PaperlayerView exact revision on arXiv

Source-linked AI summary

A framework for the extraction of Deep Neural Networks by leveraging public data

Soham Pal, Yash Gupta, Aditya Shukla, Aditya Kanade, Shirish Shevade, Vinod Ganapathy

arXiv:1905.09165v1cs.LGcs.AIcs.CRstat.ML

TL;DR

Practical model extraction must work on DNNs without secret-domain samples and under query limits. This paper combines public thief datasets with active learning, improving agreement over uniform noise across image and text tasks at a 30K-query budget.

  • Problem

    Practical extraction must work on DNNs without access to secret-task samples and minimize queries, which MLaaS providers bill and may rate-limit.

    Source: §1 · p. 2

  • Method

    The framework uses large public universal thief datasets and pool-based active learning to select a limited set of model queries.

    Source: §1 · p. 3

  • Results

    4.70× average improvement in agreement for image tasks and 2.11× for text tasks over the uniform-noise baseline, using a 30K query budget.

    Source: §1 · p. 3

  • Takeaways & Limitations

    The framework extracts DNNs with high test agreement on a limited query budget using 10–30% of the available data.

    Source: §8 · p. 16

    Further work includes developing better active-learning strategies and exploring new combinations of existing strategies.

    Source: §8 · p. 16

Abstract

from arXiv · show

Machine learning models trained on confidential datasets are increasingly being deployed for profit. Machine Learning as a Service (MLaaS) has made such models easily accessible to end-users. Prior work has developed model extraction attacks, in which an adversary extracts an approximation of MLaaS models by making black-box queries to it. However, none of these works is able to satisfy all the three essential criteria for practical model extraction: (1) the ability to work on deep learning models, (2) the non-requirement of domain knowledge and (3) the ability to work with a limited query budget. We design a model extraction framework that makes use of active learning and large public datasets to satisfy them. We demonstrate that it is possible to use this framework to steal deep classifiers trained on a variety of datasets from image and text domains. By querying a model via black-box access for its top prediction, our framework improves performance on an average over a uniform noise baseline by 4.70x for image tasks and 2.11x for text tasks respectively, while using only 30% (30,000 samples) of the public dataset at its disposal.

1 Introduction

The introduction frames practical model extraction as copying DNNs without secret-domain samples and within query limits. It proposes public thief datasets and active learning as the basis for that approach.

1 Introduction

  • Earlier approaches use uniform noise that does not scale well to deeper networks [11], hand-crafted examples requiring domain knowledge [7], or non-problem-domain data without a query budget [12].The cited approaches differ in which practical extraction criteria they address.Source: §1 · p. 2
  • Practical extraction should work on DNNs without secret-task domain knowledge and with few queries, which MLaaS billing and rate limits make valuable.The introduction names these as the three criteria for a practical approach.Source: §1 · p. 2
  • Universal thief datasets are large, diverse public corpora that provide a natural prior without requiring domain knowledge; ImageNet and Wikipedia articles illustrate vision and NLP sources.The datasets are analogous to non-problem-domain data in Correia-Silva et al. [12].Source: §1 · p. 3
  • Pool-based active learning selects informative examples from the large unlabeled thief dataset to reduce secret-model queries and stay within budget.The dataset’s size makes it unsuitable for limited budgets without query selection.Source: §1 · p. 3
  • The framework combines universal thief datasets with active learning for DNN image and text classification, and introduces an ensemble of existing active-learning strategies.The authors design an ensemble strategy to improve performance.Source: §1 · p. 3
  • 4.70× (image tasks) and 2.11× (text tasks) improvement in agreement over Tramèr et al.’s [11] uniform-noise baseline, using a 30K query budget.The comparison is averaged across image and text classification tasks.Source: §1 · p. 3

2 Background

The background introduces supervised learning and the cost of acquiring labels, then describes pool-based active learning and DeepFool adversarial examples. The framework uses pool-based sampling, while DeepFool supplies an adversarial-example technique used later by its DFAL strategy.

