A framework for the extraction of Deep Neural Networks by leveraging public data

Abstract

Machine learning models trained on confidential datasets are increasingly being deployed for profit. Machine Learning as a Service (MLaaS) has made such models easily accessible to end-users. Prior work has developed model extraction attacks, in which an adversary extracts an approximation of MLaaS models by making black-box queries to it. However, none of these works is able to satisfy all the three essential criteria for practical model extraction: (1) the ability to work on deep learning models, (2) the non-requirement of domain knowledge and (3) the ability to work with a limited query budget. We design a model extraction framework that makes use of active learning and large public datasets to satisfy them. We demonstrate that it is possible to use this framework to steal deep classifiers trained on a variety of datasets from image and text domains. By querying a model via black-box access for its top prediction, our framework improves performance on an average over a uniform noise baseline by 4.70x for image tasks and 2.11x for text tasks respectively, while using only 30% (30,000 samples) of the public dataset at its disposal.

References in corpus (13)

• Efficient Estimation of Word Representations in Vector Space
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasets
• Adversarial Active Learning for Deep Networks: a Margin Based Approach
• Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Data
• Interpretability via Model Extraction
• Stealing Neural Networks via Timing Side Channels
• Deep Learning Based Large-Scale Automatic Satellite Crosswalk Classification
• Security Analysis of Deep Neural Networks Operating in the Presence of Cache Side-Channel Attacks
• Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architectures
• Towards Reverse-Engineering Black-Box Neural Networks
• DeepObfuscation: Securing the Structure of Convolutional Neural Networks via Knowledge Distillation
• Fraternal Twins: Unifying Attacks on Machine Learning and Digital Watermarking

Cited by in corpus (13)

• Thieves on Sesame Street! Model Extraction of BERT-based APIs
• Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
• High Accuracy and High Fidelity Extraction of Neural Networks
• Entangled Watermarks as a Defense against Model Extraction
• Model extraction from counterfactual explanations
• Imitation Attacks and Defenses for Black-box Machine Translation Systems
• Model Extraction Attacks on Graph Neural Networks: Taxonomy and Realization
• Proof-of-Learning: Definitions and Practice
• Stealing Deep Reinforcement Learning Models for Fun and Profit
• Model Extraction Attacks against Recurrent Neural Networks
• Black-Box Attacks on Sequential Recommenders via Data-Free Model Extraction
• Fully Synthetic Data Improves Neural Machine Translation with Knowledge Distillation
• Towards Zero-Shot Knowledge Distillation for Natural Language Processing