $\bullet$

Agreement: We calculate agreement by the following formula. The agreement will
evaluate the similarity of surrogate encoders and target encoders in the
downstream task which is also the most important metric to evaluate model
stealing attack’s performance.

$\displaystyle Agreement=\frac{\sum_{i=1}^{n}f_{s}(x_{i})==f_{t}(x_{i})}{n}$
(12)

where $f_{s}$ is surrogate model contains surrogate encoder and surrogate
classifier, $f_{t}$ is target model.

  2. $\bullet$

Accuracy: Accuracy will evaluate the practicality of surrogate encodes on
downstream tasks. In model stealing attacks, accuracy depends on the target
model.

Figure 3: The performance of target classifiers composed by target encoder and
an extra linear layer. The x-axis represents different datasets for the target
encoder and classifier. The y-axis represents the target model’s accuracy on
downstream tasks.

(a) Label

(b) Posterior

(c) Embedding

Figure 4: The t-SNE projection of $5,000$ randomly selected samples’ predicted
labels, posteriors, and embeddings respectively. Note that the target model is
pre-trained by SimCLR on CIFAR10.

###  5.2 Performance of the Target Encoder on Downstream Tasks

We first show the target encoders’ performance in downstream tasks. Besides
the encoders trained with different self-supervised learning methods, we also
train a supervised classifier with the same model architecture and
hyperparameters for each downstream task. The results are summarized in Figure
3.

We observe that compared to models trained in supervised manners (supervised
model), encoders pre-trained by self-supervised learning can always achieve
better performance in downstream tasks with only a linear layer added. For
instance, on STL10, the supervised model can only achieve $0.5331$ accuracy
while models pre-trained by SimCLR, MoCo, BYOL, and SimSiam can achieve
$0.7995$, $0.7456$, $0.7486$, and $0.6757$ accuracy, respectively. Such
observations showcase the great potential of the encoders pre-trained by self-
supervised learning methods in different downstream tasks.

###  5.3 Performance of Conventional Attacks

(a) $D^{train}_{surrogate}$: CIFAR10

(b) $D^{train}_{surrogate}$: Wild-CIFAR10

(c) $D^{train}_{surrogate}$: CIFAR100

(d) $D^{train}_{surrogate}$: STL10

(e) $D^{train}_{surrogate}$: CIFAR10

(f) $D^{train}_{surrogate}$: Wild-CIFAR10

(g) $D^{train}_{surrogate}$: CIFAR100

(h) $D^{train}_{surrogate}$: STL10

Figure 5: The performance of model stealing attack against target models
trained on CIFAR10. Target models can give out predicted labels, posteriors,
or embeddings. The adversary uses CIFAR10, Wild-CIFAR10, CIFAR100, STL10 to
conduct model stealing attacks. The x-axis represents different kinds of
target models. The first line’s y-axis represents the agreement of the model
stealing attack. The second line’s y-axis represents the accuracy of the model
stealing attack. Figure 6: The gap between accuracy and agreement. The x-axis
represents the absolute value of the gap between agreement and accuracy. The
y-axis represents the number of samples laying in this range of gap.

As we mentioned in Section 4.2, when the target model is a classifier, by
querying the target model with an input image, the adversary may obtain its
predicted label or posteriors. The adversary can instead obtain the input
image’s embedding if the target model is an encoder. We show our results of
CIFAR10 (Figure 5, CIFAR100 (Figure 13 in Appendix) and STL10 (Figure 14 in
Appendix). When the target model is a classifier, we observe that the model
stealing attacks can achieve better performance when the response is
posteriors instead of the predicted label. For instance, when the target model
is SimCLR and both the target and surrogate dataset are CIFAR10 (5(a) and
5(e)), the surrogate model’s agreement (accuracy) is $0.7082$ ($0.7059$) when
the response is predicted label while increases to $0.7237$ ($0.7182$) when
the response is posteriors. Another observation is that compared to predicted
label or posteriors, given the embedding as the response, the surrogate
model’s agreement and accuracy can be improved further. For instance, when the
target model is MoCo and both the target and surrogate dataset are CIFAR10
(5(a) and 5(e)), the surrogate model’s agreement (accuracy) is $0.7781$
($0.7722$) when the response is embedding while only $0.7126$ and $0.7185$
($0.759$ and $0.7489$) when the response is predicted label or posteriors.
Such observation indicates that the embedding contains the most information
while the predicted label contains the least.

