Vision-Language Semantics Guided Model Extraction Attack Via Long-Horizon Contrastive Prompt Learning

Model extraction attacks enable adversaries to replicate the functionality of black-box models deployed as AI services in edge-cloud mobile and ubiquitous systems using only query access, posing serious security and intellectual property risks. In practice, model providers often disclose the list of supported classes and representative reference images to document capabilities and facilitate integration, inadvertently exposing exploitable vision-language semantic information. However, existing attacks exploit only single-modal cues and mainly rely on short-horizon query feedback to guide subsequent optimization, leaving the available information underutilized. We propose VLSMEA, a Vision-Language Semantics Guided Model Extraction Attack, which constructs prompts with a class name-anchored prefix and a learnable suffix, and optimizes them via long-horizon contrastive prompt learning in a shared vision-language space. A semantic scoring mechanism samples hard positives and negatives from long-horizon query histories to drive an alignment-repulsion objective, improving the efficiency and diversity of synthetic queries under a fixed budget. Experiments on five benchmarks with a 30K-query budget show that VLSMEA outperforms prior baselines in clone accuracy and significantly strengthens downstream adversarial transferability against victim models. These results demonstrate that, when combined with exposed semantic metadata in deployed AI services, the growing capabilities of vision-language models can substantially amplify the practical threat of model extraction against black-box deployed vision models, calling for strengthened defenses to improve privacy, integrity, and trustworthiness in secure AI deployment. Our source code is available here .