## 4 Experiments
### Discussion
This could mean exploring deeper or more complex neural network architectures that are capable of capturing a wide range of features across diverse image types. Models such as convolutional neural networks (CNNs) that are deeper and equipped with layers like residual connections might prove effective. These models can learn rich and hierarchical feature representations, making them more adept at handling the intricacies of such a complex dataset. Furthermore, the low performance on CIFAR-100 as observed might also be a result of overfitting to specific features that do not generalize well across the entire dataset. This issue can be mitigated by employing techniques such as data augmentation, regularization, and dropout to enhance the model's ability to generalize rather than memorize the training data. Another approach to improving performance, as suggested, is increasing the number of queries during training. This method, often associated with active learning, involves iteratively selecting the most informative samples from the dataset to train the model. By strategically increasing the number of queries, it is possible to refine the training process to focus on examples that are most beneficial for learning, thereby potentially improving model accuracy and robustness. In situations where obtaining the original dataset is challenging, the use of synthetically generated data becomes necessary. Among the synthetic data generation methods evaluated, the LinfPGD approach demonstrated superior performance compared to the other techniques. This method iteratively fine-tunes adversarial examples, carefully exploring the space around the original input within the constraints of the \(L_{\infty}\) norm. This methodical exploration allows it to identify perturbations that are both subtle and highly effective at deceiving the model, leading to more potent adversarial examples. Its systematic approach to exploring adversarial space, coupled with controlled perturbations and iterative optimization, allows LinfPGD to achieve superior performance in creating synthetic data that extract models. The Jacobian-based method follows LinfPGD in effectiveness. It leverages the model's Jacobian matrix to determine the directions in which the input features should be perturbed to maximize output changes, focusing on the areas where the model is most sensitive. This method effectively uses gradient information to create informative adversarial examples, which can significantly aid in model extraction by highlighting the model's decision boundaries. However, because it is generally a single-step approach, it might not capture as nuanced a view of the model's vulnerabilities as the iterative LinfPGD method, resulting in slightly less effective synthetic data for training. FGSM is a more straightforward and faster approach than both LinfPGD and the Jacobian-based method, as it involves just a single step of perturbation along the gradient of the loss. This makes FGSM computationally cheaper and quicker to apply, but it also tends to be less refined. FGSM's single-step nature means it might not find the optimal perturbation for the most informative adversarial examples, especially against well-regularized or complex models. It often leads to examples that are either too easy for the model to classify correctly or too aggressive, pushing the examples out of the data distribution and, thus less effective for training robust surrogate models. While data-free methods rely on randomly generated noise as input images to train the surrogate model, the results are poor because the input-output pairs consist of random noise images paired with the victim model's outputs, which lacks meaningful correspondence.