To better understand this, we extract samples’ predicted labels (one-hot),
posteriors, and embeddings from the SimCLR model on CIFAR10 and project them
into a 2-dimension space with t-Distributed Neighbor Embedding (t-SNE) [43].
Figure 4 shows the results for the predicted label, posteriors, and embedding.
Different colors represent different classes. From 4(a), we observe that
samples from different classes may be mapped into the same area since they
have the same predicted label. For instance, the green and orange points are
mapped into the right area although they do not have the same ground truth
labels. Regarding posteriors (4(b)), we find that different colors are more
separable compared to the predicted labels (4(a)). Regarding the embeddings
4(c), we find that samples with different classes are mostly projected into
different spaces, which makes it easier for the surrogate encoders to learn
the distribution of different samples.

We then relax the assumption of the same distribution surrogate dataset. Here
we consider two cases as mentioned in Section 3, i.e., the adversary can
either collect a dataset from the Internet that has the same classes or use a
different dataset to conduct the model stealing attacks.

For the first case where the adversary can obtain a surrogate dataset from the
Internet, we discover that the performance of model stealing attacks is also
effective with an acceptable drop compared to the same distribution surrogate
dataset. For example, when the target encoder is SimCLR and with embedding as
its responses, the attack agreement is $0.4393$ when both target and surrogate
dataset are CIFAR100 while remains at $0.4336$ when the surrogate dataset is
Wild-CIFAR100. Another observation is that the attack performance is similar
under different types of target model responses. For instance, when the target
model is SimSiam trained on CIFAR10 and the surrogate dataset is Wild-CIFAR10
(see 4(b)), the attack agreement is $0.5454$, $0.5492$, and $0.5074$ when the
response is embedding, posteriors, and predicted label, respectively. We also
have similar observations with respect to accuracy.

For the second case, the adversary can only obtain a different distribution
surrogate dataset to conduct the attack. We observe that in this case, the
model stealing attacks are less effective when the target model’s response is
predicted label or posteriors, but still powerful when the response is
embedding. For instance, When the target model is BYOL trained on CIFAR10 and
the surrogate dataset is CIFAR100, the attack agreement is $0.4686$, $0.6231$,
and $0.6880$ for the predicted label, posteriors, and embedding as the
responses. Another finding is that a more complex dataset might be helpful for
model stealing attacks. Take SimCLR model train on CIFAR10 as an example
(Figure 4), compared to taking STL10 as the surrogate dataset, the attack
agreement increases by $0.2507$, $0.2023$, and $0.0698$ when the surrogate
dataset is CIFAR100 with the predicted label, posteriors, and embedding as the
response, respectively. We conjecture that a complex dataset may cover a
larger area in both the representation space (embedding) and classification
space (predicted label or posteriors), which enables the surrogate model to
capture more potential patterns from the target model. From the figure, we
also observe that the gap between attack performance on encoder and classifier
becomes larger when the adversary has little knowledge about training data.

We also find that model stealing attacks’ accuracy and agreement are highly
correlated. We calculate the gap between accuracy and agreement in Figure 6
and find that in all our experiment settings, most of the gaps between
accuracy and agreement are less than $0.05$.

Takeaways. In conclusion, encoders are more vulnerable to model stealing
attacks than classifiers. This is because the rich information in embeddings
can better facilitate the learning process of surrogate encoders. The more
useful information the target model gives out, the more vulnerable the target
model is to model stealing attacks. Although model stealing attacks against
encoders can achieve great performance, our study shows that encoders leak
more information for the adversary to learn to make surrogate encoders more
similar to target encoders. To fully use the encoder’s output, we conduct our
attacks by leveraging Cont-Steal .

(a) Target encoder

(b) Cont-Steal

(c) Conventional

Figure 7: The t-SNE projection of $5,000$ randomly selected samples’
embeddings from target encoder, surrogate encoder under Cont-Steal , and
surrogate encoder under the conventional attack, respectively. Note that the
target encoder is pre-trained by SimCLR on CIFAR10.

(a) $D^{train}_{surrogate}$: CIFAR10

(b) $D^{train}_{surrogate}$: Wild-CIFAR10

(c) $D^{train}_{surrogate}$: CIFAR100

(d) $D^{train}_{surrogate}$: STL10

(e) $D^{train}_{surrogate}$: CIFAR10

(f) $D^{train}_{surrogate}$: Wild-CIFAR10

(g) $D^{train}_{surrogate}$: CIFAR100

(h) $D^{train}_{surrogate}$: STL10

Figure 8: The performance of Cont-Steal and conventional attack against target
encoders trained on CIFAR10. The adversary uses CIFAR10, Wild-CIFAR10,
CIFAR100, STL10 to conduct model stealing attacks. The x-axis represents
different kinds of the target model. The first line’s y-axis represents the
agreement of the model stealing attack. The second line’s y-axis represents
the accuracy of the model stealing attack.

###  5.4 Performance of Cont-Steal

As shown in Section 5.3, encoders are more vulnerable to model stealing
attacks since the embedding usually contains richer information compared to
the predicted label or posteriors. We then show that our proposed Cont-Steal
can achieve better attack performance by making deeper use of embeddings’
information.

