Stealix: Model Stealing via Prompt Evolution
Authors: Zhixiong Zhuang
Hui-Po Wang
Maria-Irina Nicolae
Mario Fritz
Venue: ICML 2025 poster (2025)
Keywords: model stealing
security
genetic algorithm
prompt optimization
Primary area: social_aspects->security
TL;DR: Stealix is the first model stealing attack leveraging diffusion models against image classification models without relying on human-crafted prompts.

Abstract: Model stealing poses a significant security risk in machine learning by enabling attackers to replicate a black-box model without access to its training data, thus jeopardizing intellectual property and exposing sensitive information.
Recent methods that use pre-trained diffusion models for data synthesis improve efficiency and performance but rely heavily on manually crafted prompts, limiting automation and scalability, especially for attackers with little expertise.
To assess the risks posed by open-source pre-trained models, we propose a more realistic threat model that eliminates the need for prompt design skills or knowledge of class names.
In this context, we introduce Stealix, the first approach to perform model stealing without predefined prompts. Stealix uses two open-source pre-trained models to infer the victim model’s data distribution, and iteratively refines prompts through a genetic algorithm, progressively improving the precision and diversity of synthetic images.
Our experimental results demonstrate that Stealix significantly outperforms other methods, even those with access to class names or fine-grained prompts, while operating under the same query budget. These findings highlight the scalability of our approach and suggest that the risks posed by pre-trained generative models in model stealing may be greater than previously recognized.

Stealix: Model Stealing via Prompt Evolution
Zhixiong Zhuang" 12
Hui-Po Wang
Maria-Irina Nicolae?
Mario Fritz
Abstract
100
Model stealing poses significant security risk in machine learning by enabling attackers to repli- cate black-box model without access to its training data, thus jeopardizing intellectual prop- erty and exposing sensitive information. Recent methods that use pre-trained diffusion models for data synthesis improve efficiency and per- formance but rely heavily manually crafted prompts, limiting automation and scalability, es- pecially for attackers with little expertise. To as- sess the risks posed by open-source pre-trained models, we propose a more realistic threat model that eliminates the need for prompt design skills knowledge of class names. In this context, we introduce Stealix, the first approach to per- form model stealing without predefined prompts. Stealix uses two open-source pre-trained mod- els to infer the victim model's data distribu- tion, and iteratively refines prompts through a ge- netic algorithm, progressively improving the pre- cision and diversity of synthetic images. Our experimental results demonstrate that Stealix significantly outperforms other methods, even those with access to class names or fine-grained prompts, while operating under the same query budget. These findings highlight the scalability of our approach and suggest that the risks posed by pre-trained generative models in model steal- ing may be greater than previously recognized] [
+26%
Accurscy
+0% +11%
0
WL
Kraskool Nets CIRAR
50 Memual
Sieelix (Durs)
Figure 1: Impact of query datasets on stealing satellite image classifier: performance drops occur with dissimi- lar datasets (Knockoff Nets + CIFAR-10) and challenging prompt design (SD + manual). Stealix mitigates these is- sues by leveraging victim-aware automatic prompt tuning.
to training data or model weights. By querying the vic- tim model with hold-out datasets, the attacker can con- struct a proxy model that behaves similarly to the origi- nal by mimicking its predictions. This attack vector com- promises the model owner's intellectual property and may expose sensitive information, posing both security and pri- vacy risks (Beetham et al. 2022 Carlini et al. 2024).
Current model stealing methods for image classification can be categorized based on the source of the queried im- ages: (1) using publicly available images like Knockoff Nets (Orekondy al.. 2019). (2) generating images by training a Generative Adversarial Network (GAN) from scratch (Truong et al.) 2021: [Sanyal et al.] (022), or (3) synthesizing images by prompting pre tre-trained open- source generative models (Shao et al., 2023 Hondru & Ionescu (023). The latter uses models like stable diffu- sion (SD) (Rombach et al. 2022) to achieve superior effi- ciency by reducing the dependence on online data sources and by eliminating the high computational cost of training generators. However, previous approaches often rely on human-ccafter prompts or class names to generate im- ages. These methods fall short when the class names lack context or fail to represent the victim's data features accu- rately. Attackers may also struggle to describe the target data distribution due to limited knowledge or vague artic- ulation. Furthermore, reliance on human intervention hin- ders scalability and automation. These challenges are espe- cially pronounced in specialized fields, where high-value models are the most common. Therefore, research under the current assumptions may oversimplify the problem and underestimate the threat of model stcaling facilitated by pre-trained models, as shown Figure
1. Introduction
Model stealing allows attackers replicate the function- ality of machine learning models without direct access
'Saarland University, Saarbrücken, Germany "Bosch Cen- ter for Artificial Intelligence, Renningen, Germany 'CISPA Helmholtz Center for Information Security, Saarbrücken, Germany. Correspondence to: Zhixiong Zhuang <zhix- zhuang @ bosch.com>.
Proceedings of the 42nd International Conference on Machine Learning, Vancouver, Canada. PMLR 267,, 2025. Copyright 2025 by the author(s).
'The project page is http:://hhiiiinggghgiihhhbbiheee

---

Stealix: Model Stealing via Prompt Evolution
Victim
Stealix: Prompt Evolution
Attacker
Optirnize
API Query
CLIP Model
Prompt
WisionLLnguage Model
Trainable Prompt
Train Proxy
Satellite View
Victim Model
1
Attacker Model
Satellite View Forest
image Label
Forest
Syntheslze
Stable
API Response
Diffusion
Seed
Labeledd by Victim
Generative Model
Figure 2: Overview of Stealix. Stealix begins with a real image as seed and synthesizes images to aid model stealing by iteratively refining prompts based on the victim's responses. The synthesized images then used train a proxy model.
To address these limitations and accurately assess the risk, we propose more realistic threat model in which the attacker lacks prior knowledge or expertise in designing prompts for the victim's data. This setup reflects practi- cal attack scemarios, such as competitors or malicious ac- tors with limited data but access to black-box model APIs. Under these constraints, existing prompt-based approaches struggle to generate diverse, class-specific queries, limiting their ability to extract the victim model effectively.
analysis demonstrates high correlation between the proxy metric and the feature distance to the victim data. (iii) Stealix surpasses methods using class names or human- crafted prompts, improving attacker model accuracy by up to 22.2% under a low query budget. (iv) Our findings reveal critical risks model stealing with open-soure models, underscoring the need for stronger defenses.
2. Related Works
In this context, we introduce Stealix, the first model stealing attack that removes the need for human-crafted prompts. Our method employs a text-to-image generative model and vision-language model to iteratively gener- ate multiple refined prompts for each class, depicted in Figure 2 Unlike prior prompt optimization works (Wen it al. 2024 Gal et al., 2023 Trabucco et al., 2024), which do not consider the victim model's predictions in optimiz- ing prompts, our approach incorporates these predictions during the optimization to address inconsistencies in im- age classification and improve image diversity. We achieve this with contrastive learning and evolutionary algorithms. Specifically, the prompt describing the target class is opti- mized under contrastive loss using features extracted by the vision-language model from the prompt itself and from image triplets. To further improve the precision and diver- sity the prompts, we propose proxy metric as the fitness function evaluate and evolve the prompts. our approach requires only a single real image per class. We show that this is sufficient to achieve new otate-of- the-art performance without requiring manual prompt engi- neering; this assumption is realistic, as potential attackers, typically competitors, often have limited data available, but fail to synthesize more.
Knowledge distillation. Knowledge distillation (KD) is model compression technique that trains smaller student models to replicate the performance of larger teacher mod- els, thereby reducing resource demands (Ba & Caruana 2014 Hinton et al. 2015). Traditional KD relies the teacher's training data to align the student with the same distribution. When this data is unavailable due to practi- cal constraints, surrogate datasets (Lopes et al., 2017) or data-free KD with generators (Fang et al. 2019 Micaelli & Storkey 2019) are commonly used, which typically re- quire white-box access for back-propagation. In contrast, model stealing operates in black-box setting, where the attacker has limited knowledge of the victim model.
Model stealing. Model stealing seeks to replicate vic- tim model's attributes, such as parameters, hyperparam- eters (Wang & Gong 2018: Tramèr et al., 2016). and functionality (Oliynyk al. (023). Functionality steal- ing involves training a proxy model mimic the vic- tim's outputs, raising security concerns in image recog- nition (Truong et al.) 2021). natural language process- ing (Krishna et al. 2020), robotics (Zhuang et al. 2024). and multimodal radiology report generation (Shen et al. 2025). Our work focuses on functionality stealing in im- ages, where traditional methods achieve it by querying vic- tim models using public datasets (Orekondy et al.) 2019) or synthetic images (Truong et al. 2021 Sanyal et al. 2022 Beetham et al. 2022). As illustrated in Figure these ap- proaches are either constrained by query dataset similar- ity or require millions of queries with substantial compu-
practice,
Contributions. (i) We present a practical threat model that removes the need for prompt design expertise, reflect- ing scalability needs in real-world settings. (ii) We pro- pose Stealix, the first prompt-agnostic approach that iter- atively refines prompts using a proxy metric. Statistical
2

---

Stealix: Model Stealing via Prompt Evolution
tational costs. Recent approaches use pre-trained diffusion
(1, K} is the predicted class label.
models reduce the query costs (Shao et al.
2023 Hondru
& lonescu, 2023). For instance, Active Self-Paced Knowl- edge Distillation (ASPKD) (Hondru & Ionescu, 2 gen- erates images using diffusion models, queries a subset through the victim model, and pseudo-labels samples via nearest-neighbor matching. However, these methods still depend on class names or manual prompts, limiting their practicality in specialized domains. Our approach intro- duces automatic prompt refinement to minimize human in- tervention and thus enhance effectiveness and scalability.
Goal and knowledge of the attacker. The attacker's ob- jective is to train a surrogate model A(x; 0a), parameter- ized by 8a that replicates the behavior of the victim model V. The attacker has black-box access to V. allowing them to query the model with images and receive the predicted class labels. The attacker is constrained by query bud- get, representing the total number of queries available per class, denoted as B. The attacker lacks knowledge of (i) the architecture and parameters of V, (ii) the dataset Dv used to train V, and (ii)) prompt design expertise. We also limit the use of class names, as they may by chance serve as good prompts; using them would diverge from the assump- tion that the attacker lacks prompt design expertise. This constraint significantly limits the attacker from leveraging generative model for efficient model stealing.
Personalized image synthesis. Prompt optimization can capture the essence of specific images, enabling pre-trained text-to-image models to generate personalized outputs. Textual inversion (Gal et al. 2023) updates prompt embed- dings with text-to-image models, while PEZ (Wen et al.] 2024) optimizes discrete prompts with vision-language model. Notably, DA-Fusion (Trabucco et al., 2024) lever- ages textual inversion to synthesize visually similar images for data augmentation. While DA-Fusion is not designed for model stealing, we extend by replacing the origi- nal class label with the victim model's prediction. Un- like existing approaches, which lack awareness of the vic- tim model's outputs and generate suboptimal queries, our method explicitly incorporates victim feedback.
4. Approach: Stealix
This section details Stealix, formalizing the problem and providing an overview in Section followed by explana-
tions of its components in Sections 4.2 4.4
4.1. Method Overview
The attacker's goal is to optimize the parameters 0₂ of a surrogate model A to replicate the behavior of the vietim model V on the victim data distribution Pv. achieving comparable performance. This can be expressed by min- imizing the loss between the outputs of the victim and sur- rogate models over the victim's 's data distribution under the cross-entropy loss:
3. Threat Model
In this section, we formalize the threat model for model stealing. We start with notations and definitions, describe the victim's capabilities, and outline the attacker's goals and knowledge, emphasizing the constraints that make model stealing challenging.
arg min 0. a~PV
E.
[ECE (V(z),
Notations. Let D ((x., 31)} be the dataset used to train an image classification model, where x; "xxCC represents input images with height H. width W. and C' channels, and y; E sponding class labels, with K being the total number of classes. Each class is indexed by e E {1,2,..., K}. The pre-trained generative model G generates an image G(p,e) e) from given prompt p by denoising noise drawn from standard normal distribution ~ (O, 1). For brevity, we denote this process
Without access to the victim data distribution Py, previous methods (Shao et al. 2023 Hondru & lonescu 2023) turn to generate high-quality images using a pre-trained text-to- image model G with a prompt p. By designing prompts to synthesize images similar to the victim data, the attacker can effectively steal the model by minimizing loss these generated images:
K} denotes the corre-
G(p).
arg min E [EEE (V(x), A(x))) 0n k>G(p)
(2)
Victim model. The victim trains a classification model V with parameters 0, on a dataset Dv, where images are drawn from the victim data distribution x ~ Py. Once deployed, it operates as black-box accessible for queries. We assume the victim model provides only the t pre- dicted class as answer, thus already reducing the model stealing risks by limiting the attack surface (Sanyal et al.) 2022 For a given input image x, 8² = V(x; 0,) E
Recall that for specialized tasks and models, the attacker might be lacking the knowledge to design relevant prompts; to address this challenge, we propose Stealix. Through the use of genetic algorithms (Zames) 1981). Stealix itera- tively generates multiple prompts that capture the diversity of class-specific features recognized by the victim model.
3

