MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AI

Abstract

The advance of explainable artificial intelligence, which provides reasons for its predictions, is expected to accelerate the use of deep neural networks in the real world like Machine Learning as a Service (MLaaS) that returns predictions on queried data with the trained model. Deep neural networks deployed in MLaaS face the threat of model extraction attacks. A model extraction attack is an attack to violate intellectual property and privacy in which an adversary steals trained models in a cloud using only their predictions. In particular, a data-free model extraction attack has been proposed recently and is more critical. In this attack, an adversary uses a generative model instead of preparing input data. The feasibility of this attack, however, needs to be studied since it requires more queries than that with surrogate datasets. In this paper, we propose MEGEX, a data-free model extraction attack against a gradient-based explainable AI. In this method, an adversary uses the explanations to train the generative model and reduces the number of queries to steal the model. Our experiments show that our proposed method reconstructs high-accuracy models -- 0.97$\times$ and 0.98$\times$ the victim model accuracy on SVHN and CIFAR-10 datasets given 2M and 20M queries, respectively. This implies that there is a trade-off between the interpretability of models and the difficulty of stealing them.

arXiv comment10 pages, 5 figures

References in corpus (7)

• Distilling the Knowledge in a Neural Network
• Axiomatic Attribution for Deep Networks
• SmoothGrad: removing noise by adding noise
• Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
• DAWN: Dynamic Adversarial Watermarking of Neural Networks
• Boolean Decision Rules via Column Generation
• Model extraction from counterfactual explanations

Cited by in corpus (4)

• I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences
• AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Models
• PriMask: Cascadable and Collusion-Resilient Data Masking for Mobile Cloud Inference
• Marich: A Query-efficient Distributionally Equivalent Model Extraction Attack using Public Data