Figure 8 shows the attack performance when the target dataset is CIFAR10. Note
that we also show the attack performance when the target dataset is CIFAR100
(Figure 15 in Appendix) and STL10 (Figure 16 in Appendix). We discover that
compared to conventional attacks against encoders, Cont-Steal can consistently
achieve better performance. For instance, as shown in 8(d), when the target
encoder is MoCo trained on CIFAR10, if the adversary uses STL10 to conduct
model stealing attacks against encoders, the surrogate encoder can achieve
$0.8518$ agreement in downstream tasks with the Cont-Steal but only $0.5898$
with conventional attacks. Another finding is that compared to the same
distribution surrogate dataset, our Cont-Steal can better enhance the
performance when the surrogate dataset comes from a different distribution of
the target dataset. For instance, when the target encoder is SimCLR trained on
CIFAR10, Cont-Steal outperforms conventional attack by $0.0550$ agreement when
the surrogate dataset is also CIFAR10, while the improvement increases to
$0.2074$ and $0.2142$ when the surrogate dataset is STL10 and Wild-CIFAR10.

(a) Supervised

(b) SimCLR

(c) MoCo

(d) BYOL

(e) SimSiam

Figure 9: Heatmap of the agreement scores of model stealing attacks. We show
the performance of 16 combinations of different information that the target
model gives out and the adversary’s knowledge on target training data.

To better understand why Cont-Steal can always achieve better performance, we
extract samples’ embeddings generated by different encoders, i.e., the target
encoder, surrogate encoder trained with the conventional attack, and surrogate
encoder trained with the Cont-Steal , and project them into a 2-dimensional
space using t$\\_$Distributed Neighbor Embedding(t-SNE). From the results
summarized in Figure 7, we find that Cont-Steal can effectively copy the
pattern of the embeddings as the target encoder. However, the conventional
attack fails to capture such patterns for a number of input samples, e.g., the
outer circle in 7(c). This further demonstrates that Cont-Steal benefits from
jointly considering different embeddings as they can serve as anchors to
better locate the position of the other embeddings in their space.

We then conduct some ablation studies to better illustrate the effectiveness
of Cont-Steal . Note that we only use agreement later to evaluate the
performance as Figure 6 shows that the gap between accuracy and agreement is
small.

Impact of The Surrogate Dataset’s Distribution. To evaluate the impact of the
adversary’s knowledge of the target dataset with respect to different attacks,
we plot the attack agreement in Figure 9 where the target encoder is pre-
trained on CIFAR10. We can see that when the adversary conducts a conventional
attack against the classifier, the adversary’s knowledge of target training
data is crucial. For instance, when the target model is a classifier pre-
trained by SimCLR and the response is predicted label, the adversary can only
achieve a $0.1519$ agreement if the surrogate dataset is STL10, i.e.,
completely different from the target dataset, while the agreement is $0.7082$
if surrogate data is exactly the same as target dataset. Compared to predicted
label or posteriors as the response, embedding depends less on the surrogate
dataset distribution, and Cont-Steal can better leverage the embedding
information. For instance, where the target model is trained by SimCLR on
CIFAR10, Cont-Steal can achieve $0.8014$ agreement when the surrogate dataset
is CIFAR100, which is even better than the best conventional attack ($0.7786$)
using the exact same target training dataset as the surrogate dataset and
embedding as the response. Such observation better implies Cont-Steal depends
less on the surrogate dataset’s distribution and can achieve better
performance in general.

(a) $D^{train}_{surrogate}$: CIFAR10

(b) $D^{train}_{surrogate}$: CIFAR100

(c) $D^{train}_{surrogate}$: STL10

(d) $D^{train}_{surrogate}$: WILD-CIFAR10

Figure 10: The agreement of Cont-Steal and conventional attack against the
target encoder which is trained on CIFAR10 by SimCLR. The X-axis represents
the epoch used to train surrogate encoders. The Y-axis represents the
agreement of surrogate encoders on downstream tasks.

Impact of the Surrogate Model’s Training Epochs. When conducting model
stealing attacks, more training epochs mean bigger cost and more easily to be
detected by the model owner. We evaluate the effectiveness of our attack with
different numbers of training epochs and the results are summarized in Figure
10. We observe that both conventional attack and the Cont-Steal converge in
the early stage of the training, e.g., 25 epochs. For instance, when the
target dataset is CIFAR10 and the surrogate dataset is CIFAR100, Cont-Steal
attack achieves $0.6587$ agreement in 25 epochs, while increases to $0.6778$
in 200 epochs. For conventional attacks, we also have a similar finding. We
also discover that Cont-Steal can steal target encoders faster than
conventional attacks. Take the case where target encoder is SimCLR and target
dataset and surrogate dataset are both CIFAR10 as an example, we can see that
after 25 epochs, the Cont-Steal and Conventional steal both achieve their
relatively stable agreement score. Such observation reveals that model
stealing attack is still effective with fewer training epochs.

