Domain Bridge: Generative Model-based Domain Forensic for Black-box Models

Dear Reviewer 6Wte,

Thank you very much for your thorough and insightful review.

In your feedback regarding weaknesses, you pointed out some bias-related issues concerning both the black-box target model and the stable diffusion generator employed in our investigation. We acknowledge and appreciate your observations.

Indeed, despite the use of state-of-the-art models as the target models of our investigation, it has come to our attention that they still exhibit inherent biases. For instance, the classifier's classification of birds based on both the presence of branches and the actual bird itself, or another classifier associating hair with gender, can be indicative of such biases.

Our primary objective is to identify the data domain of an unknown target model. However, it is worth noting that the training dataset itself may have possessed biases, such as an abundance of bird images depicting birds on branches. Consequently, our approach may provide a more accurate description of the underlying data distribution than the original class name, thereby aiding in the exposure of bias within the target model.

Furthermore, our approach also uncovered biases within the pre-trained diffusion model, although this was not our primary intention. For instance, when prompted to generate images of females, it tended to produce more images with long hair than short hair. While this may reflect real-life distributions, we remain uncertain whether this should be the case for a generative model. It stands to reason that a better diffusion model could enhance the effectiveness of our investigative process.

To address your two specific questions:

1. The initial 1,000 class names from the ImageNet dataset serve as starting points for search. We are considering the potential application of CLIP embeddings to cluster these class names, which could make the search algorithm more efficient.
2. In the typical scenarios of cloning, the process is often primarily limited by the number of samples available for querying the target, and acquiring these samples is often a challenging task. In our experiment, we utilized 5,000 samples. Scenario 4 introduces a new setting. In this scenario, the investigator initially employs our method to identify the data domain of the target model. Subsequently, a new model is trained from scratch, using the images generated by the generative model within the identified class domain. Given that the generative model itself was trained on a very large dataset, it is reasonable to expect that the newly trained model may demonstrate improved performance.

Once again, we appreciate your valuable feedback, which has provided us with valuable insights and guidance for further refinement of our work.

Best regards, Author(s)

Dear Reviewer 9fPL,

Thank you for your valuable feedback on our paper. We are grateful for the opportunity to address your concerns and clarify aspects of our work.

We agree with your observation regarding the heuristic search algorithm. Our approach defines a clear objective function to guide the investigation, laying the foundation for various search strategies to identify optimal candidates. The method we propose, while straightforward, is both practical and effective. Importantly, the incorporation of pre-trained models such as CLIP and Stable Diffusion into our methodology represents a novel application in the field of forensic analysis.

We acknowledge your point on using the corpus-based method as the primary comparison. However, note that the corpus-based method is the most closely related work for this new problem, making it the most relevant and appropriate for comparison at this stage. We agree that future work could benefit from a broader range of comparative studies to further validate and expand our findings.

We recognize the value of conducting a more comprehensive quantitative analysis and intend to include this in our future work. Despite this, the results we have obtained thus far have already demonstrated the good performance of our approach. These outcomes not only show the effectiveness of our method but also highlight its potential to enhance other forensic methodologies.

In summary, our paper introduces a novel and effective approach to a relatively new problem, marking a considerable advancement in understanding the data domain of black-box models. We hope our responses can address your concerns.

Thank you for your thorough review and constructive suggestions.

Best regards, Author(s)

Dear Reviewer PcJA,

Thank you for your thoughtful evaluation of our manuscript. We appreciate the feedback and take this opportunity to address the concerns raised.

The review highlights three primary areas of concern: the practical utility of our approach, the clarity and reproducibility of our algorithm, and the choice of classifiers for demonstrating the effectiveness of our method.

Regarding the practical utility and specificity of application scenarios, our paper presents a novel approach to investigate the domains of black-box models, which has significant implications in model transparency, bias detection, and validation. While we understand the reviewer's concerns about the immediate practical applications, we would like to emphasize that our empirical evaluations, particularly with CelebA and Places365 datasets, provide clear instances of how our method can be applied in real-world scenarios to provide important data domain info of undocumented models. As we highlighted in our manuscript, most forensic methods, such as model cloning and inversion, require information about the data domains. Our approach fulfills this requirement and bridges the gap.

In response to the concerns about the algorithm's description and reproducibility, we acknowledge that the initial manuscript may not have provided exhaustive details. However, to address this, we plan to release the code upon publication.

Regarding the choice or target classifier, we have conducted additional experiments on newer backbones, such as VIT-based classifiers. The performance on these modern architectures is consistent with our findings on older models like GoogLeNet. This shows that the architecture of the black-box model does not significantly impact the performance of our approach, as our setting is black-box and relies solely on hard labels.

We appreciate the opportunity to clarify these aspects of our work. We believe that our approach represents a significant contribution to the field of machine learning forensics. We hope that the additional information provided in this rebuttal addresses the concerns raised.

Best regards, Author(s)

Dear Reviewer dB4Y,

Thank you for your valuable feedback on our manuscript. We are grateful for the recognition of the strengths of our paper. In light of your concerns, we offer the following clarifications and responses.

We understand that the algorithm's description may have appeared unclear in our initial submission. To remedy this, we intend to include a more detailed and step-by-step description of the algorithm in our revised manuscript. We also plan to release the code upon publication.

The choice of datasets was driven by the need to demonstrate the effectiveness of our approach in identifying fine-grained classes. We can expand our evaluation to include larger and more diverse datasets.

Once again, we appreciate your valuable feedback, which has provided us with valuable insights and guidance for further refinement of our work.

Best regards, Author(s)

Dear Reviewer kDtS,

We appreciate your insights regarding the potential use of generative models. However, we would like to clarify that our work is not about fine-grained training or improving dataset understanding. Our primary objective is to infer the input data domain of an unknown model, especially in contexts where an investigator has access to an undocumented API endpoint or a single checkpoint file. This capability enables the investigator to determine the specific function of the model, such as discerning whether it is a face classifier or a medical image classifier.

Tables 1 and 2 in our paper demonstrate the efficacy of our method in accurately identifying the correct domain of a model. The ideal outcome, is when the identified domain exactly matches the original domain of the model.

Regarding model cloning in Section 6.3, our intention is not to replicate any dataset. Instead, model cloning in our context refers to creating a white-box version of a black-box model, aiming to match its performance as closely as possible.

The tree structure depicted in Figure 1 is illustrative of the iterative search process our method undergoes. This process, often goes through many iterations.

We acknowledge your suggestion regarding the alignment of the bullet points under Table 3. We will rearrange these points to enhance clarity and facilitate better understanding of the data presented in the table.

We hope this clarification sheds more light on the objectives of our work. If there are any further questions or aspects of our paper that you would like to discuss, please feel free to reach out. We are more than willing to provide additional explanations or engage in further discussions to ensure a thorough understanding of our research. Thank you again for your valuable feedback and insights.

Best regards, Author(s)