Defending Against Model Stealing Attacks Using Deceptive Perturbations

By Taesung Lee, Ben Edwards, Ian M. Molloy, Dong Su. 2018

47 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Privacy Risks of Securing Machine Learning Models against Adversarial Examples (2019, background): “In response to these attacks, the privacy community has designed defenses to prevent privacy leakage of training data [1, 19, 36, 46] or the target model [26, 31].”
High-Fidelity Extraction of Neural Network Models (2019, background): “Perturbing (or rounding/adding noise to) class probabilities [11, 13, 46], re-leasing probabilities only for high probability classes [11], and releasing only class outputs [11, 13] have all been proposed as countermeasures.”
High Accuracy and High Fidelity Extraction of Neural Networks (2019, methodology): “Approaches to limiting information include perturbing the probabilities returned by the model [11,13,49], removing the probabilities for some of the model’s classes [11], or returning only the class output [11, 13].”
Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks (2019, methodology): “However, in line with previous works (Tramèr et al., 2016; Orekondy et al., 2019; Lee et al., 2018), we find models can be effectively stolen using just the top-1 predicted label returned by the black-box.”
DAWN: Dynamic Adversarial Watermarking of Neural Networks (2019, background): “Predictions can be restricted to classes [42] or adversarially modified to degrade the performance of the surrogate model [27].”
PRADA: Protecting Against DNN Model Stealing Attacks (2018, background): “Prediction probabilities can be quantized [55] or perturbed to deceive to the adversary [29].”