Abstract:Recent studies show that machine learning models are vulnerable to model extraction attacks, where the adversary builds a substitute model that achieves almost the same performance of a black-box victim model simply via querying the victim model. To defend against such attacks, a series of methods have been proposed to disrupt the query results before returning them to potential attackers, greatly degrading the performance of existing model extraction attacks. In this paper, we make the first attempt to develop a defensepenetrating model extraction attack framework, named D- DAE, which aims to break disruption-based defenses. The linchpins of D- DAE are the design of two modules, i.e., disruption detection and disruption recovery, which can be integrated with generic model extraction attacks. More specifically, after obtaining query results from the victim model, the disruption detection module infers the defense mechanism adopted by the defender. We design a meta-learning-based disruption detection algorithm for learning the fundamental differences between the distributions of disrupted and undisrupted query results. The algorithm features a good generalization property even if we have no access to the original training dataset of the victim model. Given the detected defense mechanism, the disruption recovery module tries to restore a clean query result from the disrupted query result with well-designed generative models. Our extensive evaluations on MNIST, FashionMNIST, CIFAR-10, GTSRB, and ImageNette datasets demonstrate that D- DAE can enhance the substitute model accuracy of the existing model extraction attacks by as much as 82.24% in the face of 4 state-of-the-art defenses and combinations of multiple defenses. We also verify the effectiveness of D-DAE in penetrating unknown defenses in real-world APIs hosted by Microsoft Azure and Face++.

Model Extraction Attack against Self-supervised Speech Models

D-DAE: Defense-Penetrating Model Extraction Attacks.

Extracting Robust Models with Uncertain Examples

MEAOD: Model Extraction Attack against Object Detectors

MeaeQ: Mount Model Extraction Attacks with Efficient Queries

Generative Extraction of Audio Classifiers for Speaker Identification

SCME: A Self-Contrastive Method for Data-free and Query-Limited Model Extraction Attack

Alignment-Aware Model Extraction Attacks on Large Language Models

Model Extraction Attacks Revisited

Target Speech Extraction with Pre-trained Self-supervised Learning Models

Precise Extraction of Deep Learning Models via Side-Channel Attacks on Edge/Endpoint Devices

Probing Self-supervised Learning Models with Target Speech Extraction

Query-Efficient Adversarial Attack with Low Perturbation Against End-to-End Speech Recognition Systems

Membership Inference Attacks Against Self-supervised Speech Models

Beyond Labeling Oracles: What does it mean to steal ML models?

MEA-Defender: A Robust Watermark against Model Extraction Attack

Model Leeching: An Extraction Attack Targeting LLMs

SAME: Sample Reconstruction against Model Extraction Attacks

Practical and Efficient Model Extraction of Sentiment Analysis APIs.

A Practical Black-Box Attack Against Autonomous Speech Recognition Model

Efficient Model Extraction via Boundary Sampling