D-ADD: An Effective Plug-In for Defending Against Model Stealing

Abstract

Malicious users attempt to replicate commercial models functionally at low cost by training a clone model with query responses. Timely prevention of such model-stealing attacks is challenging, as it requires achieving robust protection, maintaining utility, and ensuring low deployment overhead at the same time. In this paper, we propose a novel non-parametric detector called Account-aware Distribution Discrepancy (ADD) to recognize queries from malicious users by leveraging account-wise local query dependency. We formulate each class as a Multivariate Normal distribution (MVN) in the feature space and measure the malicious score as the sum of weighted class-wise distribution discrepancy. Together with shift adjustment, the ADD${}^{+}$ detector is enhanced with the capability to manage domain shifts. When integrated with random-based prediction poisoning, it serves as a practical plug-and-play defense module, termed D-ADD, for image classification models. Results of extensive experimental studies show that D-ADD achieves strong defense against different types of attacks with little interference in serving benign users for both soft and hard-label settings. Codes are available from https://github.com/AI-EXP-group/D-ADD.

11 pages, 7 figures, published in AAAI 2025