BESA: Boosting Encoder Stealing Attack with Perturbation Recovery

2025-06-05

AI Summary

Encoder stealing attacks suffer severe performance degradation under perturbation-based defenses. To address this, we propose BESA, an enhanced attack framework incorporating perturbation recovery. BESA introduces a novel dual-module co-design: a lightweight perturbation detector leveraging feature-space analysis and classification, and a conditional generative model for end-to-end perturbation removal. These modules are jointly optimized and modularly integrable into existing stealing methods. For the first time, BESA theoretically and empirically breaks multi-layer composite perturbation defenses—achieving up to a 24.63% improvement in surrogate encoder accuracy across multiple benchmarks, outperforming state-of-the-art attacks. Moreover, it exhibits strong robustness against both single-layer and composite perturbation defenses.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

To boost the encoder stealing attack under the perturbation-based defense that hinders the attack performance, we propose a boosting encoder stealing attack with perturbation recovery named BESA. It aims to overcome perturbation-based defenses. The core of BESA consists of two modules: perturbation detection and perturbation recovery, which can be combined with canonical encoder stealing attacks. The perturbation detection module utilizes the feature vectors obtained from the target encoder to infer the defense mechanism employed by the service provider. Once the defense mechanism is detected, the perturbation recovery module leverages the well-designed generative model to restore a clean feature vector from the perturbed one. Through extensive evaluations based on various datasets, we demonstrate that BESA significantly enhances the surrogate encoder accuracy of existing encoder stealing attacks by up to 24.63% when facing state-of-the-art defenses and combinations of multiple defenses.

Problem

• Overcoming perturbation-based defenses in encoder stealing attacks
• Detecting and recovering from defense mechanisms in feature vectors
• Enhancing surrogate encoder accuracy against state-of-the-art defenses

Innovation

• Perturbation detection module identifies defense mechanisms
• Generative model recovers clean feature vectors
• Combines with canonical encoder stealing attacks