PaperlayerView exact revision on arXiv

Source-linked AI summary

MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimation

Sanjay Kariyappa, Atul Prakash, Moinuddin Qureshi

arXiv:2005.03161v2stat.MLcs.LG

TL;DR

Existing model stealing attacks depend on target or semantically similar data, motivating a data-free approach to copying model functionality. MAZE generates synthetic inputs and trains the generator using a disagreement objective with zeroth-order optimization under black-box access. Across evaluations, MAZE achieves high normalized clone accuracy, while MAZE-PD further improves accuracy and reduces query requirements when limited data is available.

  • Problem

    Existing model stealing attacks rely on partial target data or semantically similar surrogate data, which may be unavailable to the attacker.

  • Method

    MAZE uses a generative model trained on a disagreement objective and zeroth-order gradient estimation to create synthetic data for black-box model stealing.

  • Results

    MAZE produces clone models with normalized clone accuracy of 0.90× to 0.99×, while MAZE-PD reaches 0.97× to 1.0× and reduces queries by 2× to 24× compared to MAZE.

  • Takeaways & Limitations

    High-accuracy model stealing is feasible with only black-box access and no in-distribution data, while limited data enables near-perfect clone accuracy.

  • Takeaways & Limitations

    JBDA tends to produce lower-accuracy clones on complex datasets, including normalized clone accuracy of only 0.13× on GTSRB and 0.18× on SVHN.

Abstract

from arXiv · show

Model Stealing (MS) attacks allow an adversary with black-box access to a Machine Learning model to replicate its functionality, compromising the confidentiality of the model. Such attacks train a clone model by using the predictions of the target model for different inputs. The effectiveness of such attacks relies heavily on the availability of data necessary to query the target model. Existing attacks either assume partial access to the dataset of the target model or availability of an alternate dataset with semantic similarities. This paper proposes MAZE -- a data-free model stealing attack using zeroth-order gradient estimation. In contrast to prior works, MAZE does not require any data and instead creates synthetic data using a generative model. Inspired by recent works in data-free Knowledge Distillation (KD), we train the generative model using a disagreement objective to produce inputs that maximize disagreement between the clone and the target model. However, unlike the white-box setting of KD, where the gradient information is available, training a generator for model stealing requires performing black-box optimization, as it involves accessing the target model under attack. MAZE relies on zeroth-order gradient estimation to perform this optimization and enables a highly accurate MS attack. Our evaluation with four datasets shows that MAZE provides a normalized clone accuracy in the range of 0.91x to 0.99x, and outperforms even the recent attacks that rely on partial data (JBDA, clone accuracy 0.13x to 0.69x) and surrogate data (KnockoffNets, clone accuracy 0.52x to 0.97x). We also study an extension of MAZE in the partial-data setting and develop MAZE-PD, which generates synthetic data closer to the target distribution. MAZE-PD further improves the clone accuracy (0.97x to 1.0x) and reduces the query required for the attack by 2x-24x.

1. Introduction

Model stealing attacks copy a target model’s functionality through black-box queries, but existing approaches depend on target or semantically similar data. MAZE addresses this data limitation by generating synthetic inputs and optimizing them with zeroth-order estimation to train accurate clones.

  • Attack setting: Model stealing attacks query a target model with inputs and use its predictions to train a clone that matches the target.The attack constructs labeled query data before training the clone.
  • Data limitation: Existing attacks rely on partial target data or semantically similar surrogate data, becoming ineffective without either source.JBDA uses target-data subsets, whereas KnockoffNets uses surrogate data.
  • MAZE: MAZE generates synthetic data with a generative model instead of requiring target or surrogate datasets.The paper presents MAZE as a data-free model stealing attack for complex DNNs and multiple image-classification datasets.
  • MAZE: MAZE trains its generator with a disagreement objective that produces inputs maximizing disagreement between target and clone models.Training the clone on these examples improves alignment between the clone and target decision boundaries.
  • Optimization: MAZE uses zeroth-order gradient estimation to optimize the generator under black-box target access, estimating gradients with respect to lower-dimensional synthetic inputs.This avoids the impractical dimensionality of directly estimating gradients over millions of generator parameters.
  • MAZE-PD: MAZE-PD uses limited available data and generative adversarial training to produce synthetic queries closer to the target distribution.Its reported normalized clone accuracy is 0.97× to 1.0×, with 2×-24× fewer queries than MAZE.

2. Related Work

Functionality-stealing attacks are categorized by data availability, with partial-data, surrogate-data, and data-free settings imposing different assumptions. Existing methods depend on target-distribution or semantically suitable data, limiting performance when such data is unavailable or mismatched.

