Extraction of Complex DNN Models: Real Threat or Boogeyman?
arXiv:1910.05429
Abstract
Recently, machine learning (ML) has introduced advanced solutions to many domains. Since ML models provide business advantage to model owners, protecting intellectual property of ML models has emerged as an important consideration. Confidentiality of ML models can be protected by exposing them to clients only via prediction APIs. However, model extraction attacks can steal the functionality of ML models using the information leaked to clients through the results returned via the API. In this work, we question whether model extraction is a serious threat to complex, real-life ML models. We evaluate the current state-of-the-art model extraction attack (Knockoff nets) against complex models. We reproduce and confirm the results in the original paper. But we also show that the performance of this attack can be limited by several factors, including ML model architecture and the granularity of API response. Furthermore, we introduce a defense based on distinguishing queries used for Knockoff nets from benign queries. Despite the limitations of the Knockoff nets, we show that a more realistic adversary can effectively steal complex ML models and evade known defenses.
arXiv comment16 pages, 1 figure, Accepted for publication in AAAI-20 Workshop on Engineering Dependable and Secure Machine Learning Systems (AAAI-EDSMLS 2020)
References in corpus (14)
- Adam: A Method for Stochastic Optimization
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- How transferable are features in deep neural networks?
- A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks
- A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
- Embedding Watermarks into Deep Neural Networks
- Enhancing The Reliability of Out-of-distribution Image Detection in Neural Networks
- The Open Images Dataset V4: Unified image classification, object detection, and visual relationship detection at scale
- Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Data
- Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring
- DAWN: Dynamic Adversarial Watermarking of Neural Networks
- High Accuracy and High Fidelity Extraction of Neural Networks
- Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
- Query-Efficient Black-Box Attack by Active Learning