Black-Box Ripper: Copying black-box models using generative evolutionary algorithms

TL;DR

This paper introduces a novel method to replicate black-box neural models by generating data samples using evolutionary strategies and training a student model, achieving superior performance without access to training data or back-propagation.

Contribution

It presents a teacher-student framework that distills black-box models by generating high-response data samples through evolutionary algorithms, outperforming existing methods.

Findings

Our method surpasses state-of-the-art black-box model replication techniques.

It effectively generates data samples that elicit high responses from the black-box model.

The approach maintains high accuracy in the student model despite no access to training data or back-propagation.

Abstract

We study the task of replicating the functionality of black-box neural models, for which we only know the output class probabilities provided for a set of input images. We assume back-propagation through the black-box model is not possible and its training images are not available, e.g. the model could be exposed only through an API. In this context, we present a teacher-student framework that can distill the black-box (teacher) model into a student model with minimal accuracy loss. To generate useful data samples for training the student, our framework (i) learns to generate images on a proxy data set (with images and classes different from those used to train the black-box) and (ii) applies an evolutionary strategy to make sure that each generated data sample exhibits a high response for a specific class when given as input to the black box. Our framework is compared with several baseline and state-of-the-art methods on three benchmark data sets. The empirical evidence indicates that our model is superior to the considered baselines. Although our method does not back-propagate through the black-box network, it generally surpasses state-of-the-art methods that regard the teacher as a glass-box model. Our code is available at: https://github.com/antoniobarbalau/black-box-ripper.