---

Stealix: Model Stealing via Prompt Evolution
P
T(p)
Encoder
Text-to-image Model G
T(a
Image Encoder
I(x2))
Cana
Black-box Victim Model
Prompt
Consistency
I(mre) )
Frozen
Trainable
P+N
capture features from seed image x² and positive image x+ while filtering negatives from x= Prompt consistency (right) evaluates p with Equation (5) by prompting generative model G to synthesize images, which are classified by the victim model V to update positive and negative sets. In the example, the negative feature "pool" is removed for class "bottle".
Figure 3: Prompt refinement (left) optimizes the prompt p using encoders T and I via Equation
More precisely, each iteration of our attack consists of three steps. Prompt refinement uses population of image triplets S to optimize corresponding prompts. One ran- domly initialized prompt is optimized per image triplet to capture the target class features. The resulting prompts are evaluated using prompt consistency, fitness metric based on how consistently the victim model classifies synthesized images as the target class. Finally, prompt reproduction evolves the next population image triplets using a ge- netic algorithm. For each iteration f, the population S ((=2, att Øe ) consisting of N image triplets, built using the image sets X Xx+ and X such that x e X at E Xx. and x. E X. These sets are defined for each class c: the seed set X = {x² V(x;) = c} contains real images classified as e by the victim model; the positive set xx = ( (==)) = c} has synthetic images classi- fied as с the negative set X {œ, V (x=)) + c} includes synthetic images classified into other classes than X and X initially empty, and generated synthetic images are added to these sets over iterations.
minimizing misleading features that cause incorrect predic- tions, with triplet of images (ar at x. ) This triplet, along with a random prompt, is projected into a shared fea- ture space using an image encoder and text encoder T from a pre-trained vision-language model (Figure B left). The prompt is then optimized by minimizing the similarity loss between the prompt and image features, with guidance from the victim model's predictions:
min P
Σ
T()) V(=))
(3)
where the similarity loss LSIM defined as:
LSIM 1 (1=cs(((())
V =e (4)
cos((()))))) T(p)), if (c))
If the triplet of images contains only the seed image, the optimization objective degrades to PEZ (Wen et al. 2024]. We compare ours with PEZ in the ablative study (Appendix D). This refinement process ensures that the prompt captures salient attributes for accurate classification while eliminating features that may lead misclassifica- tion. See Algorithm 2 in Appendix A for more details.
The three steps of the method are repeated until the query budget B per class is exhausted (where = | + [x=1 (see Algorithm D. Across K classes, this produces K x B synthetic images, which are used along with the seed images train the attacker model. We limit the number of seed images the attacker needs to possess from each class to one ((222) 1). The method steps are detailed below.
4.3. Prompt Consistency
To evaluate whether the optimized prompt effectively cap- tures the features learned by the victim model, we propose proxy metric, prompt consistency (PC). Since direct cess to the victim data distribution is unavailable, this met- ric serves as an indicator of distribution similarity and is used for prompt reproduction. We assume that if prompt captures the latent features of the target class learned by the victim model, the synthetic images will be consistently
4.2. Prompt Refinement
Efficient model stealing requires synthesizing images that are similar to the victim data, which in turn needs prompts that capture the class-specific features learned by the vic- tim model. To achieve this, we optimize the prompt to emphasize attributes leading to correct classifications while
4

---

Stealix: Model Stealing via Prompt Evolution
classified the target class by the victim model, implying closer resemblance with the victim data. Based this assumption, PC measures how well prompt generates im- ages that match the target class (Figure B right). Given a prompt p. a batch of synthetic images { ~ G(p) is generated, where M is the number of images. Prompt consistency is computed as:
Algorithm 1 Stealix
1: Input:
seed image set {x²) Je synthetic images amount M for PC calculation, total query budget B per class, population size N. victim model V, generative model G. image encoder
I and text encoder T
2: Output: Attacker model
3: Initialize attacker model A
4: for each class c. do
5: X +- V. X +- 0. population index t <- 0, consumed
budget b 4- 0
M PC= = M
6:
Iniiiaal 8 (<=:))) as N.,, Ko are empty.
TV((a)) c),
(5)
7:
S <- [[== x. th Hi from X2, Xxx
8:
while h B do
1=1
9:
Initialize the fitness score set F +- for each triplet (æ æ, 2, ) in St do
10:
11:
if 6 2 B then
where [(;() cc) is 1 if the victim model classifies æ; class c, and 0 otherwise. In Section 5.2 we show there is strong correlation between PC and the T-2 distance between
12:
break end if
13:
14:
Optimize the prompt (Section
the feature vectors of real and generated images, validating
15:
P + PromptRcfinement(nn) (a D2 x. Yi T,T)
16:
// Synthesize images and get PC fitness (Section
PC as an effective proxy metric for monitoring data similar-
17:
{ G(pp)
ity and for prompt reproduction. The synthetic images are
18:
F + + U EE [(V(z)) =c}
also used to update the image sets Xtt and Xx, while the
19:
be b+ M
PC value is added the fitness set Ft. Since the prompt
20:
Update the positive and negative sets
is optimized with triplet of images, the fitness value can
21:
x + X U Uf V(z,) = c E f1, MH X + X. Ufz V(z.) + c. i E M}}
also be assigned to the corresponding triplet in St.
22:
23:
end for
24:
Generate the next population (Section 25: S <- PromppReproductionn Fr
4.4. Prompt Reproduction
26:
t +
To generate diverse prompts that capture broad range of class-specific features recognized by the victim model, we evolve the image triplet set St with X X and X as candidate set. The triplet with the highest fitness value (PC) in St is selected as the clite, carried forward to the next generation St+1 to guide the production of improved triplets. To generate new triplets. Np triplets are selected from St, where Np denotes the number of parents. This is done by repeatedly sampling k triplets and selecting the one with the highest fitness to form the parent set Sp, pro- cess known as tournament selection (Zames) 1981), ). where is the tournament size. Once the parent set is formed, two parent triplets are selected, and their images are randomly exchanged to create a new triplet. Each image in the new triplet is replaced with random sample from Xg &t,,, X with probability Pm. encouraging exploration of the candidate set. The newly generated triplet is added to S*+11 and this process is repeated until the population is fully up- dated. See Algorithm 3 in Appendix A for details on the prompt reproduction step.
27:
end while
28:
end for
29: Train model A with (x, Nt (x)) je= and their labels
30: return Attacker model
5.1. Experimental Setup
Dataset. We train the victim model on four datasets:
EuroSAT (Helber et al. 2019), PASCAL VOC (Evering-
ham et al. 2010 DomainNet (Peng et al., 2019), and CI- FARIO Alex 2009). Each dataset is chosen for its spe- cific challenges in evaluating model stealing attacks. Eu- AT requires specialized prompts for satellite-based land use classification, as class names alone fail to generate rel- evant images. In PASCAL VOC, images labeled by the largest object, testing the ability to identify the pri- mary target from the victim model's prediction. Domain- Net evaluates transfer learning across six diverse domains: clipart, infograph, paintings, quickdraw, real images, and sketches. A seed image is randomly chosen from one do- main to test cross-domain generalization, using 10 of 345 classes for manageability. In CIFARIO, class names can guide image synthesis, leading strong baselines when used by other methods, compared to ours, which does not. See Appendix (B for more details. We also introduce results on two medical datasets in Appendix L highlighting the challenges when the diffusion model has limited domain- specific knowledge.
5. Experiments
In this section, we introduce our experimental results, start- ing with the experimental setup in Section 5.1 followed by the results and analyses in Section 5.2 Finally, we ex- emplify real-world model stcaling on a model trained with proprietary data in Section 5.3
5

