Algorithm 1 Model extraction attack algorithm. Given a data set X, a substitute model $F_{\theta }$ with initial parameters $\theta$, and a target model G, return a substitute model $F_{{\theta }^{\prime }}$ with similar functionality to G. Notice that the update of Z and $\tilde{z}$ can also be placed in the inner loop; here, it is placed outside for the sake of brevity:
1:$X\leftarrow \mathbf{Instance}\mathbf{selection}\left(X\right)$
2:${\theta }^{\prime }\leftarrow \theta$
3:repeat
4:    $D\leftarrow \mathbf{Select}(X,step)$
5:    $step\leftarrow step+\Delta$
6:    $H_1,L\leftarrow F_{{\theta }^{\prime }}\left(D\right)$	▹ Query substitute model
7:    $Z\leftarrow {\mathbf{0}}_{\left[\left|H_1\right|\times C\right]}$	▹ Initialize the consistency regularization
8:    $\tilde{z}\leftarrow {\mathbf{0}}_{\left[\left|H_1\right|\times C\right]}$
9:    $H_2\leftarrow G\left(L\right)$	▹ Leave high confidence data
10:  for t in [1, epochs] do
11:        $z_i\leftarrow F_{{\theta }^{\prime }}\left(x_i\in H_1\cup H_2\right)$	▹ Train substitute model
12:        $loss\leftarrow -\frac{1}{\left|H_2\right|}{\sum }_{x_i\in H_2}log{z}_i\left[y_i\right]$	▹ supervised loss
13:        $+w\left(t\right)\frac{1}{C\left|H_1\right|}{\sum }_{x_i\in H_1}{∥z_i-{\tilde{z}}_i∥}^2$	▹ unsupervised loss
14:        update ${\theta }^{\prime }$ using, e.g., ADAM
15:    end for
16:    $Z\leftarrow \alpha Z+(1-\alpha )Z$	▹ accumulate ensemble predictions
17:    $\tilde{Z}\leftarrow Z/\left(1-{\alpha }^t\right)$	▹ bias correction
18:until  $F_{{\theta }^{\prime }}\approx G$
19:return  $F_{{\theta }^{\prime }}$