PaperlayerView exact revision on arXiv

Source-linked AI summary

Stealing Hyperparameters in Machine Learning

Binghui Wang, Neil Zhenqiang Gong

arXiv:1802.05351v3cs.CRcs.LGstat.ML

TL;DR

Hyperparameters can be confidential and materially affect model performance, yet learners may expose model parameters. This paper develops hyperparameter-stealing attacks based on objective-function gradients, showing accurate recovery across algorithms and datasets while motivating stronger defenses for some algorithms.

  • Problem

    Hyperparameters can substantially change model performance and may be confidential because they are learned through costly, proprietary procedures.

  • Method

    The attacks set the objective-function gradient at learned model parameters to zero, producing an overdetermined linear system whose solution estimates the hyperparameters.

  • Results

    The attacks accurately estimate hyperparameters across six real-world datasets and various algorithms, with regression relative estimation errors below 10^-4, and succeed on Amazon Machine Learning.

  • Takeaways & Limitations

    Rounding model parameters remains ineffective for certain algorithms, so new countermeasures are needed; the attacks can also reduce MLaaS costs without sacrificing testing performance.

  • Takeaways & Limitations

    When the ML algorithm is unknown, the current attack is defeated, and jointly identifying the algorithm and hyperparameters may be impossible in some cases.

Abstract

from arXiv · show

Hyperparameters are critical in machine learning, as different hyperparameters often result in models with significantly different performance. Hyperparameters may be deemed confidential because of their commercial value and the confidentiality of the proprietary algorithms that the learner uses to learn them. In this work, we propose attacks on stealing the hyperparameters that are learned by a learner. We call our attacks hyperparameter stealing attacks. Our attacks are applicable to a variety of popular machine learning algorithms such as ridge regression, logistic regression, support vector machine, and neural network. We evaluate the effectiveness of our attacks both theoretically and empirically. For instance, we evaluate our attacks on Amazon Machine Learning. Our results demonstrate that our attacks can accurately steal hyperparameters. We also study countermeasures. Our results highlight the need for new defenses against our hyperparameter stealing attacks for certain machine learning algorithms.

I. INTRODUCTION

The paper introduces hyperparameter stealing attacks because hyperparameters affect model performance and may remain confidential when learned through proprietary processes. It develops a general gradient-based attack, evaluates it theoretically and empirically, and studies rounding and objective-function choices as defenses.

  • Motivation: Hyperparameters can substantially change testing performance and may be confidential because they are often learned through expensive, proprietary cross-validation.The paper focuses on hyperparameters balancing loss and regularization terms.
  • Contribution: The authors formulate hyperparameter stealing as a systematic attack problem and propose a general framework applicable to popular machine learning algorithms.The studied algorithms include ridge regression, logistic regression, support vector machines, and neural networks.
  • Method: The attack sets the objective-function gradient at learned model parameters to zero, yielding an overdetermined linear system solved with linear least squares.The method relies on learned model parameters often being minima of the corresponding objective function.
  • Evaluation: When model parameters are exact objective minima, the attacks recover exact hyperparameters; small deviations produce estimation errors linear in the deviation.Empirically, relative estimation errors were less than 10^-4 for various regression algorithms across six real-world datasets.
  • Application: On Amazon Machine Learning, Train-Steal-Retrain reduces economic costs without sacrificing testing performance by stealing hyperparameters after training on a small data fraction.The user then retrains through MLaaS on the full dataset using the stolen hyperparameters.
  • Defenses: Rounding increases attack errors, but attacks remain effective for some algorithms; L2 regularization and selected loss functions provide stronger defenses than alternatives.For LASSO, relative errors remain below around 10^-3 after rounding parameters to one decimal; cross entropy and square hinge outperform regular hinge under rounding.

B. Problem Definition

The problem definition assumes an attacker knows the training dataset and ML algorithm, and may know the learned model parameters. The goal is to estimate the objective-function hyperparameter, with MLaaS providing a motivating application in which stolen hyperparameters reduce training costs.

  • Threat model: The threat model gives the attacker the training dataset and ML algorithm, with learned model parameters available optionally.The setting is motivated by MLaaS platforms that expose algorithm choices and may allow users to download model parameters.
  • Attack definition: Hyperparameter stealing attacks estimate the value balancing loss and regularization in an objective function, given the algorithm, dataset, and optionally learned parameters.This is the paper’s formal definition of the attack target.
  • Application scenario: A motivating application samples a small dataset fraction, steals the learned hyperparameter, and retrains on the full dataset through MLaaS at lower computational cost without sacrificing testing performance.The paper calls this application scenario Train-Steal-Retrain in its broader evaluation.

IV. HYPERPARAMETER STEALING ATTACKS

The attack framework exploits the near-zero gradient at learned model parameters to express hyperparameter recovery as an overdetermined linear system. It computes gradient-derived vectors and solves for one or more regularization hyperparameters, adapting the procedure to kernel algorithms and non-differentiable objectives.

  • Scope and Extensions: The framework is demonstrated on regression and classification algorithms, with neural-network results reported separately and extensions available for multiple hyperparameters.For multiple hyperparameters, the vector a becomes a matrix whose columns correspond to regularization-term gradients.
  • General Attack Framework: Setting the objective gradient at the learned parameters to zero produces an overdetermined linear system about the hyperparameter.The framework solves this system with linear least squares to obtain an approximate solution.
  • Kernel Algorithms: For kernel algorithms, the attack represents model parameters with kernel coefficients, differentiates with respect to those coefficients, and again solves an overdetermined system.The vectors a and b are redefined for the kernel representation before applying Eqn. 3.
  • Addressing Non-Differentiability: The framework addresses non-differentiability by handling problematic model-parameter dimensions and training instances separately.L1 regularization is non-differentiable where parameters are zero, while SVM objectives can be non-differentiable at certain training instances.
  • General Attack Framework: The attacker computes gradient-derived vectors from the training data, algorithm, and learned parameters, then estimates the hyperparameter from the resulting equations.The procedure consists of computing a and b, followed by hyperparameter estimation using Eqn. 3.

B. Attacks to Regression Algorithms

The paper instantiates the attack framework across linear and kernel regression and classification algorithms with different loss and regularization terms. In each case, gradients at learned parameters provide equations for estimating the regularization hyperparameter, with special handling for non-differentiable terms.

  • Regression Algorithms: Ridge regression uses least-square loss with L2 regularization, and setting its gradient to zero yields an estimate based on a = w and b = X(X^T w − y).The attack is applied to the objective L(w) = ||y − X^T w||^2 + λ||w||^2_2.
  • Regression Algorithms: Kernel ridge regression applies the same strategy after representing the model parameters with kernel coefficients and using the Gram matrix.The kernel objective uses least-square loss and L2 regularization in the α representation.
  • Classification Algorithms: The attacks cover SVMs with regular or squared hinge loss and logistic regression with L1 or L2 regularization.These four classification algorithms allow comparison across different loss functions and regularization terms.
  • Classification Algorithms: For L1-regularized logistic regression, the gradient uses sign(w), and zero-valued parameters are excluded from hyperparameter estimation.The derivative of |w_i| at w_i = 0 is defined as zero for this procedure.
  • Classification Algorithms: For kernel SVM with regular hinge loss, the attack uses only training instances satisfying y_i α^T k_i < 1 because the loss is non-differentiable at equality.The corresponding estimate uses a = 2Kα and a loss-gradient term selected by an indicator function.

V. EVALUATIONS

The evaluations combine theoretical guarantees with experiments on real-world datasets and multiple algorithm families. The theory gives exact recovery at exact optima and linear estimation error near the closest optimum, while the experiments measure relative estimation error across varied settings.

  • Theoretical Evaluations: Exact optimization minima yield exact hyperparameter recovery, so the attack returns ˆλ = λ under the theorem’s assumptions.The guarantee applies when learned parameters are exact minima of objectives formed from loss plus λ times a regularization term.
  • Theoretical Evaluations: The theoretical evaluation includes a formal proof for exact recovery and a separate proof for the near-minimum error bound.The proofs are referenced in Appendices D and E.
  • Theoretical Evaluations: When learned parameters differ slightly from the closest objective minimum, hyperparameter estimation error is a linear function of that difference.The result is stated for deviations Δw → 0 or Δα → 0 and includes gradients at the closest minimum.
  • Experimental Setup: The experiments use several UCI real-world datasets with substantially different numbers of instances and features to represent different application scenarios.Each dataset is used as a training dataset.