---

Stealix: Model Stealing via Prompt Evolution
Victim model. All models use ResNet-34 follow- ing Trunn al. (021), with PASCAL. an ImageNet- pretrained weights. Victim models are trained with SGD, Nesterov with momentum 0.9, a 0.01 learning rate, 5 x 10-1 weight decay, and cosine annealing for 50 epochs.
ate the best possible performance with data access. While data augmentation without querying the victim model is not model stealing, we include a comparison of attacker model accuracy between model stealing and data augmen- tation setups in Appendix K
Stealix. We use OpenCLIP-ViTIn as the vision-language model (Cherti et al. 2023) for prompt refinement, with a learning rate of 0.1 and 500 optimization steps using the AdamW optimizer. We employ Stable Diffusion-v2 (Rom- bach et al.] 2022) as the generative model, with guid- ance scale of 9 and 25 inference steps. PC evaluation uses M = 10 images. Stable Diffusion-v2 is used across all methods. In prompt reproduction, we set the population size to N = 10, with Np 5 parents selected via tour- nament selection with a tournament size of k 5, and retain one elite per generation. The mutation probability is set to Pm = 0.6. Following prior work (Trong et al.) 2021). we use R8 as the attacker model. To fo- cus on the impact of query data quality and ensure a fair comparison across methods, we train the attacker model using the same hyperparameters as the victim model with- out tuning: 50 epochs with SGD. More attacker and victim architectures are shown in Appendix G and Appendix H The experiments are run on a NVIDIA V V100 GPU and AMD EPYC 7543 22-Core CPU. The computation time is provided in Appendix C
Evaluation metries. We rely on two metries: (i) the accu- racy of the attacker model on the test set of the victim data, which is standard for stealing classifiers (Orekondy et al.] 2019), and (ii) the prompt consistency (PC) of the synthe- sized images. For Stealix, we report the best PC achieved across varying query budgets. For Real Guidance and DA- Fusion, where the prompt remains fixed, PC is measured by querying 500 images per class. For ASPKD that uses images synthesized by Real Guidance, PC identical to Real Guidance. PC not applicable for KD, Knockoff, and DFME, which do not involve text-to-image synthesis. All experiments are repeated three times, with mean values in the table and confidence intervals in the figure.
5.2. Experimental Results
Comparison with baselines. Table [ compares the accu- racy of the attacker model across methods for a query bud- get of 500 per class (2M per class for DFME). Stealix con- sistently outperforms all other methods. E.g., in CIFAR- 10, Stealix achieves 49.6% accuracy, a 22.2% improve- ment over the second-best method, Real Guidance. In con- trast, DFME has near-random accuracy on EuroSAT and PASCAL due to its reliance training a generator from scratch with small perturbations, which are quantized when interacting with real-world victim APIs (discussed in Ap- pendix M. In PASCAL, Stealix even surpasses KD, where the attacker has access to the victim data. This is because KD is constrained by the limited victim data size (around 73 images per class), whereas Stealix generates additional images and issues more queries. In Figure 4 we illus- trate both the stolen model accuracy and PC across varying query budgets. Stealix consistently achieves higher PC as the query budget increases, particularly in FuroSAT, where class names alone are insufficient for generating relevant images. Although Real Guidance initially attains higher PC in PASCAL and DomainNet, Stealix ultimately sur- passes it with larger query budgets. In CIFAR-10, Stealix reaches nearly 100% PC. In Appendix G and Appendix H our method consistently outperforms others with different attacker and victim architectures.
Baselines. We focus on a new, practical threat model that lacks both prompt expertise and detailed class information. Nevertheless, we compare our method with existing ap- proaches designed for other threat models. Specifically, we consider the following baselines. (i) DA-Fusion (Tra- bucco et al. 2024) is adapted to train a soft prompt from the seed image using textual inversion, then synthesize query images with strength and the same guidance scale as our method; (ii) Real Guidance (He et al., (023) uses the prompt "a photo of a (class name)" to synthesize im- ages given the seed image with strength 1 and same guid- ance scale; (ii) ASPKD (Hondru & Ionescul (023) fol- lows a three-stage process, first generating 5000 images per class using Real Guidance, then querying the victim model with a limited budget B, and finally pseudo-labeling the remaining images with a nearest neighbors approach with the attacker model; (iv) Knockoff' Nets (Orekondy et al.) 2019) evaluates performance with randomly collected im- ages by querying the CIFAR-10 victim model with Eu- roSAT images and other victim models with CIFAR- 10; (v) DFME (Truong et al., 202T) is data-free model steal- ing method based on GANs that trains a generator from scratch to adversarially generate samples to query the vie- tim model. We report the result of DFME using a query budget of 2 million per class. (vi) KD (Hinton al.) 2015) serves reference upper bound, where the attacker queries the victim model using its training data to evalu-
Limitations of human-crafted prompts. Even when at- tackers can craft prompts for the seed image based on the prior knowledge of class names, these prompts, though log- ically accurate from human perspective, may still fail to capture the nuanced features learned by the victim model. To evaluate this, we utilize InstructBLIP (Dai et al.) (223)). pre-trained languaee model, as a proxy for a hu-
6

---

Stealix: Model Stealing via Prompt Evolution
Table 1: Attacker model accuracy with query budget of 500 per class; DFME uses 2M.
Method
#Seed images
Class name
EuroSAT
PASCAL
CIFARIO
DomainNet
Victim
98.2% (1.00x)
82.7% (1.00x)
93.8% (1.00x)
83.9% (1.00x)
(KD)
95.6% (0.97x)
34.6% (0.42x)
76.7% (0.82x)
74.6% (0.89x)
Knockoff
0
X
40.1% (0,41x)
22.3% (0.27x)
24.4% (0.26x)
39.3% (0.47x)
DFME
O
X
11.1% (0.11x)
6.6% (0.08x)
23.7% (0.25x)
18.5% (0.22x)
ASPKD
O
V
39.2% (0,40x)
25.7% (0.31x)
27.1% (0.29x)
27.3% (0.32x)
Real Guidance
V
51.2% (0.52x)
24.0% (0.29x)
27.4% (0.29x)
31.9% (0.38x)
DA-Fusion
59.0% (0.60x)
16.4% (0.20x)
26.7% (0.28x)
28.4% (0.34x)
Stealix (ours)
X
65.9% (0.67x)
40.0% (0.48x)
49.6% (0.53x)
48.4% (0.58x)
EuruSAT
PASCAL
CIFARLO
DomainnNe:
(C(N8)
60-
60
60
40-
00
40
Butget Cless
Budget Class
Budiee
Budget Cless
CIRARCO
Domainnker
Accuracy 156)
Accursccy (16
NoC Macuracy DS!
Accurssy (S8)
20
8
8
300
2007
250)
300
Class
Budget
Class
Budget
Class
Steelic (ours)
Grockoff
DF ME
AS XD
Real Guidence
DM-nusion
(60)
---
Victim
Figure 4: PC and attacker model accuracy comparison across datasets with varying query budgets per class. DFME uses 2M per class. Besides the baselines, we provide KD and victim accuracy for reference.
man attacker. InstructBLIP is instructed with, is photo of a {class name). Give me a prompt synthesize sim- ilar images," alongside the seed image from the challeng- ing EuroSAT dataset. We synthesize 500 images per class based on these prompts and train the attacker model. The comparison of generated prompts between InstructBLIP and Stealix for all classes is provided in Appendix F along with examples of generated images. Stealix outperforms InstructBLIP, achieving an accuracy of 65.9% compared to 55.2%. Despite InstructBLIP incorporating relevant terms like "acrial view" and "satellite view," its average PC score is 41.0%, compared to Stealix's 's 73.7%.
sytracker collie relaxing celtiesped", which generates dog images and results in prompt consistency of 0. Stealix then uses the misclassified image negative example and re- fines the prompt to, "syrian helene pasquspock hands thum beuddling sheffield stuck smritihouseholds vulnerable ker- swednesday humormindy intestin". removing dog-related features and achieving PC Similarly, Stealix correctly identifies the dining table as the target in a crowded scene, while DA-Fusion incorrectly focuses on the human. These examples show how Stealix evolves prompts by filtering out misleading features using victim feedback.
Correlation between PC and feature distance. Since the attacker lacks access to the distribution of the victim data, PC is proposed as a proxy for monitoring and optimizing prompts, based on the hypothesis that more consistent pre- dictions from the victim model indicate closer match to its data. To evaluate this assumption, we collect 150 PC values per class corresponding to different prompts during prompt evolution. For each PC, we compute the L2 dis- tance between the mean feature vector of the synthetic im- ages and that of the victim data. Feature vectors are ex- tracted from the victim model before its final fully con- nected layer. The Spearman's 's rank correlation test shows strong, statistically significant negative correlation between
Qualitative comparison. Figure 5 presents qualitative comparisons on EuroSAT and PASCAL datasets. In Eu- roSAT, class names alone miss attributes like the satellite view, leading Real Guidance to generate generic images that differ from the victim data. Additionally, DA-Fusion struggles to interpret blurred seed images, generating ran- dom color blocks. For PASCAL, when multiple objects are present in the seed image. Stealix successfully identi- fies the target object. For instance, the seed image for the "PASCAL Person" class includes prominent dog, lead- ing to the first-generation prompt, "chilean vaw breton ce- cilia hands console redux woodpecker northwestern beagle
7

---

Stealix: Model Stealing via Prompt Evolution
Seed Image
Real Guidance
DA-Fusion
Stealix (ours)
Seed Image
Real Guildance
DA-Fusion
Stealix (ours)
EuroSAT
EUroSAT
Forest
Highway
PASCAL
PASCAL
Person
Dining Table
Figure Qualitative comparison of images generated by Real Guidance, DA-Fusion, and Stealix.
Table 2: Spearman's rank correlation between PC and L2
downloaded models for image classification. We use pub- licly available NSFW dataset from HuggingFace (Lewis) 2024 to run this attack. The dataset contains 200 images (100 "safe". 100 "not safe"). The victim reaches 92.0% accuracy on this data. The attack is initiated with one ran- dom image per class, the same hyperparameters from Sec- tion 5.1 and a ResNet-18 attacker. With query budget of 500 queries per class, Stealix achieves an accuracy of 73.0%, effectively replicating the victim model. In con- trast, the Real Guidance method fails to synthesize "not safe for work" images, resulting in an attacker model accu- racy of 50.0%, equivalent to random guessing. DA-Fusion demonstrates moderate performance, with 62.3% accuracy. This result demonstrates that our approach can leverage general priors in diffusion models to enhance model steal- ing, even in the absence of diffusion models trained on spe- cific datasets.
feature distance.
Data
Correlation p
p-value
AT
-0.63
7.04 x 10
PASCAL
-0.64
2.79 10 10"4
CIFARIO
-0.73
1.20 x 10
DomainNet -0.88
1.83 10-20
Table 3: Diversity (recall) across methods that using text- to-image generative models; higher scores indicate better diversity relative to the victim data distribution.
Method
EuroSAT
PASCAL
CIFAR10 DomainNet
Real Guidance
0.29
0.07
0.40
0.41
DA-Fusion
0.43
0.06
0.48
0.24
Stcalix (ours) 0.49
0.30
0.76
0.66
supporting the of PC guid- ing metric. We also evaluate whether higher PC leads to higher attacker model performance with different PC val- ues in Appendix
PC and Ta (Table 2),
6. Discussion
Our threat model assumes that the victim em- ploys defense that returns only hard label outputs, which is cheap and effective in limiting information leakage com- pared to soft labels (Sanyal et al. 2022). Appendix shoos that the attacker models' accuracy improves with soft-label access using images generated by Stealix. underscoring the need for this defense. Similarly, previous works (Lee al.,
Defense.
Diversity comparison. Figure shows that although PC values of Real Guidance are similar to ours for CIFAR1O. PASCAL and DomainNet, our attacker model performs consistently better. This advantage stems from the greater diversity in our synthetic data, achieved through prompt evolution, where distinct images are used to construct dif- ferent triplets. To quantify this, we use the diversity score proposed by Kynkääänniemi et al. (2019), Recall, which measures the likelihood that random image from the vic- tim data distribution falls within the support of the synthetic image The higher the score, the more diverse the im- ages. As shown in Table our method generates more diverse synthetic data with higher Recall score.
2019 Mazeika al. 2022 propose defenses that perturb the posterior prediction to reduce the utility of stolen mod- cls, while keeping the predicted class (argmax) unchanged to preserve original performance for benign users. These approaches implicitly push attackers to rely on hard labels, which are less informative but immune to such perturba- tions. However, since our prompt evolution uses only hard label feedback, this constraint impacts only the training of the attacker model, not the optimization of prompts, sug- gesting that stronger defenses may be required.
5.3. Stealing Model Based on Proprietary Data
Limitations and future work. Unlike GAN-based meth- ods, Stealix does not require backpropagation through the victim model train the generator, which enhances gen-
We now apply Stealix to large-scale Vision Transformer (ViT) (Dosovitskiy et al.) (021) trained on proprietary and non-public data, significantly differing from our previous victims. This model a 'Not Safe For Work' (NSFW) binary classification model, publicly available from Hug- gingFace (Team 2023), and ranked among the top-4 most
Warning: This datasct contains sexual content. Viewer dis- cretion is advised.
8

