Stealing Hyperparameters in Machine Learning

By Binghui Wang, Neil Zhenqiang Gong. 2018

513 citations recorded by the source corpus.

Hyperparameters are critical in machine learning, as different hyperparameters often result in models with significantly different performance. Hyperparameters may be deemed confidential because of their commercial value and the confidentiality of the proprietary algorithms that the learner uses to learn them. In this work, we propose attacks on stealing the hyperparameters that are learned by a learner. We call our attacks hyperparameter stealing attacks. Our attacks are applicable to a variety of popular machine learning algorithms such as ridge regression, logistic regression, support vector machine, and neural network. We evaluate the effectiveness of our attacks both theoretically and empirically. For instance, we evaluate our attacks on Amazon Machine Learning. Our results demonstrate that our attacks can accurately steal hyperparameters. We also study countermeasures. Our results highlight the need for new defenses against our hyperparameter stealing attacks for certain machine learning algorithms.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks (2018, background): “Later work extended model-stealing attacks to hyperparameter-stealing attacks [51].”
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, background): “Moreover, an attacker could also compromise the confidentiality/intellectual property of a model provider via stealing its model parameters and hyperparameters [34, 58, 60].”
Privacy in Deep Learning: A Survey (2020, background): “Inference Parameter Inference Property Inference Access to Model Access to Model Output Membership Inference [13] # # # # Blackbox Logits Measuring Membership Privacy[35] # # # # Blackbox Logits ML-Leaks[36] # # # # Blackbox Logits The Natural Auditor [37] # # # # Blackbox Label LOGAN [38] # # # # B”
Secure Evaluation of Quantized Neural Networks (2019, background): “It is nevertheless worth noting that an adversary with black-box access to a model, such as in the Machine Learning As A Service scenario, who can request predictions on arbitrary inputs can steal the model with nearperfect fidelity in some cases [62, 64].”
Privacy Risks of Securing Machine Learning Models against Adversarial Examples (2019, background): “Attacks targeting model privacy include: the adversary uncovering the model details with model extraction attacks [58], and inferring hyperparameters with hyperparameter stealing attacks [60].”
Exploiting Unintended Feature Leakage in Collaborative Learning (2018, background): “Training data that is explicitly incorporated or otherwise memorized in the model can also be leaked by model stealing attacks [41, 57, 61].”
Comprehensive Privacy Analysis of Deep Learning: Stand-alone and Federated Learning under Passive and Active White-box Inference Attacks (2018, background): “Input inference [20], attribute inference [21], parameter inference [22], [23], and side-channel attacks [24] are several examples of such attacks.”
Attacking Graph-based Classification via Manipulating the Graph Structure (2019, background): “…examples [7,12,27,30,37,40,43,46,51,53,56, 68], poisoning attacks [8,18,31,38,67,70], privacy attacks for users (e.g., model inversion attacks [19,20], membership inference attacks [49,52], property inference attacks [3,21]), as well as model parameter and hyperparameter stealing attacks [60,61].”
Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations (2018, background): “[46] propose a framework to steal the hyperparameters in the objective functions of different machine learning algorithms including neural networks.”
Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning (2018, background): “Input inference [31], attribute inference [32], parameter inference [33], [34], and side-channel attacks [35] are several examples of such attacks.”
Machine Learning with Membership Privacy using Adversarial Regularization (2018, background): “These inference attacks include input inference [19], membership inference [45], attribute inference [9], parameter inference [47, 48], and side-channel attacks [50].”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “using model stealing [87, 70, 101, 103, 69, 43]) and have, thus, become standard for evaluation.”
A survey of algorithmic recourse: definitions, formulations, solutions, and prospects (2020, background): “Model extraction concerns have been raised in various settings for machine learning APIs [112, 154, 170, 178].”
Attacks on Machine Learning: Lurking Danger for Accountability (2019, methodology): “Attack [4] Convolutional Neural Network Supervised No Side-channel Attack [74] Training Data Extraction [18] Adversarial Examples [50, 52, 70] Recurrent Neural Network Supervised No Training Data Extraction [18] Classifier Evasion [3] Adversarial Examples [57] Support Vector Machine Supervised Yes/N”
A Survey of Privacy Attacks in Machine Learning (2020, background): “Madelon [16] mixed features multi-class classification [97] 4,400”
MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples (2019, background): “Another line of works studied hyperparameter stealing attacks [44, 65], which aim to steal the hyperparameters such as the neural network architecture and the hyperparameter that balances between the loss function and the regularization term.”
BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements (2020, background): “Other works have explored the threats of models themselves like backdoor attack [10, 34, 41, 42] andmodel stealing attack [13, 24, 39, 40, 43].”