2) Experimental Results for Known Model Parameters:

The experiments show that hyperparameter stealing attacks accurately estimate hyperparameters across studied algorithms, including when model parameters are approximate or stolen. The attacks can also reduce MLaaS computation while preserving model accuracy in the reported setting.

  • Hyperparameter stealing attacks accurately estimate hyperparameters across all studied learning algorithms and a wide range of values.
  • RR and KRR yield more accurate estimates than other algorithms because their analytical model-parameter solutions are exact objective minima.
  • For approximate RR solutions, estimation error grows linearly with parameter deviation when the deviation is small and quadratically as it becomes larger.
  • The attacks remain effective when model parameters are unknown and first recovered using model-parameter stealing attacks.
  • Learning an Accurate Model with Less Costs: On UJIndoorLoc, sampling 3% of training data let M3 achieve almost 0 relative MSE error over M1 while running around 8 times faster for RR.
  • Learning an Accurate Model with Less Costs: M3 provides greater speedups on larger datasets and is more accurate than M2 when both achieve the same speedup over M1.

3) Attacking Amazon Machine Learning:

Amazon Machine Learning experiments show that Train-Steal-Retrain substantially reduces training cost while preserving accuracy, whereas rounding defenses vary across algorithms and regularization choices.

  • Amazon Machine Learning evaluation: $0.16 versus $1.02: M3 reduces Amazon Machine Learning training costs relative to M1, with 0.92% relative ACC error versus M1.M2 costs $0.15 and has 5.1% relative ACC error; at similar cost, M3 is more accurate than M2.
  • Amazon Machine Learning evaluation: M3 can learn a model as accurately as M1 with much less computational cost, and its speedup increases on larger training datasets.The summary also reports that M3 is more accurate than M2 when achieving the same speedup over M1.
  • Rounding defense: Rounding increases hyperparameter-estimation error while keeping testing-performance errors below 2% when one decimal is retained.The defense is therefore security-improving with small testing-performance impact for the evaluated algorithms, though effectiveness differs by algorithm.
  • Rounding defense: For LASSO, attack estimation errors remain consistently below around 10^-3 across datasets even after parameters are rounded to one decimal.This indicates that rounding is insufficient for some algorithms despite its limited effect on testing performance.
  • Regularization and loss functions: L2 regularization defends more effectively than L1 regularization because its attack-estimation errors increase faster under rounding.On Diabetes with one decimal, RR and LASSO errors increase by 10^11 and 10^2, respectively; the paper relates this pattern to gradient magnitudes.
  • Regularization and loss functions: Cross entropy and square hinge loss have similar defense effectiveness and outperform regular hinge loss under rounding.
  • Rounding defense: 10^5, 10^6, and 10^2: one-decimal rounding increases relative estimation errors for L2-LR, SVM-SHL, and SVM-RHL on Madelon, respectively.L2-LR and SVM-SHL increase at similar rates, while both increase faster than SVM-RHL as fewer decimals are retained.

B. Implications for MLaaS

Rounding model parameters does not reliably prevent hyperparameter stealing, while Train-Steal-Retrain can retain its cost advantage under parameter rounding. Its applicability depends on data and user-resource assumptions, and broader defenses remain open.

  • Implications for MLaaS: Train-Steal-Retrain can still save substantial economic costs when an MLaaS platform rounds model parameters to one decimal.
  • Implications for MLaaS: Rounding model parameters is not effective enough against attacks for certain ML algorithms, despite small testing-performance impact.The paper identifies the need for new countermeasures for those algorithms.
  • Implications for MLaaS: Train-Steal-Retrain benefits require accurate hyperparameter learning from a small data fraction, insufficient local resources or expertise, and inaccurate models when trained entirely on that fraction.The validity of the first and third assumptions is data-dependent; the strategy itself requires ML expertise.
  • Implications for MLaaS: When the ML algorithm is unknown, the current attack is defeated because the task becomes jointly stealing the algorithm and hyperparameters.Identical model parameters can make logistic regression and SVM indistinguishable in the cited example.
  • Implications for MLaaS: The study is limited to hyperparameters balancing loss and regularization, leaving architecture, dropout, learning rate, and related hyperparameters for future work.
  • Implications for MLaaS: Future defenses could extend beyond rounding, including adding noise to the objective function as in differentially private ML algorithms.

APPENDIX A ATTACKS TO OTHER LEARNING ALGORITHMS

The appendix extends gradient-based hyperparameter-stealing attacks across regularized linear, logistic, SVM, and kernel algorithms, while noting an exact-estimation boundary for sufficiently large regularization.

  • Scope condition: If λ ≥ λ_max = ||Xy||_∞, then w = 0 and the exact hyperparameter cannot be estimated; meaningful model parameters require λ < λ_max in practice.
  • Logistic regression and SVM variants: L2-regularized logistic regression estimates λ by setting the objective gradient to zero, using a = 2w and b = X(h_w(X) − y).
  • Logistic regression and SVM variants: For SVM-SHL, the attack uses the square hinge-loss gradient and estimates λ through Eqn. 3 with a = w and a data-dependent vector b.The gradient is nonzero for examples with y_iw^T x_i ≤ 1 and zero when y_iw^T x_i > 1.
  • Kernel methods: For L1-regularized kernel logistic regression, λ is estimated from a = sign(w) and b = −2Xy + 2XX^T w after setting the gradient to zero.Zero-valued model parameters are excluded because the L1 derivative is defined as zero there.
  • Kernel methods: Kernel logistic regression and kernel SVM variants apply the same gradient-zero framework using kernel representations and their corresponding loss gradients.

APPENDIX B MORE THAN ONE HYPERPARAMETER

The appendix extends the attack to Elastic Net, which has two regularization hyperparameters, and reports that both the attack and rounding defense remain effective.

  • Elastic Net: Elastic Net combines least-squares loss with L2 and L1 regularization, creating an objective with more than one hyperparameter.
  • Elastic Net: The attack excludes zero model parameters and solves the resulting overdetermined gradient equations by linear least squares.
  • Elastic Net: The two estimated hyperparameters are represented as ˆλ = [ˆλ1; ˆλ2], with A = [sign(w); 2w ⊙ |sign(w)|] and b = −2Xy + 2XX^T w.
  • Elastic Net: Across three regression datasets, the attacks effectively learn Elastic Net’s multiple hyperparameters, and rounding is also an effective defense.

APPENDIX C NEURAL NETWORK (NN)

This appendix describes hyperparameter-stealing attacks against three-layer neural networks for regression and binary classification. The attacks use gradients with respect to the output-layer weights and estimate λ by setting the gradient to zero.

  • The experiments evaluate attack and defense on a three-layer neural network for both regression and classification.
  • Regression: For regression, the attack leverages the gradient of the objective with respect to the output-layer weight vector w2.The appendix identifies w2 as the simpler gradient choice for the attack.
  • The neural-network notation includes logistic activation, input-to-hidden weights W1, output weights w2, hidden-unit count d, and two bias terms.
  • Regression: Setting the gradient to zero enables estimating λ through Eqn. 3 for the regression network.
  • Classification: For binary classification, the attack similarly uses the output-layer weights w2 to steal λ from the objective-function gradient.

APPENDIX D PROOF OF THEOREM 5.1

The proof uses the exact-minimum condition b = −λa and treats the estimated hyperparameter as a function of model parameters. It then expands that function around the optimum using Taylor expansion.

  • At an exact minimum of the objective function, the proof uses the relation b = −λa.
  • The estimated hyperparameter ˆλ is treated as a function of the model parameters.
  • The proof expands ˆλ(w⋆+ ∆w) around w⋆ using Taylor expansion.

APPENDIX F APPROXIMATIONS OF GRADIENTS

This appendix approximates the gradient of the estimated hyperparameter for several linear and kernel learning algorithms. The derivations rely on component-wise limits and small-∆w approximations tailored to each algorithm.

  • The appendix approximates ∇ˆλ(w⋆) for RR, LASSO, L2-LR, L2-KLR, L1-LR, and L1-KLR.
  • The division and limit in the gradient approximation are taken component-wise with respect to ∆w.
  • RR: For RR, the derivation assumes sufficiently small ∆w so quadratic terms involving w⋆+∆w and ∆wTXXT∆w can be approximated.
  • LASSO: The LASSO approximation uses sign(w⋆+∆w) ≈ sign(w⋆).
  • L2 methods: The L2-LR and L2-KLR approximations use small-∆w assumptions, including stability of the quadratic term and the prediction function h.
  • L1 methods: For L1-LR and L1-KLR, the gradient approximations are presented separately, with L1-KLR described as analogous to L1-LR.
Loading 1802.05351v3…