2.1 Preliminaries

  • Large training sets support DNN generalization, but their labeling effort can make learning intractable when each label, including a model query, is costly.DNNs learn by minimizing a loss on labeled data, and better predictions correspond to lower loss.Source: §2.1 · p. 4

2.2 Active learning

  • Active learning uses an oracle to label selected samples, reducing reliance on a full labeled dataset when labels are expensive.Source: §2.2 · p. 4
  • Pool-based sampling selects a subset from a full unlabeled dataset, and this work grows that queried subset in batches over successive iterations.Unlike stream-based sampling, the learner can select from the full pool rather than evaluating each sample in isolation.Source: §2.2 · p. 4

2.3 Adversarial example generation and the DeepFool technique

  • DeepFool iteratively adds perturbations until an image's prediction changes; in binary classification, it uses a first-order approximation for the linearly separable case.The process starts at the original image and stops at the first iterate classified differently; the total perturbation sums the individual steps.Source: §2.3 · pp. 4–5

3 Threat model

The threat model gives the adversary black-box API access to query a secret model, with query costs restricting practical use. The adversary trains a substitute from labeled public data and evaluates its approximation by agreement with the secret model.

3 Threat model

  • The adversary can query the secret model only through a black-box API, and query costs impose a practical total budget that can represent rate-limiting defenses.Source: §3 · p. 5
  • The adversary knows the input and label specifications but receives only the final prediction, with Top-1 labels as the primary experimental setting.The secret architecture and hyperparameters need not be known, though main results use the same architecture for secret and substitute models.Source: §3 · p. 5
  • The adversary lacks the secret training dataset but may use unlabeled public data, which must be labeled by the secret model before substitute training.Source: §3 · p. 5
  • The adversary trains a substitute on a small subset of the thief dataset, and agreement measures the fraction of samples on which its predictions match the secret model.Agreement does not depend on true labels; higher held-out agreement makes a close approximation more likely.Source: §3 · p. 6

4 Technical details

The framework iteratively trains a substitute model from labels queried from a secret model, using active learning to choose new samples from a public thief dataset. It combines strategies that prioritize informative boundary samples and diverse selections.

4 Technical details

  • Each iteration queries a selected subset of the thief dataset, trains the substitute, labels the full pool approximately with it, and selects the next query set.The process begins with a random seed subset and repeats for a fixed number of iterations.Source: §4 · p. 6

4.1 Active learning subset selection strategies

  • The strategy options include random sampling, highest-entropy uncertainty sampling, K-center selection for diversity, and adversarial selection of samples near the decision boundary.Uncertainty sampling ranks substitute predictions by entropy; K-center selects probability vectors farthest from existing centers; the adversarial strategy uses DeepFool perturbations.Source: §4.1 · pp. 7–8

4.2 Ensemble of subset selection strategies

  • Adversarial+K-center first selects ρ boundary-near points, then chooses k among them to increase diversity.The ensemble addresses the complementary properties that K-center promotes diversity without ensuring individual usefulness, while adversarial selection favors informative points without reducing redundancy.Source: §4.2 · p. 8

5 Experimental setup

The experiments evaluate image and text classifiers using secret datasets and public thief datasets, with specified base architectures and training procedures.

5.1 Datasets

  • Secret image tasks use MNIST, Fashion-MNIST, CIFAR-10, and GTSRB; text tasks use MR, IMDB, AG News, and QC.The image thief dataset is a 100,000-example subset of ILSVRC2012-14, while the text thief dataset uses WikiText-2 sentences.Source: §5.1 · p. 9

5.2 DNN architecture

  • Primary evaluations use the same base-complexity architecture for secret and substitute models, with additional image experiments varying their complexity.Training uses Adam, validation-based early stopping, L2 regularization, and dropout.Source: §5.2 · p. 9, §5.3 · p. 9
  • Image classifiers use a three-block CNN with 32, 64, and 128 filters, while text classifiers use Kim’s sentence CNN with 100 filters each of sizes 3, 4, and 5.The image network ends with fully connected and softmax layers; the text network applies max-over-time pooling before those layers.Source: §5.2 · p. 9

5.3 Training Regime

  • Experiments use k0 = 0.1B and η = 0.2; the ensemble parameter is set to ρ = B.B is the total query budget.Source: §5.3 · p. 9

6 Experimental results

The experiments compare active-learning strategies, query budgets, thief datasets, and model architectures across image and text classification. Agreement generally benefits from active sample selection and public thief data, while architecture match and more iterations also affect results.

