Abstract:Recent studies show that machine learning models are vulnerable to model extraction attacks, where the adversary builds a substitute model that achieves almost the same performance of a black-box victim model simply via querying the victim model. To defend against such attacks, a series of methods have been proposed to disrupt the query results before returning them to potential attackers, greatly degrading the performance of existing model extraction attacks. In this paper, we make the first attempt to develop a defensepenetrating model extraction attack framework, named D- DAE, which aims to break disruption-based defenses. The linchpins of D- DAE are the design of two modules, i.e., disruption detection and disruption recovery, which can be integrated with generic model extraction attacks. More specifically, after obtaining query results from the victim model, the disruption detection module infers the defense mechanism adopted by the defender. We design a meta-learning-based disruption detection algorithm for learning the fundamental differences between the distributions of disrupted and undisrupted query results. The algorithm features a good generalization property even if we have no access to the original training dataset of the victim model. Given the detected defense mechanism, the disruption recovery module tries to restore a clean query result from the disrupted query result with well-designed generative models. Our extensive evaluations on MNIST, FashionMNIST, CIFAR-10, GTSRB, and ImageNette datasets demonstrate that D- DAE can enhance the substitute model accuracy of the existing model extraction attacks by as much as 82.24% in the face of 4 state-of-the-art defenses and combinations of multiple defenses. We also verify the effectiveness of D-DAE in penetrating unknown defenses in real-world APIs hosted by Microsoft Azure and Face++.

DivTheft: an Ensemble Model Stealing Attack by Divide-and-Conquer

D-DAE: Defense-Penetrating Model Extraction Attacks.

Army of Thieves: Enhancing Black-Box Model Extraction via Ensemble based sample selection

Model Stealing Attack Based on Sampling and Weighting

Model Stealing Attack against Recommender System

ML-Stealer: Stealing Prediction Functionality of Machine Learning Models with Mere Black-Box Access

Defending Against Model Stealing Via Verifying Embedded External Features

SwiftTheft: A Time-Efficient Model Extraction Attack Framework Against Cloud-Based Deep Neural Networks

Model Stealing for Any Low-Rank Language Model

Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attacks

Efficient Model Stealing Defense with Noise Transition Matrix

ES Attack: Model Stealing against Deep Neural Networks without Data Hurdles

Making models more secure: An efficient model stealing detection method

DeepTheft: Stealing DNN Model Architectures through Power Side Channel

Model scheduling and sample selection for ensemble adversarial example attacks

Model Stealing Attack against Multi-Exit Networks

Rethinking Model Ensemble in Transfer-based Adversarial Attacks

An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferability

Stealing the Invisible: Unveiling Pre-Trained CNN Models through Adversarial Examples and Timing Side-Channels

Stealing Deep Reinforcement Learning Models for Fun and Profit

Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferability