A framework for the extraction of Deep Neural Networks by leveraging public data

By Soham Pal, Yash Gupta, Aditya Shukla, Aditya Kanade, Shirish K. Shevade, Vinod Ganapathy. 2019

63 citations recorded by the source corpus.

Machine learning models trained on confidential datasets are increasingly being deployed for profit. Machine Learning as a Service (MLaaS) has made such models easily accessible to end-users. Prior work has developed model extraction attacks, in which an adversary extracts an approximation of MLaaS models by making black-box queries to it. However, none of these works is able to satisfy all the three essential criteria for practical model extraction: (1) the ability to work on deep learning models, (2) the non-requirement of domain knowledge and (3) the ability to work with a limited query budget. We design a model extraction framework that makes use of active learning and large public datasets to satisfy them. We demonstrate that it is possible to use this framework to steal deep classifiers trained on a variety of datasets from image and text domains. By querying a model via black-box access for its top prediction, our framework improves performance on an average over a uniform noise baseline by 4.70x for image tasks and 2.11x for text tasks respectively, while using only 30% (30,000 samples) of the public dataset at its disposal.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

The False Promise of Imitating Proprietary LLMs (2023, background): “Past work on model imitation Prior work has shown that model imitation is possible for various domains (Orekondy et al., 2019; Tram ` er et al., 2016; Lowd and Meek, 2005), including language classifiers (Krishna et al., 2020; Pal et al., 2019) and machine translation systems (Wallace et al., 2020).”
Imitation Attacks and Defenses for Black-box Machine Translation Systems (2020, background): “Despite these challenges, prior work shows that model stealing is possible for simple classi-ﬁcation (Lowd and Meek, 2005; Tram`er et al., 2016), vision (Orekondy et al., 2019), and language tasks (Krishna et al., 2020; Pal et al., 2019).”
Entangled Watermarks as a Defense against Model Extraction (2020, methodology): “One form of extraction involves using the substitute dataset to train a substitute model, which is a stolen copy of the victim model [31,32].”
Thieves on Sesame Street! Model Extraction of BERT-based APIs (2019, methodology): “…models contrasts with prior work, where large-scale attacks require at minimum that the adversary can access a small amount of semantically-coherent data relevant to the task (Papernot et al., 2017; Correia-Silva et al., 2018; Orekondy et al., 2019a; Pal et al., 2019; Jagielski et al., 2019).”
High-Fidelity Extraction of Neural Network Models (2019, methodology): “This includes nonadaptive techniques [11, 12, 16] as well as adaptive techniques using various forms of active learning [7, 11–13, 15, 50].”
High Accuracy and High Fidelity Extraction of Neural Networks (2019, background): “Task accuracy extraction has been considered for linear models [11] and neural networks [12, 16, 19], and fidelity extraction has also been considered for linear models [11] and neural networks [7, 15].”