---

Stealix: Model Stealing via Prompt Evolution
eralization across victim architectures (Appendix H Al- though the attacker architecture still influence the per- formance (Appendix G). our method consistently outper- forms the baselines. Since image synthesis and surrogate training are decoupled, attackers can reuse synthetic im- ages for, e.g., hyperparameter tuning. This key advantage could be explored in future work to improve model accu- racy, Finally, as open-source generative models advance, integrating more powerful models into our framework of- fers significant potential for further enhancements.
featurex-2009-TR. pdf, 2009.
Ba, J. and Caruana, R. Do deep nets really need be deep? In Advances in Neural Information Processing Systems (NeurIPS), 2014.
Beetham, J., Kardan, N., Mian, A. S., and Shah, M. Dual student networks for data-free model stealing. In International Conference on Learning Representations 2022.
Carlini, N., Paleka, D., Dvijotham, K. D., Steinke, T., Hayase, J., Cooper, A. F., Lee, K., Jagielski, M., Nasr, M., Conmy, A., Wallace, E.,, Rolnick, D., and Tramèr, F. Stealing part of a production language model. In Interna- tional Conference on Machine Learning (ICML), 2024.
7. Conclusion
We showed that attackers can leverage open-source genera- tive models steal proprietary ones, even without prompt expertise or class information. Using Stealix for prompt evolution and aligning generated data with victim data sig- nificantly boosts model extraction efficiency. This is the first study to reveal the risks of publicly available pre- trained generative models in model theft for realistic attack scenarios. We urge the development of defenses against this emerging threat.
Cherti, M., Beaumont, R., Wightman, R.. Wortsman, M., Ilharco, G., Gordon, C., Schuhmann, C., Schmidt, L., and Jitsev, J. Reproducible scaling laws for contrastive language-image learning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2023.
Impact Statement
Dai, W., Li, J., Li, D., Tiong, A. M. H., Zhao, J., Wang, W., Li, B. A., Fung, P., and Hoi, S. C. H. Instructblip: languala models with instruction tuning. In Advances in Neural Information Processing Systems (NeurIPS), 2023.
This work aims to raise awareness of the risks associated with model stealing, particularly through the use of open- source pre-trained generative models. While our work demonstrates how such models can be exploited in adver- sarial settings, it is intended to inform the development of more robust defenses against model theft. We emphasize that approach is not designed to promote malicious be- havior but to highlight vulnerabilities that need address- ing within the AI community. We encourage practitioners, model developers, and stakeholders to implement stronger defenses, such as hard-label-only responses or adversarial detection mechanisms, to mitigate potential risks. All ex- periments were conducted with publicly available models and data, and with the intent of advancing the security of Al systems.
Towards general-purpose
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x 16 words: Transformers for image recognition at scale. In International Conference on Learning Representations (ICLR), 2021.
Everingham, M., Van Gool, L., Williams, C. K. I., Winn, J., and Zisserman, A. The pascal visual object classes (voc) challenge. International Journal of Computer Vi- sion (IJCV), 2010.
Fang, G., Song, J., Shen, C., Wang, X., Chen, D., and Song, M. Data-free adversarial distillation. arXiv preprint arXiv: 2019.
Acknowledgements
We acknowledge the support and funding by Bosch AIShield. This work was also partially funded by ELSA European Lighthouse Secure and Safe AI funded by the European Union under grant agreement No. 101070617, as well as the German Federal Ministry of Education and Research (BMBF) under the grant AlgenCY (16K182012).
Gal, R., Alaluf, Y., Atzmon, Y., Patashnik, O., Bermano, A. H., Chechik, G., and Cohen-Or, D. An image is worth one word: Personalizing text-to-image generation using textual inversion. In International Conference on Learn- ing Representations (ICLR), 2023.
References
He, R., Sun, S., Yu, X., Xue, C., Zhang, W., Torr, P., Bai, S., and Qi, X. Is synthetic data from generative models ready for image recognition? In International Confer- ence on Learning Representations (ICLR), 2023.
Alex, K. Learning multiple layers of features from tiny images. http:://ww. cs. toronto. edukrizflearning-

---

Stealix: Model Stealing via Prompt Evolution
Helber, P., Bischke, B., Dengel, A., and Borth, D. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. IEEE Journal of Se- lected Topics in Applied Earth Observations and Remote Sensing, 2019.
Peng, X., Bai, Q.. Xia, X., Huang. Z., Saenko, K., and Wang, B. Moment matching for multi-source domain adaptation. In International Conference Computer Vision (ICCV), 2019.
Rombach, R., Blattmann, A., Lorenz, D., Esser, P., and Ommer, B. nigh-resoluuton image synthesis with latent diffusion models. In Conference on Computer Vision and Pultern Recognition (CVPR), 2022.
Hinton, G., Vinyals. O., and Dean, J. Distilling the knowledge in neural network. arXiv preprint arXiv:/503.02533 2015.
Hondru, V. and lonescu, R. T. Towards few-call model stealing via active self-paced knowledge distillation and diffusion-based image generation. arXiv preprint arXiv:2310.0000 2023.
Sanyal, S., ini, Addepalli, S., and Babu, R. V. Towards data-free model stealing in hard label setting. In Con- ference on Computer Vision and Pattern Recognition (CVPR), 2022.
Krishna, K., Tomar, S., Parikh, A. P., Papernot, N., and Iyyer, M. Thieves on sesame street! model extraction of bert-based apis. In International Conference Learn- ing Representations (ICIR), 2020.
Shao, M., Meng, L.,, Qiao, Y., Zhang, L., and Zuo, W. Data- free black-box attack based on diffusion model. arXiv preprint arXiv:2307.12872 2023.
Shen, Y., Zhuang, Z., Yuan, K., Nicolae, M.-I,, Navab, N., Padoy, N., and Fritz, M. Medical multimodal model stealing attacks via adversarial domain alignment. In Proceedings of the AAAI Conference on Artificial Intel- ligence (AAAI), 2025.
Kynkäänniemi, T., Karras, T., Laine, S., Lehtinen, J., and Aila, T. Improved precision and recall metric for assess- ing generative models. In Advances in Neural Informa- lion Processing Systems (NeurIPS), 2019.
Lee, T., Edwards, B., Molloy, I., and Su, Defending against machine learning model stealing attacks using deceptive perturbations. In IEEE Security and Privacy Workshops (SPW), 2019.
Team, F. Not-safe-for-work image detection.
https: https://uuggingface co.Falconsai/////occcccoo..a.aaa nsfw dirige_detcction 2023.
Accessed:
2024-11-30.
Lewis, Z.
huggingface Not-safe-for-work dataset.
https://
Trabucco, B., Doherty, K., Gurinas, M., and Salakhutdinov, Effective data augmentation with diffusion models. In International Conference on Learning Representations (ICLR), 2024.
nsfw www_ddetcttto
train?p=1 2024. Accessed: 2024-11-30.
Lopes, R. G., Fenu, S., and Starner, Data-free knowl- edge distillation for deep neural networks. In Advances in Neural Information Processing Systems (NeurIPS), 2017.
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., and Risten- part, T. Stealing machine learning models via prediction {APIs]. In USENIX Security, 2016.
Mazeika, M., Li, B., and Forsyth, D. How to steer your ad- versary: Targeted and efficient model stealing defenses with gradient redirection. In International Conference Machine Learning (ICMI), 2022.
Truong, J.-B., Maini, P., Walls, R. J., and Papernot, N. Data-free model extraction. In Conference on Computer Vision and Pattern Recognition (CVPR), 2021.
Veeling, B. S., Linmans, J., Winkens, J., Cohen, T., and Welling, M. Rotation equivariant enns for digital pathol- ogy. In Medical Image Computing and Computer As- sisted Intervention (MICCAI), 2018.
Micaelli, P. and Storkey, A. J. Zero-shot knowledge trans- fer via adversarial belief matching. In Advances in Neu- ral Information Processing Systems (NeurIPS), 2019.
Oliynyk, D., Mayer, R., and Rauber, A. I know what you trained last summer: A survey on stealing machine learning models and defences. ACM Computing Surveys, 2023.
Wang, B. and Gong, N. Stealing hyperparameters in machine learning. In IEEE Symposium on Security and Privacy (IEEE S&P), 2018.
Wen, Y., Jain, N., Kirchenbauer, J., Goldblum, M., Geip- ing, J., and Goldstein, T. Hard prompts made easy: Gradient-bann discrete optimization for prompt tuning and discovery. In Advances in Neural Information Pro- cessing Systems (NeurIPS), 2024.
Orekondy, T., Schiele, B., and Fritz, M. Knockoff nets: Stealing functionality of black-box models. In Con- ference on Computer Vision and Pattern Recognition (CVPR), 2019.
10

---

Stealix: Model Stealing via Prompt Evolution
Wibisono, A., Wainwright, M. J., Jordan, M., and Duchi, J. C. Finite sample convergence rates of zero-order stochastic optimization methods. In Advances in Neu- ral Information Processing Systems (NeurIPS), 2012.
Yang, J., Shi, R., Wei, D., Liu, Z., Zhao, L., Ke, B., Pfister, H., and Ni, B. Medmnist v2-a large-scale lightweight benchmark for 2d and 3d biomedical image classifica- tion. Scientific Data, 2023.
Zames, G. Genetic algorithms in search, optimization and machine learning. Inf Tech J, 3(1):301, 1981.
Zhuang, Z., Nicolae, M.-I., and Fritz, M. Stealthy im- itation: Reward-guided environment-free policy steal- ing. In International Conference on Machine Learning (ICML), 2024.