Impact of the Surrogate Dataset’s Size. The size of the surrogate dataset is
also an important factor in conducting the model stealing attack, as it may
require lots of effort in collecting data and a larger cost when querying the
target encode with a bigger dataset. Here we study whether our attack is still
effective with fewer data. Concretely, we vary the size of the surrogate
dataset from $10\%$ to $90\%$ and evaluate the attack performance. Figure 11
shows that compared to conventional attacks against encoder, Cont-Steal can
consistently achieve better performance when the surrogate dataset’s size is
limited. For instance, when the adversary only uses $10\%$ of STL10 to conduct
model stealing attacks against encoder, Cont-Steal can achieve $0.4462$
agreement which is even higher than conventional attacks against encoder using
the full STL10 dataset. Such observation further demonstrates the efficacy of
Cont-Steal , which can consistently perform better with much fewer data.

(a) $D^{train}_{surrogate}$: CIFAR100

(b) $D^{train}_{surrogate}$: CIFAR10

(c) $D^{train}_{surrogate}$: STL10

(d) $D^{train}_{surrogate}$: Wild-CIFAR100

Figure 11: The agreement of Cont-Steal and conventional attack against the
target encoder which is trained on CIFAR100 by SimCLR. The X-axis represents
the percentage of randomly selected data in the surrogate dataset. The y-axis
represents the agreement of the surrogate model.

(a) Cont-Steal

(b) Conventional

Figure 12: The agreement of conventional attack and Cont-Steal attack against
the target encoder which is ResNet18 trained on CIFAR10. The surrogate model
is ResNet18, ResNet34 or ResNet50. The surrogate dataset is CIFAR100. The
x-axis represents the different kinds of target model. The y-axis represents
the agreement of the model stealing attack.

Impact of the Surrogate Model’s Architecture. Previous experiments are based
on the assumption that the adversary knows the target model’s architecture. We
then investigate whether the attack against the encoder is still effective
when the surrogate encoder has different model architectures compared to the
target encoder. Concretely, we perform Cont-Steal and conventional attacks
against the ResNet18 encoder with surrogate model’s architecture as ResNet18,
ResNet34, and ResNet50, respectively.

As shown in Figure 12, the attacks are more effective when the surrogate
encoder has the same architecture as the target encoder. For instance, when
the target model is pre-trained by BYOL, if the surrogate model is ResNet18,
which is the same as the target model, the adversary can achieve $0.8296$
agreement. When the surrogate encoder is ResNet50, which is more complex but
different from the target encoder, the adversary can only achieve $0.7135$
agreement. However, the gap is acceptable in different training algorithms,
and even negligible on MoCo. In conclusion, the architecture of the surrogate
model only has limited influence on the attack performance.

Impact of Negative Pairs Generated from the Surrogate Encoder. In Cont-Steal
’s loss functions, besides $D^{-}_{encoder}$, we also consider the distance of
negative pairs generated from the surrogate encoder itself, i.e.,
$D^{-}_{self}$. To evaluate the necessity of $D^{-}_{self}$, we take the
target encoder trained by BYOL on STL10 as an example and study the attack
performance without $D^{-}_{self}$. The results are summarized in Table 1. We
find that adding $D^{-}_{self}$ indeed improves the attack performance in
terms of the agreement while preserving the accuracy. For instance, when the
surrogate dataset is STL10, the surrogate model stolen by Cont-Steal with
$D^{-}_{self}$ achieves $0.687$ agreement while only $0.514$ if without
$D^{-}_{self}$. The reason behind is that the negative pairs generated from
the surrogate encoder can serve as extra “anchors” to better locate the
position of the embedding, which leads to higher agreement. Such observation
demonstrates that it is important to include $D^{-}_{self}$ in Cont-Steal .

Table 1: The agreement and accuracy of different contrastive losses. We use BYOL trained on STL10 as the target model.  Dataset | Method | BYOL
---|---|---
Agreement | Accuracy
STL10 | w/o $D^{-}_{encoder}$ | 0.5144 | 0.4834
w $D^{-}_{encoder}$ | 0.6868 | 0.6251
CIFAR10 | w/o $D^{-}_{encoder}$ | 0.4810 | 0.4653
w $D^{-}_{encoder}$ | 0.5430 | 0.4608
CIFAR100 | w/o $D^{-}_{encoder}$ | 0.4868 | 0.4769
w $D^{-}_{encoder}$ | 0.5448 | 0.4721
Wild-STL10 | w/o $D^{-}_{encoder}$ | 0.5144 | 0.4834
w $D^{-}_{encoder}$ | 0.5364 | 0.4831

Takeaways. We show that both conventional attacks and our Cont-Steal are
effective even under different restrictions, which means the threat of model
stealing attacks against encoders is largely underestimated. Cont-Steal ’s
outstanding performance further amplifies the threat by leveraging a more
powerful way to conduct the model stealing attacks against the target encoder.

