The intellectual property of deep networks can be easily “stolen” by surrogate model attack. There has been significant progress in protecting the model IP in classification tasks. However, little ...