---

Stealix: Model Stealing via Prompt Evolution
A. Algorithms
We detail the algorithms for prompt refinement and prompt reproduction in Section 4.2 and Section 4.4
Prompt refinement. We implement the hard prompt optimization method proposed by PEZ (Wen et 2024 to optimize the prompt to capture target class features learnt by the vietim model (Algorithm 2 The soft prompt, p. consists of L embedding vectors and is initialized from the vocabulary embedding set E. The soft prompt is iteratively mapped to its nearest neighbor embeddings using a projection function, ProjE((), and converted into hard prompt, p. via a function ()) During each iteration, the soft prompt is updated through gradient descent, guided by the similarity loss LSMM. which aims to retain features in the positive image while reducing features in the negative image. This process is repeated for optimization steps, after which the final hard prompt obtained. We follow the hyperparameters from Wen al. (2024), setting I. 16 and y = 0.1, while reducing s from 5000 to 500 to save optimization time, e.g., on AT,OSAT, from approximately 3 minutes 18 seconds. We further evaluate the impact of prompt lengths (4, 16. 32) on EuroSAT with query budget of 500 per class across three random seeds. The results show that Stealix achieves 62.5%, 65.9%, and 64.3% accuracy for prompt lengths 4, 16, and 32, respectively. This demonstrates that Stealix consistently outperforms others (second-best method: 59.0% from DA-Fusion in Table I.. with prompt length 16 striking the best balance between efficiency and accuracy.
Algorithm 2 Prompt Refinment
1: Input: image triplet (x2, x,), text encoder T and image encoder 1, optimization steps s, learning rate 7, soft
prompt length L
2: Output: hard prompt
3: Initialize soft prompt p from vocabulary E
4: for step = 1 to do
5: // Project soft prompt to nearest neighbor embeddings and convert to hard prompt.
6: p' (
7: p - (oft2Hard(p')
8:
// Compute gradient of the similarity loss and update soft prompt using gradient descent.
9:
g 4 VΦ Exe(ug,e) s., T)) (x))
10:
ń x f0 79
11: end for
12: // Final projection to ensure the soft prompt is fully converted to hard tokens.
13: p' + Projj (p)
14: + Soft2Hard(f))
15: return hard prompt p
Prompt reproduction. In Algorithm B we employ genetic algorithm to iteratively refine prompts through tournament selection, crossover and mutation. In tournament selection, we use prompt consistency as the fitness function.
B. Datasets
We provide an overview of the datasets introduced in our experiment setup (Section 5.1.p detailing the sizes of the training and validation sets and their respective image resolutions (see Table 4. For CIFAR- 10, we utilize the standard training and test splits provided by PyTorch, which consist of 50,000 training images and 10,000 test images at resolution of 32 32 pixels. In the case of PASCAL, we follow the preprocess from DA-Fusion (Trabucco et al.) (024) assign classification labels based on the largest object present in each image, resulting in 1,464 training images and 1,449 validation images with an image size of 256 x 256 pixels. The ET dataset is split into training and validation sets using 80/20 ratio while maintaining class distribution through stratified sampling, yielding 21,600 training images and 5,400 validation images at a resolution of 64 x 64 pixels. For DomainNet, we select the first 10 classes in alphabetical order across six diverse domains: clipart, infograph, paintings, quickdraw, real images, and sketches. We apply the same 80/20 stratified split as used for EuroSAT, resulting in 11,449 training images and 2,863 validation images, each resized to 64 x 64 pixels.
12

---

Stealix: Model Stealing via Prompt Evolution
Algorithm Prompt Reproduction
Input:
Current population St, fitness set Jr, seed image set X. positive image set X², negative image & tournament size k. number of parents Ny. number of populations N.
2: Output: Evolved population g++1
3: Select the clite triplet (2 2. 26 Jatee with the highest fitness from St given JF
4: Initialize next population S*+11 {(rr, xt, th Jone Keep the clite triplet the next population
Initialize the parents set S, <-
6: // Perform tournament selection to select Np parents.
7: for = to Np do
8: Randomly select & triplets from S*
Choose triplet (xg, at (x with maximum fitness from the triplets given Jet
10: Sp 4 Sp U { a 22))
11: end for
12: //
Generate the next generation.
13: for = N do
Apply crossover using selected parents.
15: Select two parents from Sp cyclically, demoted as (a2.1: 27,1) and
16:
Split each parent at a random point and form new triplet, e.g., (22,1 at, (2,2), ) as new triplet (a 27 22
17:
I/ Apply mutation.
18:
Replace each image in (1,, xt,=)) with random one from NE Nt, X. with probability pm
19:
S < S U (2 Ne (36
20:
end for
21:
S
Table 4: Overview of datasets.
Dataset
Train/Val
Image Size
EA
21.6K/5.4K
64 x 64
PASCAL
1464/1449
256 x 256
CIFAR1O
50K/10K
32 x 32
DomainNet
11449/2863
x
C. Comparison of Computation Time
We present a comparison of the time required for various methods using the EuroSAT dataset as an example. All ex- periments were conducted on a single machine with an NVIDIA V100 32GB GPU and an AMD EPYC 7543 32-Core Processor. Table 5 summarizes the total time for the process under 500-query budget per class (with DFME using 2M queries per class). Stealix demonstrates state-of-the-ard accuracy while maintaining reasonable computational efficiency.
Table 5: Comparison of computational time and accuracy across methods on the EuroSAT dataset. The victim model accuracy 98.2%.
Knockoff
DFME
ASPKD
Real Guidance
DA-Fusion
Stealix (ours)
Time (hours)
0.5
4.5
28.6
3.3
5.4
6.3
Accuracy
40.1% %
11.1%
39.2%
51.2%
59.0%
65.9%
13

---

Stealix: Model Stealing via Prompt Evolution
D. Ablative Analysis
We evaluate the contribution of prompt reproduction to Stealix by conducting an ablation study, where prompts are opti- mized using only CLIP from the seed image, without reproduction. This degrades our method to a version equivalent to PEZ (Wen et al. 2024), which relies solely on a single image and does not consider the victim model's predictions. More specifically, PEZ optimizes prompts using only the seed image 2% while our prompt refinement reformulates prompt op- timization as contrastive loss over a triplet (1 x²²), guided by the victim model's predictions. This enables Stealix to capture class-relevant features more effectively. Stealix further introduce prompt consistency as a proxy for evaluation, and prompt reproduction using genetic algorithms, forming a complete and victim-aware model stealing framework. As shown in Table 6 the setup labeled "Stealix w/o reproduction (PEZ)" shows a significant accuracy drop, highlighting the critical role of our victim-aware prompt optimization to evolve the prompts with prompt consistency. Note that PFZ not originally model stealing method, but a prompt tuning technique. We include it as part of an ablation study instead of baseline comparison to isolate the impact of our proposed components.
Table 6: Ablation study: comparison of attacker model accuracy without prompt reproduction.
Method
EuroSAT
PASCAL
CIFARIO
Demain
Victim
98.2% (1.00x)
82.7% (1.00x)
93.8% (1.00x)
83.9% (1.00x)
Stealix w/o reproduction (PEZ)
60.1 1% (0.61x)
26.7% (0.32x)
33.8% (0.36x)
39.2% (0.47x)
Stealix (ours)
65.9% (0.67x)
40.0% (0.48x)
49.6% (0.53x)
48.4% (0.58x)
E. Linking Prompt Consistency to Model Accuracy
To evaluate whether higher PC leads more effective model stealing. we compare attacker model performance using syn- thetic images generated from two prompts with different PC values. Specifically, we select prompts the 25th percentile (lower PC) and the 100th percentile (higher PC) during the prompt evolution process. We generate 500 synthetic images with each of the two prompts, query the victim model, and use only the positive images to train the attacker model. We ex- clude the Oth percentile prompt because it yields no positive samples. Since the higher PC prompt generates more positive images than the lower PC prompt, we reduce the number of positive images from the higher PC prompt to match that of the lower PC prompt. The results, presented in Figure 6 demonstrate that higher PC values consistently lead to improved attacker model accuracy across all datasets, confirming that higher PC enhances the effectiveness of model stealing attacks.
EuroSAT
PASCAL
CIFAR10
DomainNet
10
20
30
40
50
10
20
25
10
20
30
3
10
15
20
25
Accuracy (1)
Accuracy 1%)
Accurecy (1)
Accuraty (%)
Higher
Figure 6: Comparison of attacker model accuracy using synthetic images generated from prompts with higher and lower prompt consistency across four datasets.
14

---

Stealix: Model Stealing via Prompt Evolution
F. Simulating A Attacker with InstructBLIP
The prompts generated by InstructBLIP (Dai et al., 2023) for the Eu dataset are conditioned on seed images and the instruction: "It is photo of {class name). Give me prompt to synthesize similar images." In Figure 7 we show the prompts produced by InstructBLIP and by Stealix with high PC. As discussed in Section 5.2 and shown Table 7 prompts generated by InstructBLIP result in lower PC values and reduced attacker model performance due to misalignment with the latent features learned by the victim model, despite being human-readable. For example, in the "Residential" class of EuroSAT (Figure 8) InstructBLIP's prompt "an acrial view of residential area" results in a PC of only 8.8%, while Stealix reaches 71.0%.
As for Stealix, the optimized prompts are not always interpretable to humans, echoing our motivation that human-crafted prompts may be suboptimal for model performance. Moreover, Stealix supplements class-specific details that may be overlooked by humans. For example, shown in Figure [ (highlighte in red), gps crop emphasizes geospatial context for AnnualCrop, jungle suggests dense vegetation for Forest, and floodsaved, port, and bahamas convey water-related cues for River and Lake. These examples illustrate how Stealix uncovers latent features that the victim learns and highlight the limitations of human-centric prompt design and the importance of automated prompt evolution in model stealing.
Table 7: Comparison with InstructBI.IP on EuroSAT at query budget of 500 per class.
Method
#Seed images
Class name
PC
Accuracy
InstructBLIP
1
41.0%
55.2%
Stealix (ours)
1
X
73.7%
65.9%
InstructBLIP: an aerial view of a farm in the countryside
InstructBLIP: an aerial view of farm
Stealix: sdc ngc icular gps crop scaled farming pivot plane( seen piszurich t colton
lob nwt khanducf sakh lewisavonwoodley nestled taller surrounding expansive align seemingly overview aerial
Stealix:
InstructBLIP: an aerial view of a forest
InstructBLIP: an aerial view of farm
Stealix: colombian seva jungle spectral Wgb visible sp
Stealix: deepikapspatial opt scan satellite zoopt infield situ river sharjah jamazimbabwebw grid thumb
detected slicresolution
xxl sdk
InstructBLIP: satellite image of the earth taken from space
InstructBLIP: an aerial view of a residential area
Stealix: ..ousy nino E insigapproaching fmr chang korean perpetrhwan bornonthsdday soldiwounded mme villagers InstructBLIP: an aerial view of highway and farmland
Stealix: sris T chichester aaah arial population cityscape
rers townhouse cpu import grid reduced sideways avenue
InstructBLIP: aerial view of river
Stealix: kai rhine ichi ? iss jog agricultural survey ni grimsshowing intersection ": (*failed bridge
Stealix:
nxt nav nasa ifclearer ouk floodsaved immensalzburg port overlooking salzburg deplo_ thumbs
InstructBLIP: an aerial view of a large industrial area
InstructBLIP: aerial view of large body of water
Stealix: nasa idle sato jalan factory industrial minor sewer seen area transferred h0ro
Stealix: fiawec apunwreck bahamas visible sli() rh sd usaf calf infront nearby visible usaf
Figure 7: Seed images and corresponding prompts generated by InstructBLIP and Stealix for the EuroSAT dataset. Each pair shows the original seed image and the prompt used for image synthesis. Class names from top bottom, left right: AnnualCrop, Forest, Herbaceous HerbaceousSVegetation, Highway, Industrial, Pasture, PermanentCrop. Residential, River, SeaLake. Feature words related to each class are highlighted in red for Stealix.
InstructBLIP
Stealix (Ours)
Seed Image
EuroSAT Residential
Figure 8: Synthetic images for the Residential class with the prompt from InstructBLIP and ours.
15

