Increasing the Cost of Model Extraction with Calibrated Proof of Work

By Adam Dziedzic, Muhammad Ahmad Kaleem, Y. Lu, Nicolas Papernot. 2022

39 citations recorded by the source corpus.

In model extraction attacks, adversaries can steal a machine learning model exposed via a public API by repeatedly querying it and adjusting their own model based on obtained predictions. To prevent model stealing, existing defenses focus on detecting malicious queries, truncating, or distorting outputs, thus necessarily introducing a tradeoff between robustness and model utility for legitimate users. Instead, we propose to impede model extraction by requiring users to complete a proof-of-work before they can read the model's predictions. This deters attackers by greatly increasing (even up to 100x) the computational effort needed to leverage query access for model extraction. Since we calibrate the effort required to complete the proof-of-work to each query, this only introduces a slight overhead for regular users (up to 2x). To achieve this, our calibration applies tools from differential privacy to measure the information revealed by a query. Our method requires no modification of the victim model and can be applied by machine learning practitioners to guard their publicly exposed models against being easily stolen.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

In Privacy & Security

Citations in the corpus

On the Difficulty of Defending Self-Supervised Learning against Model Extraction (2022, methodology): “The calibrated proof-of-work defense proposes to make model extraction more difﬁcult by requiring users to solve a puzzle before they can read predictions from an ML model exposed via a public API (Dziedzic et al., 2022).”