  • Model-stealing settings: Functionality stealing aims to replicate a target model’s behavior and can operate with partial, surrogate, or synthetic data.The paper distinguishes functionality stealing from parameter and hyper-parameter stealing.
  • Partial-data attacks: JBDA uses seed examples from the target distribution, perturbs them with the clone-loss Jacobian, and labels the resulting inputs using target predictions.The synthetic examples are added to the labeled pool used to train the clone.
  • Partial-data attacks: 0.13× and 0.18× are JBDA’s reported normalized clone accuracies on GTSRB and SVHN, respectively, illustrating weaker performance on more complex datasets.The paper identifies dependence on seed examples and lower accuracy on complex datasets as key limitations.
  • Surrogate-data attacks: KnockoffNets queries the target with an alternate dataset, but its effectiveness depends on whether that surrogate dataset represents the target distribution.A suitable surrogate can yield up to 0.97× target accuracy, whereas a mismatched surrogate performs poorly.
  • Data-free attacks: Data-free attacks use no data, but noise-derived inputs perform well on simple datasets and poorly on complex ones such as CIFAR-10.The paper reports relative clone accuracy of 0.11× on CIFAR-10 for a noise-based attack.
  • Relation to knowledge distillation: Knowledge distillation is related to model stealing, but data-free KD methods are not directly applicable because model stealing exposes only black-box target access.In KD, the target model is available to the attacker and is summarized into a simpler architecture.

3. Preliminaries

The paper formulates data-free model stealing as training a clone that matches a high-accuracy target using only black-box access and soft output probabilities. It considers primary data-free and secondary partial-data settings, with a test set used for evaluation.

  • Objective and constraints: The objective is to train a clone model that replicates the target model’s functionality by maximizing clone accuracy on a test set.The target performs a classification task with high accuracy.
  • Objective and constraints: The attacker knows neither the target architecture nor its parameters and can query arbitrary inputs to observe output probabilities.This is the paper’s black-box soft-label setting.
  • Data-availability settings: The primary data-free setting provides no target dataset access and no good way to sample from the target distribution.MAZE is developed for this setting.
  • MAZE setup: MAZE’s setup uses a generator to create synthetic queries, a target and clone that produce predictions, and zeroth-order estimation because target backpropagation is unavailable.The generator seeks disagreement between target and clone predictions.
  • Data-availability settings: The secondary partial-data setting gives the attacker a small random subset of target training examples, such as 100 examples.This setting is used for the MAZE-PD extension.
  • Evaluation assumption: Both settings assume access to a test set used to report the clone models’ test accuracies.The test set is not described as attacker training data.

4. MAZE: Data-Free Model Stealing

MAZE trains a generator and clone jointly without target or surrogate data: the generator seeks target–clone disagreement, while the clone learns target predictions. Zeroth-order estimates with respect to synthetic inputs make generator optimization feasible under black-box access.

  • Attack objectives: MAZE uses a generator fed by random latent vectors to produce synthetic queries, then trains the clone to match target output probabilities.The clone minimizes KL divergence between clone and target predictions.
  • Attack objectives: The generator maximizes KL-divergence between target and clone predictions, creating queries that expose disagreement for clone learning.Generator and clone therefore have opposing objectives resembling a two-player game.
  • Black-box optimization: Direct generator training is unavailable because optimizing its loss requires backpropagation through the black-box target model.The inaccessible target parameters prevent computing the loss derivative with respect to the synthetic input directly.
  • Black-box optimization: MAZE estimates the loss gradient with respect to the generated input rather than millions of generator parameters, then backpropagates that estimate through the generator.For CIFAR-10, the synthetic input has dimensionality 3072.
  • Zeroth-order estimation: Averaging forward differences over m random directions reduces the variance of the zeroth-order gradient estimate.Each direction uses a small smoothing factor ϵ and a random unit-sphere vector.
  • Training algorithm: The attack alternates generator training, clone training, and experience replay inside an outer loop bounded by the query budget Q.Experience replay reuses stored input–prediction pairs without additional target queries.
  • Query efficiency: With batch size B, generator updates cost m+1 target queries per sample and clone updates cost one query per sample, while replay adds none.The reported experimental configuration uses B = 128, m = 10, and 2048 queries per attack iteration.

5. Experimental Evaluation

The evaluation attacks image-classification DNNs and compares MAZE with surrogate-data and partial-data baselines. MAZE achieves high normalized clone accuracy without data, while baseline performance depends strongly on dataset similarity or complexity.

  • Experimental setup: The experiments evaluate MAZE on multiple image-classification target models, using LeNet for FashionMNIST and ResNet-20 for the other datasets.A randomly initialized 22-layer WideResNet serves as the clone architecture across datasets.
  • Baselines: KnockoffNets uses surrogate datasets, whereas JBDA uses 100 target-distribution seed examples followed by six augmentation rounds.JBDA trains the clone for ten epochs between augmentation rounds.
  • Evaluation metric: Table 1 reports clone accuracy both directly and normalized by the attacked target model’s accuracy.The table compares MAZE with existing attacks and highlights the best clone accuracy for each dataset.
  • MAZE results: 0.90× to 0.99× normalized accuracy is obtained by MAZE across all attacked target models without using any data.The baseline Noise attack fails to produce high-accuracy clones for most datasets.
  • Comparison with prior attacks: 0.91×–0.99× normalized clone accuracy is achieved by MAZE, compared with 0.13×–0.69× for JBDA across the reported comparisons.The paper attributes MAZE’s stronger result to queries produced through the disagreement objective.
  • Comparison with prior attacks: KnockoffNets ranges from 0.52× on a visually dissimilar surrogate-target pairing to 0.89× when the surrogate and target datasets are similar.These examples illustrate the baseline’s dependence on surrogate-data similarity.