---

Stealix: Model Stealing via Prompt Evolution
G. Different Attacker Model Architectures
We analyze the performance of different attacker model architectures, including ResNet18, ResNet34, VGGI6, and Mo- bileNet, as shown in Table [ Our method, Stealix, consistently outperforms all other baselines, regardless of the attacker model architecture. However, the choice of architecture does impact performance: smaller models like MobileNet result in lower accuracy due their limited capacity, seen in the KD baseline where MobileNet achieves only 89.2% accuracy compared to 95.6% with ResNet. This suggests that architectural limitations, rather than the attack method, drive the per- formance drop. Moreover, because Stealix decouples image synthesis from attacker model training, attackers can optimize hyperparameters and architectures without re-querying the victim model, offering flexibility and efficiency.
Table 8: Performance comparison of different attacker architectures against a ResNet34 victim model (98.2% accuracy) trained on EuroSAT, using a query budget of 500 queries per class.
Attacker architecture
Method
#Seed images
Class name
ResNet18
ResNet34
VGG16
MobileNet
KD
95.6% (0.97x)
95.6% (0.97x)
95.7% (0.97x)
89.2% (0.91x)
Knockoff
40.1% (0.41x)
40.3% (0.41x)
40.1% (0.41x)
29.3% (0.30x)
DFME ASPKD
X
11.1% (0.11x)
11.1% (0.11x)
11.1% (0.11x)
11.1% (0.11x)
39.2% (0.40x)
39.0% (0.40x)
35.4% (0.36x)
32.0% (0.33x)
Real Guidance
51.2% (0.52x)
52.0% (0.53x)
43.9% (0.45x)
40.6% (0.41x)
DA-Fusion
X
59.0% (0.60x)
53.3% (0.54x)
58.8% (0.60x)
48.6% (0.50x)
Stealix (ours)
X
65.9% (0.67x)
67.9% (0.69x)
66.0% (0.67x)
51.9% (0.53x)
H. Different Victim Model Architectures
We analyze the performance of Stealix across different victim model architectures on EuroSAT, including R8sNet18, ResNet34, VGGI6, and MobileNet, as shown in Table Using ResNet18 as the attacker architecture, Stealix consistently performs well across these architectures, demonstrating its robustness to variations in the victim model. The ability to generalize across diverse architectures highlights the adaptability and effectiveness of Stealix in real-world scenarios where the attacker may not know the exact architecture of the victim model.
Table 9: Performance comparison of Stealix against different victim architectures (ResNet18, ResNet34, VGG16, Mo- bileNet) with the attacker model architecture set to ResNet18 across all experiments on EuroSAT.
Victim architecture
Method
ResNet18
ResNet34
VGG16
MobileNet
Victim
98.4% (1.00x)
98.2% (1.00x)
98.2% (1.00x)
96.9% (1.00x)
Stealix (8
66.2% (0.67x)
65.9% (0.67x) 73.4% (0.75x)
66.0% (0.68x)
I. Limitations of DFME
We analyze the performance of DFME (Truong et al. 2021) under realistic attack scenarios. Following the original DFME setup, we attempted to extract our ResNet34 victim model trained on CIFAR- 10 using 2 million queries per class with soft- label access, achieving an attacker model accuracy of 87.4%, which is comparable to the results reported in the original work. However, DFME generates images with pixel values in the range (-1, due to the use of Tanh activation, which is incompatible with real-world APIs that expect standard image formats (e.g., pixel values in 255).. After quantizing these images to the standard format, the attacker model accuracy dropped 76.4%. despite using the same query budget. This performance degradation occurs because DFME relies adding small perturbations to the generated images estimate gradients via forward differences (Wibisono et al. 2012). Quantization can negate these subtle perturbations. Furthermore, when the victim model provides only hard-label outputs as a defense mechanism, the attacker model accuracy further decreased to 23.7%. In this case, the output labels remain constant under small input perturbations, rendering forward difference methods ineffective for gradient estimation and significantly limiting the attacker's ability to train the generator.
We present the results across all datasets Table 10 In the case of PASCAL, we reduced the batch size from 256 to 64
16

---

Stealix: Model Stealing via Prompt Evolution
due computational constraints imposed by the large image size (256 x 256 pixels). Notably, DFME fails to extract the PASCAL victim model, likely due to this higher image resolution. Furthermore, for the fine-grained EuroSAT dataset, even with soft-label access and without quantization, the attacker model achieves only 19.0% accuracy.
Table 10:
Performance of DFME on various datasets under different settings with query budget of 2M per class. Victim model accuracies provided for reference.
Method
EuroSAT
PASCAL
CIFARIO
DomainNet
Victim 98.2% (1.00x)
82.7% (1.00x)
93.8% (1.00x)
83.9% (1.00x)
DFME
19.0% (0. 19x)
6.6% (0.08x)
87.4% (0.93x)
83.0% (0.99x)
Quantization
10.2% (0. 10x)
6.6% (0.08x)
76.4% (0.81x)
72.0% (0.86x)
Hard label
11.1% (0.11x)
6.6% (0.08x)
23.7% (0.25x)
18.5% (0.22x)
J. Stealix with Soft Labels
In this experiment, we evaluate the impact of soft-label access the attacker model accuracy compared the hard-label- only scenario. Since Stealix's prompt evolution only relies hard labels for calculating prompt consistency, the same synthetic images are used to train the attacker model under both conditions, with the only difference being whether the labels are hard or soft (full probability predictions). As shown in Figure 99) Stealix consistently achieves higher accuracy with soft-label access across all datasets, as soft labels provide richer information through confidence scores, resulting in improved model performance. This underscores the importance of defenses like hard-label-only outputs to limit the effectiveness of model stealing attacks. However, hard-label defenses merely slow down the attack, increasing the required query budget without fully preventing model theft. Given the high quality and alignment of synthetic images with the victim's 's data, the attack remains viable over time. This highlights the need for more advanced defense strategies to better address this threat in future research.
CIAARLO
DomainKet
(52)
Accuracy
20
16
100
502
500
300
400
300 Dudgget per Class
Oudget per Class
Dudget per Class
Dusger per Class
Steollc (hand)
Stretic (xof))
--- Vidtim Accuracy
Figure 9: Performance comparison of Stealix with hard label and soft label access across EuroSAT, PASCAL, CIFAR-10, and DomainNet at varying query budgets.
K. DA-Fusion as Data Augmentation
Having one image per class is realistic setup and differs from having full access victim data its distribution. This reflects real-world threats posed by competitors in the same field, aiming to provide similar services. While attackers can use DA-Fusion to augment the seed images to train the attacker model without querying the victim model, we demonstrate that model stealing still provides a substantial performance improvement. We compare the accuracy of attacker models under a model stealing setup versus a data augmentation setup, with a query budget of 500 per class. Table [T] shows that performance degrades significantly with DA-Fusion when relying solely on class labels for training instead of using predictions from the victim model, highlighting that model stealing is essential, even with one image per class.
17

---

Stealix: Model Stealing via Prompt Evolution
Table 11: Comparison of attacker model training with and without victim queries, showing accuracy with 500-query budget per class; DFME uses 2M.
Method
Query victim
EuroSAT
PASCAL
CIFARIO
DomainNet
Victim
98. 98.2% (1.00x)
82.7% (1.00x)
93.8% (1.00s)
83.9% (1.00x)
Stealix (ours)
65.9% (0.67x)
40.0% (0.48x)
49.6% (0.53x)
48.4% (0.58x)
DA-Fusion
<
59.0% (0.60x)
16.4% (0.20x)
26.7% (0.28x)
28.4% (0.34x)
DA-Fusion
29.9% (0.30x)
10.7% (0.13x)
18.9% (0.20x)
17.9% (0.21x)
L. Limited Medical Knowledge
As generative priors like diffusion models are trained on publicly available data, the absence or limited presence of domain- specific knowledge, such as medical expertise, would have impact on the performance of model stealing relies on these models. However, this issue applies universally to all model stealing methods that rely on diffusion models, not specifically to ours. Our experiment results in Table show that diffusion models can be leveraged more effectively in model stealing when they describe the data well but are not properly prompted. In other words, our approach shares the same lower- bound as existing methods but significantly improves the upper-bound, achieving an approximate 7-22% improvement compared to the second-best method, as shown in Table
With that being said, we conducted an experiment analyzing performance when diffusion models have limited domain- specific knowledge, We consider two medical datasets: PatchCamelyon (PCAM) (Veeling et al. 2018) and RetinaM- NIST (Yang et al.] 2023). In PCAM, class names are "benign tissue" and "tumor tissue". RetinaMNIST involves a five-level grading system for diabetic retinopathy severity, with class names as "diabetic retinopathy i," where ranges from 0 to 4 for severity. We conduct experiments using three random seeds and report the mean attacker accuracy below, following the setup described in Section 5.1 The victim model uses the ResNet34 architecture, while the attacker model is based on ResNet18. The qualitative comparison in Figure[U shows that the diffusion model struggles to synthesize Retina- like images, highlighting its limited knowledge. However, the results in Table T2 show that methods with generative priors still outperform Knockoff Nets and DFME, confirming the value of priors, though the improvements decrease as the data deviates from the diffusion model's distribution, resulting only modest gains of Stealix in such cases.
In summary, our approach provides (1) significant improvement when diffusion models can describe the data and (2) comparable slightly better performance when they have limited domain knowledge.
Seed Image
Roal Guidance
D&-Fasion
Stealls (ours)
Sead Image
Real Guidance
DA-Fusion
Steoli (ours)
PCAM Benign Tissue
Retina Sevarity
Refna Severity
Tumor Tissue
Figure 10: Qualitative comparison of images generated by Real Guidance, DA-Fusion, and Stealix the PCAM and RetinaMNIST datasets. Other baselines include: Knockoff uses CIFAR1O query data, DFME synthesizes noise images, and ASPKD uses the same images as Real Guidance.
Table 12: Attacker model accuracy for medical dataset with a query budget of 500 per class; DFME uses 2M.
Method
#Seed images
Class name
PCAM
RetinaMNNIST
Victim
91.2% (1.00x)
61.7% (1.00x)
(KD)
76.3% (0.84x)
59.4% (0.96x)
Knockoff DFME ASPKD
X
50.0% (0.55x)
56.1% (0.91x)
50.0% (0.55x)
46.1% (0.75x)
60.1% (0.66x)
55.3% (0.90x)
Real Guidance
/
61.8% (0.68x)
56.1% (0.91x)
DA-Fusion
X
61.5% (0.68x)
56.7% (0.92x)
Stealix (ours)
X
62.2% (0.68x)
58.0% (0.94x)
18


