Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Efficient Model Extraction via Boundary Sampling

Maor Biton Dor, Yisroel Mirsky

TL;DR

A novel data-free model extraction attack that significantly advances the current state-of-the-art in terms of efficiency, accuracy, and effectiveness and achieves all of this with a strict black-box assumption on the victim, with no knowledge of the target's architecture or dataset.

Abstract

This paper introduces a novel data-free model extraction attack that significantly advances the current state-of-the-art in terms of efficiency, accuracy, and effectiveness. Traditional black-box methods rely on using the victim's model as an oracle to label a vast number of samples within high-confidence areas. This approach not only requires an extensive number of queries but also results in a less accurate and less transferable model. In contrast, our method innovates by focusing on sampling low-confidence areas (along the decision boundaries) and employing an evolutionary algorithm to optimize the sampling process. These novel contributions allow for a dramatic reduction in the number of queries needed by the attacker by a factor of 10x to 600x while simultaneously improving the accuracy of the stolen model. Moreover, our approach improves boundary alignment, resulting in better transferability of adversarial examples from the stolen model to the victim's model (increasing the attack success rate from 60\% to 82\% on average). Finally, we accomplish all of this with a strict black-box assumption on the victim, with no knowledge of the target's architecture or dataset. We demonstrate our attack on three datasets with increasingly larger resolutions and compare our performance to four state-of-the-art model extraction attacks.

Efficient Model Extraction via Boundary Sampling

TL;DR

A novel data-free model extraction attack that significantly advances the current state-of-the-art in terms of efficiency, accuracy, and effectiveness and achieves all of this with a strict black-box assumption on the victim, with no knowledge of the target's architecture or dataset.

Abstract

This paper introduces a novel data-free model extraction attack that significantly advances the current state-of-the-art in terms of efficiency, accuracy, and effectiveness. Traditional black-box methods rely on using the victim's model as an oracle to label a vast number of samples within high-confidence areas. This approach not only requires an extensive number of queries but also results in a less accurate and less transferable model. In contrast, our method innovates by focusing on sampling low-confidence areas (along the decision boundaries) and employing an evolutionary algorithm to optimize the sampling process. These novel contributions allow for a dramatic reduction in the number of queries needed by the attacker by a factor of 10x to 600x while simultaneously improving the accuracy of the stolen model. Moreover, our approach improves boundary alignment, resulting in better transferability of adversarial examples from the stolen model to the victim's model (increasing the attack success rate from 60\% to 82\% on average). Finally, we accomplish all of this with a strict black-box assumption on the victim, with no knowledge of the target's architecture or dataset. We demonstrate our attack on three datasets with increasingly larger resolutions and compare our performance to four state-of-the-art model extraction attacks.

Paper Structure

This paper contains 23 sections, 2 equations, 2 figures, 5 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Related Works
  4. Method
  5. Objective
  6. Approach
  7. Selection
  8. Mutation
  9. Boundary Traversal
  10. Experiment Setup
  11. Datasets
  12. Model Extraction Algorithms
  13. Models
  14. Resources
  15. Metrics
  16. ...and 8 more sections

Figures (2)

  • Figure 1: An illustration that compares sampling strategies used by model extraction attacks. Existing methods that target multi-class classifiers either sample $f$ in a distributed manner or focus on high-confidence areas. Our approach is to focus on low-confidence areas to better capture the decision boundary manifolds.
  • Figure 2: Comparison of substitute model accuracy across different values of the top k values for Fashion-MNIST and CIFAR-10.