What is Model Stealing？

Extract an approximation that of the target model that “closely matches” the original
Accuracy？
Fidelity？
Funtional equivalence？

Threat Models

API Access

Model extraction using：
Prediction Vectors
Labels Only

Model Access

Obfuscate the use of the model by：
Fine-tuning
Distillation

Data Access

Use the private dataset by：
Training a new model from scratch
Distilling the target mode（requires API access as well）

My Model was Stolen：So What?

Why

Machine learning models may require a very large amount of resource to create：
Research and Development
Creating Private Datasets
Compute Costs

Model	Cost
GPT2	$256/hour
XLNET	$245,000
GPT3	$4.6 Million

Having your model stolen can create new vulnerabilities for it：
Data privacy issues through model-inversion/membership inference（模型反演/成员推理）

Enables the use of white-box（白盒） adversarial example（对抗样本） creation

If a model extraction attack（模型提取攻击） is successful, the victim loses the information asymmetry advantage that is integral in defences for several other kinds of attacks.

Outline

First Paper: Black-box techniques for extracting a model using a query API（使用查询API提取模型的黑盒技术）
Second Paper: Detect model extraction by characterizing behaviour specific to the victim model（通过对受害者模型特有的行为特征进行检测模型提取）
Third Paper: Detecting model extraction by characterizing behaviour specific to the victim’s training set（通过对受害者训练集的特定行为进行特征化来检测模型的提取）

Stealing Machine Learning Models via Prediction APIs

Tramèr et al., 2016 paper link

Contributions

1. Show the effectiveness of simple equation solving extraction attacks.
2. Novel algorithm for extracting decision trees from non-boolean features.
3. Demonstrate that extraction attacks still work against models that output only class labels.
4. Application of these methods to real MLaaS interfaces.

Threat Model & Terminology

Focus on proper model extraction（模型提取）
Attacker has “black-box” access
This includes any info and statistics provided by the ML API

Equation Solving Attacks

方程求解攻击
What about more complicated models?
The paper shows that these attacks can extend to all model classes with a “logistic” layer




Is this attack feasible on DNN given the number of queries?
Are “random” inputs good enough to learn an accurate model for inputs with high dimensional feature space?

Case study: Amazon Web Services
Feature extraction takes extra reverse engineering which means more queries!<