ES Attack: Model Stealing against Deep Neural Networks without Data Hurdles

Yuan, Xiaoyong; Ding, Leah; Zhang, Lan; Li, Xin; Wu, Dapeng

doi:10.48550/arxiv.2009.09560

Cited by 1 publication

(5 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…b) Knockoff (Knockoff Nets [32]) works with an auxiliary dataset that shares similar attributes as the original training data used to train the victim model. c) ESA (ES Attack [45]) requires no additional data but a 2) Failure of watermarking: Our experiments in Section V-B show the effectiveness and robustness of watermarking to finetuning and pruning attacks. Unfortunately, here we show that the embedded watermarks can be removed by model extraction attacks.…”

Section: Defending Against Model Extractionmentioning

confidence: 97%

“…The adversary may be aware of the architecture of the victim model but has no knowledge of the training data or model parameters. The goal of model extraction adversaries is to accurately steal the functionality of the victim model through the prediction API [21], [38], [33], [32], [45]. To achieve this, the adversary first obtains an annotated dataset by querying the victim model for a set of auxiliary samples, then trains a copy of the victim model on the annotated dataset.…”

Section: Dnn Copyright Threat Modelmentioning

confidence: 99%

“…ES Attack. We use the OPT-SYN algorithm [45] to heuristically synthesize the surrogate data. We set the stealing epoch to 50 for MNIST and 400 for CIFAR-10.…”

Section: F Model Extraction Attacksmentioning

confidence: 99%

“…We failed to extract the SpeechCommands Victim model since the validation accuracy could not exceed 20%. All other hyper-parameters are the same as in [45]. * Functionality-equivalent Extraction.…”

Section: F Model Extraction Attacksmentioning

confidence: 99%

“…Arguably, unauthorized finetuning or pruning is the most straightforward way of model stealing, if the model parameters are publicly accessible (for research purposes only) or the adversary is an insider. Even when only the API is exposed, the adversary can still exploit advanced model extraction techniques [38], [33], [32], [21], [45] to steal most functionalities of the hidden model. These attacks pose serious threats to the copyright of deep learning models, calling for effective protection methods.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models

Chen¹,

Wang²,

Peng³

et al. 2021

Preprint

View full text Add to dashboard Cite

Deep learning models, especially those large-scale and high-performance ones, can be very costly to train, demanding a considerable amount of data and computational resources. As a result, deep learning models have become one of the most valuable assets in modern artificial intelligence. Unauthorized duplication or reproduction of deep learning models can lead to copyright infringement and cause huge economic losses to model owners, calling for effective copyright protection techniques. Existing protection techniques are mostly based on watermarking, which embeds an owner-specified watermark into the model. While being able to provide exact ownership verification, these techniques are 1) invasive, i.e., they need to tamper with the training process, which may affect the model utility or introduce new security risks into the model; 2) prone to adaptive attacks that attempt to remove/replace the watermark or adversarially block the retrieval of the watermark; and 3) not robust to the emerging model extraction attacks. Latest fingerprinting work on deep learning models, though being non-invasive, also falls short when facing the diverse and ever-growing attack scenarios.In this paper, we propose a novel testing framework for deep learning copyright protection: DEEPJUDGE. DEEPJUDGE quantitatively tests the similarities between two deep learning models: a victim model and a suspect model. It leverages a diverse set of testing metrics and efficient test case generation algorithms to produce a chain of supporting evidence to help determine whether a suspect model is a copy of the victim model. Advantages of DEEPJUDGE include: 1) non-invasive, as it works directly on the model and does not tamper with the training process; 2) efficient, as it only needs a small set of seed test cases and a quick scan of the two models; 3) flexible, i.e., it can easily incorporate new testing metrics or test case generation methods to obtain more confident and robust judgement; and 4) fairly robust to model extraction attacks and adaptive attacks. We verify the effectiveness of DEEPJUDGE under three typical copyright infringement scenarios, including model finetuning, pruning and extraction, via extensive experiments on both image classification and speech recognition datasets with a variety of model architectures.

show abstract

Section: Defending Against Model Extractionmentioning

confidence: 97%

Section: Dnn Copyright Threat Modelmentioning

confidence: 99%

“…ES Attack. We use the OPT-SYN algorithm [45] to heuristically synthesize the surrogate data. We set the stealing epoch to 50 for MNIST and 400 for CIFAR-10.…”

Section: F Model Extraction Attacksmentioning

confidence: 99%

Section: F Model Extraction Attacksmentioning

confidence: 99%