Model Extraction Warning in MLaaS Paradigm

By Manish Kesarwani, Bhaskar Pratim Mukhoty, Vijay Arya, Sameep Mehta. 2017

161 citations recorded by the source corpus.

Machine learning models deployed on the cloud are susceptible to several security threats including extraction attacks. Adversaries may abuse a model's prediction API to steal the model thus compromising model confidentiality, privacy of training data, and revenue from future query payments. This work introduces a model extraction monitor that quantifies the extraction status of models by continually observing the API query and response streams of users. We present two novel strategies that measure either the information gain or the coverage of the feature space spanned by user queries to estimate the learning rate of individual and colluding adversaries. Both approaches have low computational overhead and can easily be offered as services to model owners to warn them against state of the art extraction attacks. We demonstrate empirical performance results of these approaches for decision tree and neural network models using open source datasets and BigML MLaaS platform.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Privacy Risks of Securing Machine Learning Models against Adversarial Examples (2019, background): “In response to these attacks, the privacy community has designed defenses to prevent privacy leakage of training data [1, 19, 33, 41] or the target model [24, 28].”
PRADA: Protecting Against DNN Model Stealing Attacks (2018, background): “A second line of defense consists in detecting model extraction attacks by recording requests from clients and computing the feature space explored by the aggregated requests [23].”
High-Fidelity Extraction of Neural Network Models (2019, background): “Two possible approaches are to analyze query patterns [48, 49] or use an independent authentication channel.”
High Accuracy and High Fidelity Extraction of Neural Networks (2019, background): “The other camp, differentiating benign from malicious users, has focused on analyzing query patterns [51, 52].”
A Systematic Review on Model Watermarking for Neural Networks (2020, methodology): “Some research was conducted in order to issue security warnings, once an ML model is about to reveal enough information that an attacker or a group of attackers might be able to extract its functionality [Kesarwani et al., 2018].”
A framework for the extraction of Deep Neural Networks by leveraging public data (2019, background): “[48] design a model extraction monitor that logs the queries made by users of a MLaaS service.”
DAWN: Dynamic Adversarial Watermarking of Neural Networks (2019, methodology): “wever, some extraction attacks [21] circumvent such defenses because they remain effective using just prediction classes. Prior defenses to model extraction are designed to protect only simple models [22, 36] or to prevent only specific extraction attacks [27]. It is arguable if a generic defense wo”
Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks (2019, background): “Existing works (which is primarily in multiclass classiﬁcation settings) aim to either detect stealing attacks (Juuti et al., 2019; Kesarwani et al., 2018; Nelson et al., 2009; Zheng et al., 2019) or perturb the posterior prediction.”