Reviews:
[{"review_id": "vTmNueRWtW", "reviewer": "Reviewer_Lkbu", "summary": "The paper proposes a new method for model stealing attacks for computer vision classification models. Specifically, they find that prior work uses a pretrained text to image generator model to synthesize images similar to the victim data. However, this step requires an attacker to have knowledge to craft useful prompts, an assumption the paper claims is often not met for more specialized domains. \n\nHence, they introduce Stealix, which uses genetic algorithms to find the right prompt to synthesize useful images for model stealing. Specifically, they optimize a useful prompt under a contrastive loss using features extracted by a vision-language model from the prompt itself, further improving the prompt by using a genetic algorithm using a proxy metric as the fitness function.\n\nThey compare their method to different methods form the literature, all of which are based on stronger assumptions for the attacker. Across 4 datasets, they still find stealix to work better (better accuracy on test set of victim model). They also provide qualitative results, showing that synthetic images generated using stealix generate images more similar to the original, real data.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for recognizing our contribution in addressing a key limitation of prior work, and for their appreciation of our method's clarity, effectiveness, and thorough evaluation. We answer the questions below. The reviewer can try the provided prompts at [Stable Diffusion 2.1 demo](https://huggingface.co/spaces/stabilityai/stable-diffusion). Note that the demo may use a different generation setup from ours in the experiments.\n\n> Q1. Can authors provide some examples of optimized prompts? \n\nWe provide examples of optimized prompts in the following table and will include them in the revised paper. The table showcases prompts corresponding to the high Prompt Consistency (PC) values as described in Appendix E. One immediate observation is that the optimized prompts are not always interpretable to humans, echoing our motivation that human-crafted prompts may be suboptimal for model performance. Moreover, our approach often supplements class-specific details that may be overlooked by humans. For example, **gps crop** emphasizes geospatial context for AnnualCrop, **jungle** suggests dense vegetation for Forest, and **floodsaved**, **port**, and **bahamas** convey water-related cues for River and SeaLake. These examples illustrate how Stealix uncovers latent features that the victim learns.\n\n\n| Class| Prompt with high PC |\n| --------| -------- |\n| AnnualCrop     | sdc ngc icular **gps crop** scaled **farming** pivot plane ⃣@ seen piszurich t colton 2     |\n|Forest |colombian seva **jungle** spectral रrgb visible sp detected slicresolution ��ि xxl sdk |\n|  River  | nxt nav nasa ifclearer ouk **floodsaved** immensalzburg **port** overlooking salzburg deplo_ thumbs   |\n|SeaLake |fiawec apurwreck **bahamas** visible sli(!) rh sd usaf calf y infront nearby visible usaf |\n\n> Q2. Additionally, can you give some examples how the prompts change during the evoluation. This would shed more light into why stealix works so well compared to human-crafted prompts\n\nWe provide an example to illustrate prompt evolution. In Figure 5, the seed image for the \"Person\" class includes a prominent dog, leading to the first-generation prompt — \"chilean vaw breton cecilia hands console redux woodpecker northwestern **beagle** sytracker **collie** relaxing celticsped\" — which generates dog images and results in prompt consistency (PC) of 0. Stealix then uses the misclassified image as a negative example and refines the prompt to — \"syrian helene pasquspock hands thumbcuddling sheffield stuck smritihouseholds vulnerable kerswednesday humormindy intestin\" — removing dog-related features and achieving PC = 1. This example shows how Stealix evolves prompts by filtering out misleading features using victim feedback. We will revise the paper to include this example for better clarity.\n\n> Q3.  What is the author's intuition why the attack works so much better than the baselines for a simple dataset like Cifar-10? What do the prompts look like in this case?\n\nThank you for the question. As discussed in the **Diversity comparison** (Line 377, right column) and shown in Table 3, the better performance stems from the greater diversity in our synthetic data, enabled by prompt evolution. E.g., one optimized prompt for the cat class — \"punisher desktop **kittens siamese** beef **twins** personality bosnicorgi schnautuxedo 일tuxedo satellite consecutive **desktop**\" — includes fine-grained categories such as \"siamese\" and relational cues like \"twins\" to encourage multiple distinct instances. Additionally, terms like \"desktop\" provide varied contextual environments. In contrast, simple prompts like \"a photo of a cat\" tend to produce less diverse images. These diverse prompts are generated automatically by Stealix, without requiring a human in the loop.\n\n> Q4. Do you think the same attack method/philosophy would work for other kinds of models? (e.g. image segmentation, text classification).\n\nIt might be possible to generalize to other tasks. For image segmentation, recent work [1] shows that prompts can guide image generation toward specific segmentation layouts, suggesting that prompt refinement based on mask consistency could be a feasible direction. For text classification, the image generator could be replaced with a language model, with prompts optimized to generate inputs aligned with what the classifier has learned.\n\n[1] Yumeng Li, Margret Keuper, Dan Zhang, and Anna Khoreva. \"Adversarial supervision makes layout-to-image diffusion models thrive.\" ICLR 2024.\n\n> Q5. How would stealix perform on datasets with even more classes?\n\nStealix is expected to scale to more classes. We optimize prompts per class and treat all non-target classes as negatives, ensuring focus on class-specific features. Unlike baselines that generate images without considering predicted classes, Stealix actively steers synthesis toward the intended class.", "claims_and_evidence": "Yes. They claim their method removes an assumption made by previous work on model stealing, and convincingly show that their attack still works on a variety of setups, and even improves upon other attacks.", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "NA", "experimental_designs_or_analyses": "Yes, the experiments seem to make sense.", "relation_to_broader_scientific_literature": "The specifically focus on model stealing for image classification models. They identify that many methods rely on certain expertise/knowledge of the attacker to craft useful prompts to generate useful images to train the proxy model. They remove this assumption, providing a way to craft useful prompts, and find model stealing to work better than previous work - especially for more specialized datasets.", "essential_references_not_discussed": "NA", "other_strengths_and_weaknesses": "Strengths:\n- The paper identifies an assumption which prior methods make (an attacker being able to identify useful prompt to synthesize images to train the proxy model), argues that this assumption is not always met in practice and offers an effective method as a solution. \n- While complicated, the method is explained very carefully and formalized well. \n- The method outperforms previous methods although these are based on stronger attacker assumptions.\n- A substantial amount of ablations give confidence in the method and the quality of the work. \n\t \nWeaknesses: \n- Limited interpretability insights into why this method works so well (suggestions see questions).", "other_comments_or_suggestions": "NA", "questions_for_authors": "- Can authors provide some examples of optimized prompts? For instance, it would be nice to have the optimal prompt for each class label determiend by stealix such as in Table 7. Additionally, can you give some examples how the prompts change during the evoluation. This would shed more light into why stealix works so well compared to human-crafted prompts. \n- The main argument for the proposed method is when the task is highly specialized and requires specific prompts. What is the author's intuition why the attack works so much better than the baselines for a simple dataset like Cifar-10? What do the prompts look like in this case? \n- Do you think the same attack method/philosophy would work for other kinds of models? (e.g. image segmentation, text classification). \n- How would stealix perform on datasets with even more classes?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PfCPbxCdYz", "reviewer": "Reviewer_qvJM", "summary": "This paper introduces Stealix, a new model stealing method that leverages images synthesized from diffusion models to steal victim models. Compared with existing diffusion model-based model stealing attacks, the key improvement is that Stealix can automatically construct attack prompts for the stealing-image generation, thus eliminating the need for human-crafted prompts. Experiments demonstrate that Stealix enhances both query efficiency and stolen model performance in black-box query scenarios.\n\n## **update after rebuttal**\n\nAfter reading the rebuttal, I think this paper has novel results but the authors need to improve their presentation (**espectially Algorithm 1**) to make the paper more clear. So I decide to keep my current score but tend to acceptance.\n\nThe authors should update their paper according to me and other reviewers' reviews.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for appreciating our strict black-box threat model and recognizing the novelty of our automatic prompt construction approach for model stealing. We answer their questions below.\n\n> Q1. In Algorithm 1, are you performing Stealix with only a single class? Is that really effective? I would be interested in seeing the performance when stealing the model with samples from multiple classes.\n\nWe apologize for the mistake in Algorithm 1 and we will fix it in the revised paper. To clarify, Stealix considers all classes simultaneously. Algorithm 1 illustrates the process (Line 3-25) for a single class, but in practice, it is applied to all classes in parallel. After processing all classes, the generated images are collected and used to train the attacker model A, as outlined in the method overview (Lines 201–203, left column)\n\nWe will revise Algorithm 1 to wrap Lines 3–25 in a `for each class c` loop, and move Line 26 outside the loop with an updated description: \"Train model $A$ using **all class image sets** $\\lbrace\\mathcal{X}_c^s, \\mathcal{X}_c^+, \\mathcal{X}_c^-\\rbrace _{c=1}^K$\", where $K$ denotes the total number of classes. We will also update the algorithm input accordingly to reflect that it processes all classes, rather than requiring a specified target class $c$.\n\n\n> Q2. Wouldn't initial empty $\\mathcal{X}_c^+$ and $\\mathcal{X}_c^-$ result in empty initial $\\mathcal{S}^0$?\n\nWe will revise the algorithm to fix the notation. While $\\mathcal{X}_c^+$ and $\\mathcal{X}_c^-$ are initially empty, the seed set $\\mathcal{X}_c^s$ is not, so initial $\\mathcal{S}^0$ is populated using seed images: $\\mathcal{S}^0 = \\lbrace(x_c^s)_i^0\\rbrace _{i=1}^N$. \nFor generality, we denote $\\mathcal{S}^t = \\lbrace(x_c^s, x_c^+, x_c^-)_i^t\\rbrace _{i=1}^N$ and allow any of the elements in the triplet to be null. Our prompt optimization supports learning from as little as a single image (Equation 3), ensuring the process works in the early stages where positive and/or negative samples are unavailable.\n\n> Q3. The query budget comparison in Table 1 may not be fair. Unlike other methods listed, the proposed Stealix method requires further querying the victim model during the prompt-constructing stage, as it needs to repeatedly query the victim model with newly synthesized images (see Lines#19-20 in Algorithm 1). I suggest the authors provide the exact equation for calculating the overall query budgets and list all related hyperparameters in a single table for clarity.\n\nThanks for the suggestion. We clarify that Table 1 presents a fair comparison, because all synthesized images in Lines#19-20 of Algorithm 1 are included in training the attacker model, with each prompt synthesizing $M$ images (Line 15 in Algorithm 1). The full query budget corresponds exactly to the queries made during prompt construction, as noted in Line 200 (left column).\n\nTaking CIFAR-10 in Table 1 as an example, with a total budget per class of $B=500$, Stealix uses $M=10$ queries per prompt (Line 15 of Algorithm 1), resulting in 50 prompts per class. Across 10 classes, this leads to a total query budget of $10\\times 500=5000$ that are used to train the attacker model, which is the same budget used for other methods.\n\n> Q4. The experiments only consider a single victim model backbone (i.e., ResNet-34), which I think is insufficient to demonstrate the effectiveness of Stealix. I suggest including additional experiments on ResNet-like/CLIP-like victim backbones.\n\nWe clarify that our paper does include comparisons across multiple victim model architectures. Specifically, Appendix H provides results with different victim backbones, and Appendix G covers variations in attacker model architectures. For both setups, we study two ResNet variations, one VGG and one MobileNet. Additionally, in Section 5.3, we demonstrate Stealix's effectiveness against a Vision Transformer (ViT)-based victim model trained on proprietary data.\n\n\n> Q5. In Algorithm 1, Lines#9-11 are redundant and can be removed.