SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Table 7: Stealing and Using Encoders With and Without our Defense. The model used in the experiments is DINO, with the following parameters for the cost function  $\lambda = 10^{-6}$ ,  $\alpha = 1000$ , and  $\beta = 60\%$ , and the number of buckets equal to  $2^{12}$ . We have to increase the value of parameter  $\alpha$  by  $\times 1000$  since the norms of the DINO representations are also around  $10^{3}$  higher than for SimSiam. We observe that B4B performs similarly on DINO as for SimSiam.
USER	DEFENSE	# QUERIES	DATASET	TYPE	CIFAR10	STL10	SVHN	F-MNIST
LEGIT	NONE	ALL	TASK	QUERY	94.51 ±0.08	97.98 ±0.04	70.66 ±0.16	89.98 ±0.03
LEGIT	B4B	ALL	TASK	QUERY	94.25 ±0.11	98.05 ±0.04	69.66 ±0.14	89.68 ±0.01
ATTACK	NONE	50K	IMGNET	STEAL	67.92 ±0.04	66.02 ±0.22	61.30 ±0.01	89.46 ±0.01
ATTACK	B4B	50K	IMGNET	STEAL	42.02±0.05	38.91±0.06	19.94±0.02	73.33±0.04
ATTACK	NONE	100K	IMGNET	STEAL	75.07 ±0.01	76.32 ±0.02	71.79 ±0.06	89.76 ±0.01
ATTACK	B4B	100K	IMGNET	STEAL	19.27±0.03	21.24±0.03	19.84±0.01	71.01±0.03
SYBIL	B4B	50K+50K	IMGNET	STEAL	45.56±0.06	42.50±0.02	24.25±0.03	78.01±0.08
F.8 Additional evaluation of transformations
Additionally, we show the impact of transformations on the performance of legitimate users in Table 8 (for both SimSiam and DINO).
Figure 13: Protocol to Evaluate the Mapping Between Representations. We present the protocol of evaluating remappings for two sybil accounts.  $①$  API receives inputs from two sybil accounts and generates corresponding representations.  $②$  Representations are transformed on a per-user basis and returned.  $③$  Adversary trains a reference classifier on representations from account one.  $④$  Adversary trains a linear model to find mapping from representations of account two to representations of account one.  $⑤$  To check the quality of obtained mapping representations from test set of account two are mapped using the fixed mapper (from step 4) to representation space of account one. This enables the calculation of cosine distance between representations from account one and their counterparts from account two shown in Figure 5. Additionally, the fixed reference classifier (from step 3) can be used to measure the accuracy drop caused by remapping.
Table 8: Impact of Transformations on the Performance for Legitimate Users. We show that the transformations applied per-account do not harm the performance of legitimate users on their downstream tasks. The victim encoders was trained on the ImageNet dataset using SimSiam and DINO frameworks.
TRANSFORMATION	ENCODER	CIFAR10	STL10	SVHN	F-MNIST
NONE	Victim SimSiam	90.41±0.02	95.08 ±0.13	75.47 ±0.04	91.22 ±0.11
AFFINE	SIMSIAM	90.24 ±0.11	95.05 ±0.1	74.96 ±0.18	91.42 ±0.15
PAD+SHUFFLE	SIMSIAM	90.4 ±0.05	95.34 ±0.06	75.47 ±0.01	91.38 ±0.15
AFFINE+PAD+SHUFFLE	SIMSIAM	90.18 ±0.06	95.03 ±0.05	74.86 ±0.1	91.35 ±0.1
BINARY	SIMSIAM	88.78 ±0.2	94.72 ±0.02	68.42 ±0.16	88.91 ±0.34
NONE	Victim DINO	94.51 ±0.08	97.98 ±0.04	70.66 ±0.16	89.98 ±0.03
AFFINE	DINO	94.25 ±0.11	98.05 ±0.04	69.77 ±0.11	89.68 ±0.01
PAD+SHUFFLE	DINO	94.72 ±0.02	98.07 ±0.03	70.44 ±0.1	89.91 ±0.08
AFFINE+PAD+SHUFFLE	DINO	94.26 ±0.06	98.02 ±0.01	69.49 ±0.2	89.70 ±0.1
BINARY	DINO	92.96 ±0.1	98.03 ±0.03	59.53 ±0.27	88.26 ±0.04