##  6 Related Work

Contrastive Learning. Contrastive learning is one of the most popular methods
to train encoders. Oord et al. [42] proposed Contrastive Predictive Coding,
where probabilistic contrastive loss is used to capture information. Wu et al.
[47] used a memory bank to store the instance class representation vector and
then conducted prediction based on these representations. He et al. [14]
proposed a new framework, MoCo, which adds momentum technique to prevent
contrastive collapse while maintaining the diversity of negative samples. Chen
et al. [5] proposed SimCLR, which reveals the importance of data augmentation
and projector behind encoder. Grill et al. [13] proposed BYOL where negative
pair is unnecessary. BYOL also adopts the momentum technique. Chen et al. [7]
proposed SimSiam. SimSiam removed the momentum encoder on the basis of BYOL.
To avoid contrastive collapse, SimSiam uses the stop gradient technique.
SimCLR, MoCo, BYOL, SimSiam are currently the mainstream frameworks of
contrastive learning, thus we concentrate on them in this paper.

Previous work also evaluate the security and privacy risks stemming from
contrastive learning. He et al. [17] conducted membership inference and
attribute inference attacks against contrastive models and showed that
contrastive models are less vulnerable to membership inference attacks but
more prone to attribute inference attacks. Jia et al. [21] proposed backdoor
attacks against contrastive models and showed that the backdoor can be
effectively injected into the encoder to perform abnormally in specific
downstream tasks. Liu et al. [25] proposed a membership inference attack
against encoders trained by contrastive learning. Concretely, they leveraged
different augmentations of a sample to query the target encoder and calculated
the similarity scores among those embeddings. Intuitively, if the sample is a
member, different embeddings should be closer, which leads to higher
similarity scores.

Model Stealing Attack. In model stealing attacks, the adversary’s goal is to
steal part of the target model. Tramèr et al. [41] proposed the first model
stealing attack against black-box machine learning API to steal its
parameters. Wang et al. [44] proposed the first hyperparameter stealing
attacks against ML models. Oh et al. [28] also tried to steal machine learning
model’s architectures and hyperparameters. Orekondy et al. [29] proposed
knockoff nets, which aim at stealing the functionality of black-box models.
Krishna et al. [24] formulated the model stealing attack against BERT-based
API. Besides, Wu et al. [45] and Shen et al. [36] perform model stealing
attacks against Graph Neural Networks where Wu et al. [45] focus on the
transductive setting and Shen et al. [36] concentrate on the inductive
setting. These works often have relative strong assumptions such as model
family is known and victim’s data is partly available while we conduct model
stealing attacks against encoders and relax the above assumption as well.

Knowledge Distillation. Knowledge distillation aims to transfer the knowledge
from the larger “teacher” model to the smaller “student” model. Hinton et al.
[18] introduced the idea of knowledge distillation. The basic motivation of
knowledge distillation is to achieve fast and lightweight learning. Yuan et
al. [48] extended the knowledge distillation to the self-learning field by
proposing a Teacher-free Knowledge Distillation(Tf-KD) framework. Tian et al.
[39] proposed contrastive representation distillation where contrastive loss
is used to do knowledge distillation. Knowledge distillation is similar to
model stealing attacks, but it always assumes the adversary knows everything
about the target model, whereas model stealing attacks only have limited
assumptions.

##  7 Conclusion

In this paper, we conduct the first model stealing risk assessment towards
image encoders. Our evaluation shows that the encoder is more vulnerable to
model stealing attacks compared to the classifier. This is because the
embedding provided by the encoder contains richer information than the
posteriors or predicted labels returned by the whole classifier. Such
embedding can be leveraged by the surrogate encoder to better learn the
distribution of representations from the target encoder.

To better unleash the power from the embeddings, we propose Cont-Steal , a
contrastive learning-based model stealing method against encoders. Concretely,
Cont-Steal introduces different types of negative pairs as “anchors” to better
navigate the surrogate encoder learn the functionality of the target encoder.
Extensive evaluations show that Cont-Steal consistently performs better than
conventional attacks against encoders. And such an advantage is further
amplified when the adversary has no information of the target dataset, a
limited amount of data, and restricted query budgets. Our work points out that
the threat of model stealing attacks against encoders is largely
underestimated, which calls for effective intellectual property protection of
representation learning techniques, especially to the defenses against encoder
stealing attacks like ours.