\n\nRemoving Lines 9–11 would allow the consumed budget $b$ to exceed the total allowed budget $B$, since $b$ is updated within the inner loop (Line 17). Nevertheless, we appreciate the reviewer's suggestion and will revise the algorithm to test the budget constraint only once.", "claims_and_evidence": "There are many technical details in this paper that need to be further clarified. (See **Weaknesses & Suggestions & Questions**)", "methods_and_evaluation_criteria": "The query budget comparison in Table 1 might be not fair. (See **Weaknesses & Suggestions & Questions**)", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "See **Weaknesses & Suggestions & Questions**.", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "**Strengths:**\n\n1. The attack is conducted in a very strict black-box setting, which I appreciate.\n\n2. The idea of automatically constructing prompts for generating model stealing images is promising.\n\n\n**Weaknesses & Suggestions & Questions:**\n\n1. In Algorithm 1, are you performing Stealix with only a single class $c$? Is that really effective? I would be interested in seeing the performance when stealing the model with samples from multiple classes.\n\n2. In Algorithm 1, Line#5 constructs the initial sample set $\\mathcal{S}^0$ from $\\mathcal{X}^s_c$, $\\mathcal{X}^+_c$, and $\\mathcal{X}^-_c$. However, according to Line#3, both $\\mathcal{X}^+_c$ and $\\mathcal{X}^-_c$ are initialized as empty sets. Wouldn't this result in $\\mathcal{S}^0$ being an empty set, and thus the overall Algorithm 1 could not continue (Because the for-loop in Line#8 could never start)? Please clarify.\n\n3. The query budget comparison in Table 1 may not be fair. Unlike other methods listed, the proposed Stealix method requires further querying the victim model during the prompt-constructing stage, as it needs to repeatedly query the victim model with newly synthesized images (see Lines#19-20 in Algorithm 1). I suggest the authors provide the exact equation for calculating the overall query budgets and list all related hyperparameters in a single table for clarity.\n\n4. The experiments only consider a single victim model backbone (i.e., ResNet-34), which I think is insufficient to demonstrate the effectiveness of Stealix. I suggest including additional experiments on ResNet-like/CLIP-like victim backbones.\n\n5. In Algorithm 1, Lines#9-11 are redundant and can be removed.", "other_comments_or_suggestions": "Please note that while I give a score of 3 (Weak Accept), it actually means that I think this paper is a borderline paper. As such, my final score will be based on the response of authors. If my concerns could not be addressed, I will decrease the score accordingly.", "questions_for_authors": "See **Weaknesses & Suggestions & Questions**.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "huLa9oDyIQ", "reviewer": "Reviewer_bASY", "summary": "This paper proposes a model stealing attack method, named Stealix, to steal the functionality of an image classification victim model. Stealix generates synthetic images through a diffusion model, and fine-tunes the image-generation prompt based on victim model's responses. An iterative prompt refinement and reproduction process is employed to capture the features of training data distribution, so that the synthetic dataset is closer to the training distribution, leading to higher accuracy of the attacker's rebuilt model. Stealix enables an automatic choice prompt and does not require the knowledge class name, given that a few seed images are available. Comprehensive experiments are conducted, and Stealix consisstently outperformed baseline methods.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate the reviewer's recognition of this direction of soliciting queries as promising, and we're glad that the completeness and thoroughness of our experiments came through clearly. We aim to answer the questions below.\n\n> Q1. Why the comparison with PEZ method is deferred to appendix and is conducted under only one setting? It will be great if PEZ is also included in the comparison.\n\nWe placed the PEZ comparison in the appendix due to page limits. Since PEZ is not originally a model stealing method, but a prompt tuning technique, we include it as part of an ablation study—not a baseline comparison—to isolate the impact of our proposed components: prompt refinement with victim feedback, prompt consistency, and prompt reproduction. Please see our answers to Q2 for a detailed comparison.\n \n\n> Q2. Could you please clearly clarify the contribution and difference of PEZ and this work?\n\nThe key difference is that PEZ optimizes prompts using only the seed image $x_c^s$, while our prompt refinement reformulates prompt optimization as a contrastive loss over a triplet $(x_c^s, x_c^+, x_c^-)$, guided by the victim model’s predictions. This enables Stealix to capture class-relevant features more effectively. Stealix further introduce prompt consistency as a proxy for evaluation, and prompt reproduction using genetic algorithms, forming a complete and victim-aware model stealing framework.\n\n> W1. While the attacker aims to steal the entire model, Alg 1 requires a specific target class. Can you clarify which setting is used and correct any inconsistency?\n\nWe apologize for the inconsistency and we will correct it in the paper. The target class is not required as we steal the entire model. Stealix iterates over all classes to collect synthetic images. We will revise Algorithm 1 to wrap Lines 3–25 in a `for each class` loop, and move Line 26 outside the loop with an updated description: \"Train model $A$ using **all class image sets $\\lbrace\\mathcal{X}_c^s, \\mathcal{X}_c^+, \\mathcal{X}_c^-\\rbrace _{c=1}^K$**\", where $K$ denotes the total number of classes. We will also update the algorithm input accordingly to reflect that it processes all classes, rather than requiring a specified target class $c$.\n\n> W2. How large is the seed image set needed, and used in the experiments?\n\n\nWe use only a single seed image per class in all our experiments, as noted in Line 205 (left column).\n\n> W3. Line 129-131, it is somewhat incorrect to claim that other methods do not utlize victim model's outputs. My understanding is that PEZ also optimizes the prompt using victim's responses, isn't it?\n\nWe are sorry for the confusion: we do not claim that PEZ and other methods do not utlize victim model's outputs. More precisely, they use the victim's predictions only during **attacker model training**; in contrast, Stealix additionally uses them for **optimizing prompts** (refinement, consistency check and reproduction). PEZ, as detailed in our response to Q2, do not use victim responses to optimize the prompt, as the class of the seed image is known. We will update the paper to clarify this point.\n\n\n> W4. Does the proposed method apply to stealing regression models?\n\nStealix can potentially be extended to regression tasks. For example, during prompt refinement, low regression error, such as a low mean square error (MSE), could be interpreted as “positive” feedback and high error as “negative,” similar to our classification setting. This would allow the triplet-based optimization and prompt consistency metric to operate analogously.", "claims_and_evidence": "Yes. The paper is well-organized and well-written. The experiment results seem to be convincing.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "Not applicable.", "experimental_designs_or_analyses": "The authors conduct experiments on four representative datasets and compare their proposed method to six other methods, which looks great to me. Also, an experiment on stealing a model trained on private dataset is conducted, further enhancing the realiability of authors' findings. Nevertheless, why the comparison with PEZ method is deferred to appendix and is conducted under only one setting? It will be great if PEZ is also included in the comparison.", "relation_to_broader_scientific_literature": "N/A.", "essential_references_not_discussed": "The authors mention that the proposed method will be degraded to PEZ (Wen et al., 2024) if the image triplet contains the seed image only. It seems the work of PEZ is strongly related to this paper. Could you please clearly clarify the contribution and difference of PEZ and this work?", "other_strengths_and_weaknesses": "**Strengths**\n1. The proposed method, as author highlighted, avoids the need of pre-defined prompts or class name to generate synthetic images. This direction of soliciting queries is promising.\n2. This paper is highly complete with sufficient experiments.\n\n**Weakness**\nIt will be great if authors can clarify a couple questions:\n1. While the attacker aims to steal the entire model, Alg 1 requires a specific target class $c$. Can you clarify which setting is used and correct any inconsistency?\n2. How large is the seed image set needed, and used in the experiments?\n3. Line 129-131, it is somewhat incorrect to claim that other methods do not utlize victim model's outputs. My understanding is that PEZ also optimizes the prompt using victim's responses, isn't it?\n4. Does the proposed method apply to stealing regression models?", "other_comments_or_suggestions": "Typos:\nLine 218, Section 4 should be Figure 3, I guess.", "questions_for_authors": "Please find in the weakness section above.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "N/A"}}, {"review_id": "qGcLQIyQNp", "reviewer": "Reviewer_aEpx", "summary": "This paper introduces a method for model stealing attacks that do not require manually crafted prompts. Unlike prior approaches, which rely on predefined class names or expert knowledge to generate synthetic data, Stealix employs a genetic algorithm to iteratively refine prompts based on a victim model’s responses.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for recognizing the realism of our threat model, the scalibility of our approach, and the effectiveness of our proposed proxy metric. We aim to address their concerns below.\n\n> W1. While Stealix is tested on various victim model architectures (e.g., ResNet, VGG, MobileNet), the paper does not extensively explore more complex or state-of-the-art architectures (e.g., Transformers).\n\nWe do address this in Section 5.3: Stealing Model Based on Proprietary Data, where we apply Stealix to a real-world Vision Transformer (ViT) model trained on proprietary data and demonstrate better performance than other methods.\n\n> W2. This paper assumes that the victim model only provides hard-label outputs as a defense mechanism. However, the authors does not explore how Stealix would perform against more sophisticated defenses. \n\nThanks for the suggestion. Most defenses such as [1, 2] perturb the posterior prediction to reduce the utility of stolen models, while keeping the predicted class (argmax) unchanged to preserve original performance for benign users. This pushes attackers to rely on hard labels, which are less informative but immune to such perturbations. Our work directly targets this setting, where attackers proactively use hard labels to circumvent the defenses. We view exploring additional defenses as complementary and will add this discussion in the revision. We are open to evaluating Stealix against defenses that the reviewer has in mind.\n\n\n[1] Taesung Lee, Benjamin Edwards, Ian Molloy, and Dong Su. \"Defending against machine learning model stealing attacks using deceptive perturbations.\" IEEE Security and Privacy Workshops (SPW) 2019.\n\n[2] Mantas Mazeika, Bo Li, and David Forsyth. \"How to steer your adversary: Targeted and efficient model stealing defenses with gradient redirection.\" ICML 2022.\n\n> W3. The paper would benefit from a more detailed computational cost analysis.\n\nWe appreciate the reviewer's suggestion. We have reported the runtime comparison across methods in Appendix C: Comparison of Computation Time. The results show that Stealix maintains competitive computational efficiency while outperforming other baselines.", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "all good.", "experimental_designs_or_analyses": "see Other Strengths And Weaknesses part.", "relation_to_broader_scientific_literature": "This paper builds upon and extends prior research in model stealing, generative adversarial techniques, and automated prompt optimization.", "essential_references_not_discussed": "None.", "other_strengths_and_weaknesses": "Strengths:\nEliminates the need for manually crafted prompts or class names, making it more accessible and scalable for attackers with limited expertise.\nThis paper proposes a more realistic threat model.\nThe proposed proxy metric shows a strong correlation with the feature distance to the victim data.\n\nWeaknesses:\nAs authors mentioned, this approach relies heavily on the quality of open-source generative models.\nWhile Stealix is tested on various victim model architectures (e.g., ResNet, VGG, MobileNet), the paper does not extensively explore more complex or state-of-the-art architectures (e.g., Transformers). \nThis paper assumes that the victim model only provides hard-label outputs as a defense mechanism. However, the authors does not explore how Stealix would perform against more sophisticated defenses.\nThe paper would benefit from a more detailed computational cost analysis.", "other_comments_or_suggestions": "None.", "questions_for_authors": "see Other Strengths And Weaknesses part.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper considers a more realistic setting for model stealing attack, where there is no requirement for prompt design or knowledge of class names. The reviewers found this setting reasonable and realistic. The paper proposes a new method Stealix to perform model stealing under the new setting. Stealix refines the prompts based on genetic algorithm to synthesize images for model stealing. The experiments demonstrate the effectiveness of the proposed method.

Overall, the paper studies a more realistic setting for model stealing attacks, proposes a new algorithms, and conducts extensive experiments to verify the effectiveness. All reviewers agree to accept this paper. Thus I would like to recommend Accept.
Decision: Accept (poster)