Data-Free Model Extraction

Truong, Jean-Baptiste; Maini, Pratyush; Walls, Robert J.; Papernot, Nicolas

doi:10.48550/arxiv.2011.14779

Cited by 3 publications

(14 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Considering the limited ability of attackers, data-free model extraction attacks have been proposed [18,7]. In this attack, attackers are assumed to have difficulty preparing surrogate datasets.…”

Section: Related Workmentioning

confidence: 99%

“…In the studies by Truong et al [18] and Kariyappa et al [7], the adversary uses zeroth-order gradient estimation with additional m queries to obtain ∇ x L(x):…”

Section: Approximation Of Gradientsmentioning

confidence: 99%

“…Loss Functions The existing method [18] shows the difference in the loss function used by the adversary causes the difference in the clone model accuracy. We introduce loss functions used in the existing methods.…”

Section: Approximation Of Gradientsmentioning

confidence: 99%

“…In MAZE [7], an adversary uses KL-divergence l KL (y, ŷ) = c i=1 y i log y i ŷi as a loss function. In data-free model extraction (DFME) [18], in addition to KL-divergence, an adversary uses the L1 norm with reconstructed logits l 1 (y, ŷ) = ||σ * (y) − σ * (ŷ)|| 1 as a loss function in order to prevent gradients from vanishing. We call this loss function the 1 norm loss.…”

Section: Approximation Of Gradientsmentioning

confidence: 99%

“…In such cases, input data is difficult for the adversary even to collect. For this reason, a data-free model extraction attack has been proposed [18,7], in which the adversary prepares a generative model to generate input data instead of collecting them (as shown in Fig. 2).…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AI

Miura,

Hasegawa,

Shibahara

2021

Preprint

View full text Add to dashboard Cite

The advance of explainable artificial intelligence, which provides reasons for its predictions, is expected to accelerate the use of deep neural networks in the real world like Machine Learning as a Service (MLaaS) that returns predictions on queried data with the trained model. Deep neural networks deployed in MLaaS face the threat of model extraction attacks. A model extraction attack is an attack to violate intellectual property and privacy in which an adversary steals trained models in a cloud using only their predictions. In particular, a data-free model extraction attack has been proposed recently and is more critical. In this attack, an adversary uses a generative model instead of preparing input data. The feasibility of this attack, however, needs to be studied since it requires more queries than that with surrogate datasets. In this paper, we propose MEGEX, a data-free model extraction attack against a gradient-based explainable AI. In this method, an adversary uses the explanations to train the generative model and reduces the number of queries to steal the model. Our experiments show that our proposed method reconstructs high-accuracy models -0.97× and 0.98× the victim model accuracy on SVHN and CIFAR-10 datasets given 2M and 20M queries, respectively. This implies that there is a trade-off between the interpretability of models and the difficulty of stealing them.1 https://cloud.google.com/explainable-ai Preprint. Under review.

show abstract

Section: Related Workmentioning

confidence: 99%

“…In the studies by Truong et al [18] and Kariyappa et al [7], the adversary uses zeroth-order gradient estimation with additional m queries to obtain ∇ x L(x):…”

Section: Approximation Of Gradientsmentioning

confidence: 99%

Section: Approximation Of Gradientsmentioning

confidence: 99%

Section: Approximation Of Gradientsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AI

Miura,

Hasegawa,

Shibahara

2021

Preprint

View full text Add to dashboard Cite

show abstract

Deep Generative Knowledge Distillation by Likelihood Finetuning

Chen

Zheng

et al. 2023

IEEE Access

View full text Add to dashboard Cite

Knowledge Distillation (KD) is designed to train smaller student models using a larger pretrained teacher model. However, in decentralized data systems such as blockchain, privacy concerns may arise, making the data inaccessible. To address this issue, Data-Free KD (DFKD) methods have been proposed, which extract prior knowledge from teacher networks and use it to synthesize data for KD. Previous DFKD methods faced challenges due to the large search space of data generation. Recently, deep generative models (DGMs) have been proposed to learn data distribution using deep networks, which provides an efficient way to reduce the search space by generating a set of pseudo data. In this paper, we explore the performance of KD trained using pseudo samples generated by pretrained DGMs and find that the correlation with image quality is not always positive. Based on this observation, we propose a new DFKD framework called Generative Knowledge Distillation (GenKD) that reduces the search space by constructing a prior distribution modeled by DGMs for their power of likelihood estimation. Specifically, we use energy-based models (EBM) to generate data from the Maximum Likelihood Estimation (MLE) of the EBM and gradients from downstream KD tasks by policy gradient. We then train the student model using the pretrained teacher model and pseudo samples. We also implement our GenKD framework on several widelyused benchmarks, including CIFAR100, CIFAR10, and SVHN. Our experiments demonstrate that we can generate high-quality pseudo samples quantitatively and qualitatively using GenKD. Additionally, the top-1 accuracy of the student network can approach state-of-the-art (SOTA) DFKD methods trained using fewer pseudo samples and less generation time.INDEX TERMS Knowledge distillation, deep generative model, image quality evaluation, data-free knowledge distillation.

show abstract

Generative Extraction of Audio Classifiers for Speaker Identification

Tejumade¹,

Bourtoule²,

Chandrasekaran³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

It is perhaps no longer surprising that machine learning models, especially deep neural networks, are particularly vulnerable to attacks. One such vulnerability that has been well studied is model extraction: a phenomenon in which the attacker attempts to steal a victim's model by training a surrogate model to mimic the decision boundaries of the victim model. Previous works have demonstrated the effectiveness of such an attack and its devastating consequences, but much of this work has been done primarily for image and text processing tasks. Our work is the first attempt to perform model extraction on audio classification models. We are motivated by an attacker whose goal is to mimic the behavior of the victim's model trained to identify a speaker. This is particularly problematic in security-sensitive domains such as biometric authentication. We find that prior model extraction techniques, where the attacker naively uses a proxy dataset to attack a potential victim's model, fail. We therefore propose the use of a generative model to create a sufficiently large and diverse pool of synthetic attack queries. We find that our approach is able to extract a victim's model trained on LibriSpeech using queries synthesized with a proxy dataset based off of VoxCeleb; we achieve a test accuracy of 84.41% with a budget of 3 million queries.

show abstract

Data-Free Model Extraction

Cited by 3 publications

References 23 publications

MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AI

MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AI

Deep Generative Knowledge Distillation by Likelihood Finetuning

Generative Extraction of Audio Classifiers for Speaker Identification

Contact Info

Product

Resources

About