## References

  * [1] https://www.cs.toronto.edu/~kriz/cifar.html.
  * [2] Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Srndic, Pavel Laskov, Giorgio Giacinto, and Fabio Roli.  Evasion Attacks against Machine Learning at Test Time.  In European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML/PKDD), pages 387–402. Springer, 2013.
  * [3] Nicholas Carlini and David Wagner.  Towards Evaluating the Robustness of Neural Networks.  In IEEE Symposium on Security and Privacy (S&P), pages 39–57. IEEE, 2017.
  * [4] Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan.  Model Extraction and Active Learning.  CoRR abs/1811.02054, 2018.
  * [5] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey E. Hinton.  A Simple Framework for Contrastive Learning of Visual Representations.  In International Conference on Machine Learning (ICML), pages 1597–1607. PMLR, 2020.
  * [6] Xiaoyi Chen, Ahmed Salem, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang.  BadNL: Backdoor Attacks Against NLP Models with Semantic-preserving Improvements.  In Annual Computer Security Applications Conference (ACSAC), pages 554–569. ACSAC, 2021.
  * [7] Xinlei Chen and Kaiming He.  Exploring Simple Siamese Representation Learning.  In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 15750–15758. IEEE, 2021.
  * [8] Adam Coates, Andrew Y. Ng, and Honglak Lee.  An Analysis of Single-Layer Networks in Unsupervised Feature Learning.  In International Conference on Artificial Intelligence and Statistics (AISTATS), pages 215–223. JMLR, 2011.
  * [9] Ekin Dogus Cubuk, Barret Zoph, Jon Shlens, and Quoc Le.  RandAugment: Practical Automated Data Augmentation with a Reduced Search Space.  In Annual Conference on Neural Information Processing Systems (NeurIPS), pages 18613–18624. NeurIPS, 2020.
  * [10] Carl Doersch and Andrew Zisserman.  Multi-task Self-Supervised Visual Learning.  In IEEE International Conference on Computer Vision (ICCV), pages 2070–2079. IEEE, 2017.
  * [11] Spyros Gidaris, Praveer Singh, and Nikos Komodakis.  Unsupervised Representation Learning by Predicting Image Rotations.  In International Conference on Learning Representations (ICLR), 2018.
  * [12] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and Harnessing Adversarial Examples.  In International Conference on Learning Representations (ICLR), 2015.
  * [13] Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre H. Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Ávila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, Bilal Piot, Koray Kavukcuoglu, Rémi Munos, and Michal Valko.  Bootstrap Your Own Latent - A New Approach to Self-Supervised Learning.  In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2020.
  * [14] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross B. Girshick.  Momentum Contrast for Unsupervised Visual Representation Learning.  In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 9726–9735. IEEE, 2020.
  * [15] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep Residual Learning for Image Recognition.  In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778. IEEE, 2016.
  * [16] Xinlei He, Rui Wen, Yixin Wu, Michael Backes, Yun Shen, and Yang Zhang.  Node-Level Membership Inference Attacks Against Graph Neural Networks.  CoRR abs/2102.05429, 2021.
  * [17] Xinlei He and Yang Zhang.  Quantifying and Mitigating Privacy Risks of Contrastive Learning.  In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 845–863. ACM, 2021.
  * [18] Geoffrey E. Hinton, Oriol Vinyals, and Jeffrey Dean.  Distilling the Knowledge in a Neural Network.  CoRR abs/1503.02531, 2015.
  * [19] Bo Hui, Yuchen Yang, Haolin Yuan, Philippe Burlina, Neil Zhenqiang Gong, and Yinzhi Cao.  Practical Blind Membership Inference Attack via Differential Comparisons.  In Network and Distributed System Security Symposium (NDSS). Internet Society, 2021.
  * [20] Matthew Jagielski, Nicholas Carlini, David Berthelot, Alex Kurakin, and Nicolas Papernot.  High Accuracy and High Fidelity Extraction of Neural Networks.  In USENIX Security Symposium (USENIX Security), pages 1345–1362. USENIX, 2020.
  * [21] Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong.  BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning.  In IEEE Symposium on Security and Privacy (S&P). IEEE, 2022.
  * [22] Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan.  Supervised Contrastive Learning.  In Annual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2020.
  * [23] Diederik P. Kingma and Jimmy Ba.  Adam: A Method for Stochastic Optimization.  In International Conference on Learning Representations (ICLR), 2015.
  * [24] Kalpesh Krishna, Gaurav Singh Tomar, Ankur P. Parikh, Nicolas Papernot, and Mohit Iyyer.  Thieves on Sesame Street! Model Extraction of BERT-based APIs.  In International Conference on Learning Representations (ICLR), 2020.
  * [25] Hongbin Liu, Jinyuan Jia, Wenjie Qu, and Neil Zhenqiang Gong.  EncoderMI: Membership Inference against Pre-trained Encoders in Contrastive Learning.  In ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2021.
  * [26] Milad Nasr, Reza Shokri, and Amir Houmansadr.  Machine Learning with Membership Privacy using Adversarial Regularization.  In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 634–646. ACM, 2018.
  * [27] Milad Nasr, Reza Shokri, and Amir Houmansadr.  Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning.  In IEEE Symposium on Security and Privacy (S&P), pages 1021–1035. IEEE, 2019.
  * [28] Seong Joon Oh, Max Augustin, Bernt Schiele, and Mario Fritz.  Towards Reverse-Engineering Black-Box Neural Networks.  In International Conference on Learning Representations (ICLR), 2018.
  * [29] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz.  Knockoff Nets: Stealing Functionality of Black-Box Models.  In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 4954–4963. IEEE, 2019.
  * [30] Nicolas Papernot, Patrick D. McDaniel, Ian Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami.  Practical Black-Box Attacks Against Machine Learning.  In ACM Asia Conference on Computer and Communications Security (ASIACCS), pages 506–519. ACM, 2017.
  * [31] Nicolas Papernot, Patrick D. McDaniel, Somesh Jha, Matt Fredrikson, Z. Berkay Celik, and Ananthram Swami.  The Limitations of Deep Learning in Adversarial Settings.  In IEEE European Symposium on Security and Privacy (Euro S&P), pages 372–387. IEEE, 2016.
  * [32] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Yann Ollivier, and Hervé Jégou.  White-box vs Black-box: Bayes Optimal Strategies for Membership Inference.  In International Conference on Machine Learning (ICML), pages 5558–5567. PMLR, 2019.
  * [33] Ahmed Salem, Michael Backes, and Yang Zhang.  Don’t Trigger Me! A Triggerless Backdoor Attack Against Deep Neural Networks.  CoRR abs/2010.03282, 2020.
  * [34] Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang.  Dynamic Backdoor Attacks Against Machine Learning Models.  CoRR abs/2003.03675, 2020.
  * [35] Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes.  ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models.  In Network and Distributed System Security Symposium (NDSS). Internet Society, 2019.
  * [36] Yun Shen, Xinlei He, Yufei Han, and Yang Zhang.  Model Stealing Attacks Against Inductive Graph Neural Networks.  In IEEE Symposium on Security and Privacy (S&P). IEEE, 2022.
  * [37] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov.  Membership Inference Attacks Against Machine Learning Models.  In IEEE Symposium on Security and Privacy (S&P), pages 3–18. IEEE, 2017.
  * [38] Liwei Song and Prateek Mittal.  Systematic Evaluation of Privacy Risks of Machine Learning Models.  In USENIX Security Symposium (USENIX Security). USENIX, 2021.
  * [39] Yonglong Tian, Dilip Krishnan, and Phillip Isola.  Contrastive Representation Distillation.  In International Conference on Learning Representations (ICLR), 2020.
  * [40] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel.  Ensemble Adversarial Training: Attacks and Defenses.  In International Conference on Learning Representations (ICLR), 2017.
  * [41] Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart.  Stealing Machine Learning Models via Prediction APIs.  In USENIX Security Symposium (USENIX Security), pages 601–618. USENIX, 2016.
  * [42] Aäron van den Oord, Yazhe Li, and Oriol Vinyals.  Representation Learning with Contrastive Predictive Coding.  CoRR abs/1807.03748, 2018.
  * [43] Laurens van der Maaten and Geoffrey Hinton.  Visualizing Data using t-SNE.  Journal of Machine Learning Research, 2008.
  * [44] Binghui Wang and Neil Zhenqiang Gong.  Stealing Hyperparameters in Machine Learning.  In IEEE Symposium on Security and Privacy (S&P), pages 36–52. IEEE, 2018.
  * [45] Bang Wu, Xiangwen Yang, Shirui Pan, and Xingliang Yuan.  Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realization.  CoRR abs/2010.12751, 2020.
  * [46] Huijun Wu, Chen Wang, Yuriy Tyshetskiy, Andrew Docherty, Kai Lu, and Liming Zhu.  Adversarial Examples for Graph Data: Deep Insights into Attack and Defense.  In International Joint Conferences on Artifical Intelligence (IJCAI), pages 4816–4823. IJCAI, 2019.
  * [47] Zhirong Wu, Yuanjun Xiong, Stella X. Yu, and Dahua Lin.  Unsupervised Feature Learning via Non-Parametric Instance Discrimination.  In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 3733–3742. IEEE, 2018.
  * [48] Li Yuan, Francis E. H. Tay, Guilin Li, Tao Wang, and Jiashi Feng.  Revisiting Knowledge Distillation via Label Smoothing Regularization.  In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 3903–3911. IEEE, 2020.
  * [49] Chengxu Zhuang, Alex Lin Zhai, and Daniel Yamins.  Local Aggregation for Unsupervised Learning of Visual Embeddings.  In IEEE International Conference on Computer Vision (ICCV), pages 6001–6011. IEEE, 2019.

