High-performance Deep Neural Networks (DNNs) are increasingly deployed in many real-world applications e.g., cloud prediction APIs. Recent advances in model functionality stealing attacks via black-box access (i.e., inputs in, predictions out) threaten the business model of such applications, which require a lot of time, money, and effort to develop. Existing defenses take a passive role against stealing attacks, such as by truncating predicted information. We find such passive defenses ineffective against DNN stealing attacks. In this paper, we propose the first defense which actively perturbs predictions targeted at poisoning the training objective of the attacker. We find our defense effective across a wide range of challenging datasets and DNN model stealing attacks, and additionally outperforms existing defenses. Our defense is the first that can withstand highly accurate model stealing attacks for tens of thousands of queries, amplifying the attacker's error rate up to a factor of 85× with minimal impact on the utility for benign users.
This paper proposed an effective defense against model stealing attacks. 
Merits:
1) In general, this paper is well written and easy to follow.
2) The approach is a significant supplement to existing defense against model stealing attacks. 
3) Extensive experiments. 
However, I still have concerns about the current version. 
I will possibly adjust my score based on the authors' response. 
1) In the model stealing setting, attacker and defender are seemingly knowledge limited. This should be clarified better in Sec. 3.  It is important to highlight that the defender has no access to F_A, thus problem (4) is a black-box optimization problem for defense. Also, it is better to have a table to summarize the notations. 
Additional questions on problem formulation:
a) Problem (4) only relies on the transfer set, where $x \sim P_A(x)$, right? 
b) For evaluation metrics, utility and non-replicability, do they have the same D^{test}? How to determine them, in particularly for F_A? 
c) One utility constraint is missing in problem (4). I noticed that it was mentioned in MAD-argmax, however, I suggest to add it to the formulation (4).
2)  The details of heuristic solver are unclear. Although the authors pointed out the pseudocode in the appendix, it lacks detailed analysis. 
3) In Estimating G, how to select the surrogate model? Moreover, in the experiment, the authors mentioned that defense performances are unaffected by choice of architectures, and hence use the victim architecture for the stolen model. If possible, could the author provide results on different architecture choices for the stolen model as well as the surrogate model?
############## Post-feedback ################
I am satisfied with the authors' response. Thus, I would like to keep my positive comments on this paper. Although the paper is between 6 and 8, I finally decide to increase my score to 8 due to its novelty in formulation and extensive experiments.