Abstract:The massive deployment of Machine Learning (ML) models has been accompanied by the emergence of several attacks that threaten their trustworthiness and raise ethical and societal concerns such as invasion of privacy, discrimination risks, and lack of accountability. Model hijacking is one of these attacks, where the adversary aims to hijack a victim model to execute a different task than its original one. Model hijacking can cause accountability and security risks since a hijacked model owner can be framed for having their model offering illegal or unethical services. Prior state-of-the-art works consider model hijacking as a training time attack, whereby an adversary requires access to the ML model training to execute their attack. In this paper, we consider a stronger threat model where the attacker has no access to the training phase of the victim model. Our intuition is that ML models, typically over-parameterized, might (unintentionally) learn more than the intended task for they are trained. We propose a simple approach for model hijacking at inference time named SnatchML to classify unknown input samples using distance measures in the latent space of the victim model to previously known samples associated with the hijacking task classes. SnatchML empirically shows that benign pre-trained models can execute tasks that are semantically related to the initial task. Surprisingly, this can be true even for hijacking tasks unrelated to the original task. We also explore different methods to mitigate this risk. We first propose a novel approach we call meta-unlearning, designed to help the model unlearn a potentially malicious task while training on the original task dataset. We also provide insights on over-parameterization as one possible inherent factor that makes model hijacking easier, and we accordingly propose a compression-based countermeasure against this attack.

I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences

Adversarial for Good – Defending Training Data Privacy with Adversarial Attack Wisdom

Stealing Machine Learning Models via Prediction APIs

Beyond Labeling Oracles: What does it mean to steal ML models?

ML-Stealer: Stealing Prediction Functionality of Machine Learning Models with Mere Black-Box Access

Model Extraction Attacks Revisited

Machine Learning–based Cyber Attacks Targeting on Controlled Information

Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks

Machine Learning Based Cyber Attacks Targeting on Controlled Information: A Survey

Model Extraction Attacks and Defenses on Cloud-Based Machine Learning Models

Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attacks

The security of machine learning in an adversarial setting: A survey

LSSMSD: Defending Against Black-Box DNN Model Stealing Based on Localized Stochastic Sensitivity

ES Attack: Model Stealing against Deep Neural Networks without Data Hurdles

Model-Reuse Attacks on Deep Learning Systems

Defending Against Model Stealing Via Verifying Embedded External Features

Model for Peanuts: Hijacking ML Models without Training Access is Possible

FMSA: a Meta-Learning Framework-Based Fast Model Stealing Attack Technique Against Intelligent Network Intrusion Detection Systems

ShrewdAttack: Low Cost High Accuracy Model Extraction.

Towards the Science of Security and Privacy in Machine Learning

How to Steer Your Adversary: Targeted and Efficient Model Stealing Defenses with Gradient Redirection