6 Experimental results

  • The evaluation measures secret–substitute agreement on the secret dataset’s test split, with iterative training except for random selection.The experiments also compare results using the full thief dataset.Source: §6 · p. 10

6.1 Image classification

  • Across image experiments, the ensemble strategy beats basic adversarial selection in 14 cases and wins 13, while K-center wins five.No dataset has random selection outperforming all other strategies; K-center underperforms once, adversarial twice, and uncertainty six times.Source: §6.1 · p. 10
  • At a fixed query budget, increasing the number of iterations improves agreement but increases training time.The experiments also report improved agreement when the secret model’s output probabilities, rather than only its top prediction, are available.Source: §6.1 · p. 11
  • Uniform noise produces low image agreement and uneven predicted-label frequencies, whereas a universal thief dataset alleviates difficulty reaching some classes.With the full 100K thief dataset, average agreement improves 4.82× over the uniform baseline.Source: §6.1 · pp. 11–12

6.1 Image classification; 6.3 Text classification

  • Image agreement improves 4.70× over the uniform baseline at a 30K budget, while text agreement improves 2.11× over the discrete uniform baseline.The image result uses active learning; the text result also retains its improvement with a 30K budget.Source: §6.1 · p. 12, §6.3 · p. 14

6.2 Influence of substitute model architecture

  • Agreement is generally high when secret and substitute model complexities match, but remains reasonably high when they differ.The authors attribute degradation with a less complex substitute to underfitting, and with a more complex one to overfitting and poorer generalization.Source: Table 5 · p. 12, §6.2 · p. 13

6.3 Text classification

  • In text experiments, no dataset has random selection outperforming all other strategies; K-center and uncertainty each underperform only once.Agreement usually increases with query budget, and improves incrementally across iterations.Source: §6.3 · p. 13, Figure 7 · p. 13
  • All three text experiments using the thief dataset, including random selection, outperform the uniform-noise baseline.Using the full 89K thief dataset improves agreement 2.22× over the discrete uniform baseline.Source: §6.3 · pp. 13–14, Table 6 · p. 14

7 Related work

Related work covers model extraction attacks and defenses, methods for reverse-engineering model architecture, and active-learning strategies. The paper distinguishes its pool-based approach from prior extraction work using query synthesis or domain-specific data.

7.1 Model extraction

  • Tramèr et al. [11] study extraction under a limited query budget, but random uniform noise as a thief dataset fails for deeper networks; Papernot et al. [7] query limited training-data subsets or hand-crafted samples resembling it.Source: §7.1 · pp. 14–15
  • Other extraction approaches use seed-based exploration, query synthesis, or active learning with problem-domain data or a GAN trained on secret samples.Chandrasekaran et al. [41] use query synthesis for decision trees, whereas this paper uses pool-based active learning.Source: §7.1 · pp. 14–15

7.2 Model reverse-engineering

  • Model reverse-engineering uses prediction outputs, timing, or hardware side channels to infer model hyperparameters or architecture.Methods include softmax-based meta-models [17], timing analysis [19], and cache [20] [22] or bus [21] side channels.Source: §7.2 · p. 16

7.3 Active learning

  • Deep-network active-learning methods include K-center core-set construction and DeepFool-based boundary sampling.Sener and Savarese [24] use K-center approximations, while Ducoffe and Precioso [14] use DeepFool to sample near decision boundaries.Source: §7.3 · p. 16

8 Conclusion

The paper concludes that its framework combines unlabeled public data and active learning to extract DNNs. Across diverse datasets, it reports high test agreement with limited queries while using only a fraction of the available data.

8 Conclusion

  • The framework combines unlabeled public data and active learning to address the paper’s three criteria for practical model extraction.The supplied conclusion does not enumerate those criteria.Source: §8 · p. 16
  • Across diverse datasets, the framework extracts DNNs with high test agreement using limited queries and 10–30% of available data.Future work includes developing better active-learning strategies and exploring other combinations of existing strategies.Source: §8 · p. 16

Related papers

Loading 1905.09165v1…