##  Appendix A Appendix

(a) $D^{train}_{surrogate}$: CIFAR100

(b) $D^{train}_{surrogate}$: Wild-CIFAR100

(c) $D^{train}_{surrogate}$: CIFAR10

(d) $D^{train}_{surrogate}$: STL10

(e) $D^{train}_{surrogate}$: CIFAR100

(f) $D^{train}_{surrogate}$: Wild-CIFAR100

(g) $D^{train}_{surrogate}$: CIFAR10

(h) $D^{train}_{surrogate}$: STL10

Figure 13: The performance of model stealing attack against target models
trained on CIFAR100. Target models can give out predicted label, posterior, or
embeddings. The adversary uses CIFAR100, Wild-CIFAR100, CIFAR10, STL10 to
conduct model stealing attacks. The x-axis represents different kinds of the
target model. The first line’s y-axis represents the agreement of the model
stealing attack. The second line’s y-axis represents the accuracy of the model
stealing attack

(a) $D^{train}_{surrogate}$: STL10

(b) $D^{train}_{surrogate}$: Wild-STL10

(c) $D^{train}_{surrogate}$: CIFAR10

(d) $D^{train}_{surrogate}$: CIFAR100

(e) $D^{train}_{surrogate}$: STL10

(f) $D^{train}_{surrogate}$: Wild-STL10

(g) $D^{train}_{surrogate}$: CIFAR10

(h) $D^{train}_{surrogate}$: CIFAR100

Figure 14: The performance of model stealing attack against target models
trained on STL10. Target models can give out the predicted label, posterior,
or embeddings. The adversary uses STL10, Wild-STL10, CIFAR10, CIFAR100 to
conduct model stealing attacks. The x-axis represents different kinds of the
target model. The first line’s y-axis represents the agreement of the model
stealing attack. The second line’s y-axis represents the accuracy of the model
stealing attack

(a) $D^{train}_{surrogate}$: CIFAR100

(b) $D^{train}_{surrogate}$: Wild-CIFAR100

(c) $D^{train}_{surrogate}$: CIFAR10

(d) $D^{train}_{surrogate}$: STL10

(e) $D^{train}_{surrogate}$: CIFAR100

(f) $D^{train}_{surrogate}$: Wild-CIFAR100

(g) $D^{train}_{surrogate}$: CIFAR10

(h) $D^{train}_{surrogate}$: STL10

Figure 15: The performance of Contrastive Stealing and conventional attack
against target encoders trained on CIFAR100. The adversary uses CIFAR100,
Wild-CIFAR100, CIFAR10, STL10 to conduct model stealing attacks. The x-axis
represents different kinds of the target model. The first line’s y-axis
represents the agreement of the model stealing attack. The second line’s
y-axis represents the accuracy of the model stealing attack

(a) $D^{train}_{surrogate}$: STL10

(b) $D^{train}_{surrogate}$: Wild-STL10

(c) $D^{train}_{surrogate}$: CIFAR10

(d) $D^{train}_{surrogate}$: CIFAR100

(e) $D^{train}_{surrogate}$: STL10

(f) $D^{train}_{surrogate}$: Wild-STL10

(g) $D^{train}_{surrogate}$: CIFAR10

(h) $D^{train}_{surrogate}$: CIFAR100

Figure 16: The performance of Contrastive Stealing and conventional attack
against target encoders trained on STL10. The adversary uses STL10, Wild-
STL10, CIFAR10, CIFAR100 to conduct model stealing attacks. The x-axis
represents different kinds of the target model. The first line’s y-axis
represents the agreement of the model stealing attack. The second line’s
y-axis represents the accuracy of the model stealing attack.

(a) Cont-Steal
$D_{surrogate}^{train}$ = CIFAR10

(b) Cont-Steal
$D_{surrogate}^{train}$ = STL0

(c) Cont-Steal
$D_{surrogate}^{train}$ = Wild-CIFAR10

(d) Conventional
$D_{surrogate}^{train}$ = CIFAR10

(e) Conventional
$D_{surrogate}^{train}$ = STL10

(f) Conventional
$D_{surrogate}^{train}$ = Wild-CIFAR10

Figure 17: The agreement of Cont-Steal and conventional attack against target
encoder which is ResNet18 trained on CIFAR10 by SimCLR. Surrogate model is
ResNet18, ResNet34 or ResNet50. The first line is the attack performance of
Cont-Steal and the second line is the performance of conventional attack. The
X-axis represents the different kinds of the target model. The Y-axis
represents the agreement of the model stealing attack.