Abstract:Recent studies show that machine learning models are vulnerable to model extraction attacks, where the adversary builds a substitute model that achieves almost the same performance of a black-box victim model simply via querying the victim model. To defend against such attacks, a series of methods have been proposed to disrupt the query results before returning them to potential attackers, greatly degrading the performance of existing model extraction attacks. In this paper, we make the first attempt to develop a defensepenetrating model extraction attack framework, named D- DAE, which aims to break disruption-based defenses. The linchpins of D- DAE are the design of two modules, i.e., disruption detection and disruption recovery, which can be integrated with generic model extraction attacks. More specifically, after obtaining query results from the victim model, the disruption detection module infers the defense mechanism adopted by the defender. We design a meta-learning-based disruption detection algorithm for learning the fundamental differences between the distributions of disrupted and undisrupted query results. The algorithm features a good generalization property even if we have no access to the original training dataset of the victim model. Given the detected defense mechanism, the disruption recovery module tries to restore a clean query result from the disrupted query result with well-designed generative models. Our extensive evaluations on MNIST, FashionMNIST, CIFAR-10, GTSRB, and ImageNette datasets demonstrate that D- DAE can enhance the substitute model accuracy of the existing model extraction attacks by as much as 82.24% in the face of 4 state-of-the-art defenses and combinations of multiple defenses. We also verify the effectiveness of D-DAE in penetrating unknown defenses in real-world APIs hosted by Microsoft Azure and Face++.

A Deep Learning Modeling Attack Method for MISR-APUF Protection Structures.

Deep Learning Modeling Attack Analysis for Multiple FPGA-based APUF Protection Structures

D-DAE: Defense-Penetrating Model Extraction Attacks.

MLMSA: Multi-Label Multi-Side-Channel-Information enabled Deep Learning Attacks on APUF Variants

FPGA Implementation of a Challenge Pre-Processing Structure Arbiter PUF Designed for Machine Learning Attack Resistance

The ANN Based Modeling Attack and Security Enhancement of the Double-layer PUF

Going Deep: Using deep learning techniques with simplified mathematical models against XOR BR and TBR PUFs (Attacks and Countermeasures)

Modeling Attack Tests and Security Enhancement of the Sub-threshold Voltage Divider Array PUF

Machine Learning-based Vulnerability Study of Interpose PUFs as Security Primitives for IoT Networks

Neural Network Modeling Attacks on Arbiter-PUF-Based Designs

A Deep Learning Method for the Security Vulnerability Study of Feed-Forward Physical Unclonable Functions

A Machine Learning Attack Resistant Dual-mode PUF

The Modeling Attack and Security Enhancement of the XbarPUF with Both Column Swapping and XORing.

Design And Modelling An Attack on Multiplexer Based Physical Unclonable Function

Attacking Delay-based PUFs with Minimal Adversary Model

A Lightweight Authentication Protocol Against Modeling Attacks Based on a Novel LFSR-APUF

Active learning for fast and slow modeling attacks on Arbiter PUFs

A robust deep learning attack immune MRAM-based physical unclonable function

Efficient Attacks on Strong PUFs via Covariance and Boolean Modeling

A Response-Feedback-Based Strong PUF with Improved Strict Avalanche Criterion and Reliability

Modeling Attack Resilient Reconfigurable Latent Obfuscation Technique for PUF based Lightweight Authentication