6. MAZE-PD: MAZE with Partial-Data

MAZE-PD extends MAZE with WGAN-based generative adversarial training so synthetic queries more closely follow the target distribution, improving accuracy and query efficiency when limited data is available.

  • 6.1. Incorporating WGAN in MAZE: MAZE-PD adds a WGAN objective to train the generator toward inputs closer to the target distribution.The generator loss combines MAZE’s disagreement loss with a WGAN loss, balanced by λ.
  • 6.1. Incorporating WGAN in MAZE: The modified attack introduces a critic that estimates the Wasserstein distance between target and synthetic data distributions.Critic training is added while clone training and experience replay remain unchanged.
  • 6.2. Results: Clone Accuracy with Partial Data: 0.97×-1.0× normalized clone accuracy is achieved by MAZE-PD across all datasets with 100 target-training examples.The available partial data represents roughly 0.2% of the target training data.
  • 6.2. Results: Clone Accuracy with Partial Data: 2× to 24× lower query budgets are required by MAZE-PD than MAZE for a given clone accuracy.The comparison uses 100 random examples from the target training data and does not require extra target queries for critic training.
  • 6.2. Results: Clone Accuracy with Partial Data: MAZE-PD achieves significantly higher accuracy than JBDA at the same query budget and reaches 0.97×-1.0× across all four datasets.JBDA remains below 0.30× on SVHN, GTSRB, and CIFAR-10.

7. Conclusion

The paper concludes that MAZE enables high-accuracy model stealing without input data by using zeroth-order optimization to train a generator of synthetic queries. Its partial-data extension further improves accuracy and reduces query requirements, while sensitivity studies expose query, estimation, and replay trade-offs.

  • 7. Conclusion: MAZE is presented as a data-free model stealing attack for complex DNNs across multiple image-classification tasks.It uses a generator trained with zeroth-order optimization to craft synthetic inputs for cloning the target model.
  • 7. Conclusion: 0.90× to 0.99× normalized clone accuracy is achieved by MAZE without using input data.The paper reports that MAZE outperforms recent attacks relying on partial or surrogate data.
  • 7. Conclusion: MAZE-PD extends the attack to limited-data settings by using generative adversarial training to produce inputs closer to the target distribution.The extension assumes a small number of examples from that distribution.
  • 7. Conclusion: 0.97× to 1.0× accuracy and 2× to 24× fewer queries are reported for MAZE-PD compared with MAZE.These results concern the partial-data setting.
  • B.1. Sensitivity to Query Budget: Higher query budgets improve clone accuracy, but the required budget depends on dataset difficulty.SVHN reaches 0.95× with around 5M queries, whereas CIFAR-10 requires around 30M.
  • B.2. Sensitivity to Number of Directions for Estimating the Gradient: The number of gradient directions trades off estimation accuracy against queries available for clone training, with the best value depending on dataset complexity.Lower m improves accuracy for some simpler datasets but harms accuracy for GTSRB and CIFAR-10 when estimation error becomes larger.
  • B.2. Sensitivity to Number of Directions for Estimating the Gradient: 7.3% average clone-accuracy improvement is obtained from experience replay.Replay retrains the clone on previously seen examples and helps avoid catastrophic forgetting.

B.4. Impact of Error in Gradient Estimation

MAZE’s zeroth-order gradient estimation causes a modest clone-accuracy loss, while larger query budgets largely absorb this error.

  • 3.8% average clone-accuracy improvement is observed when MAZE uses perfect rather than estimated gradient information.The comparison uses reduced query budgets of 1.25M for FashionMNIST and SVHN, 10M for GTSRB, and 20M for CIFAR-10.
  • The estimated gradients are reasonably accurate, allowing MAZE to train high-accuracy clone models.
  • At a budget of 30 million queries, the clone-accuracy difference between estimated and perfect gradients is negligible.

C. MAZE-PD: Impact on Query Budget

MAZE-PD reaches the target normalized clone accuracy with substantially fewer queries than MAZE when a small partial dataset is available.

  • 2× to 24× query-budget reduction is achieved by MAZE-PD compared with MAZE for reaching 0.90× normalized clone accuracy.The comparison uses the query budget required to reach the minimum normalized clone accuracy of 0.90×.
  • MAZE-PD’s query reduction is considerable with just 100 examples and is expected to decrease further with more training examples.

D. Comparing Synthetic Images Generated by MAZE and MAZE-PD

MAZE-PD generates synthetic images that more closely resemble the target distribution than those generated by MAZE, supporting improved query efficiency.

  • MAZE creates synthetic images without target-model input data, whereas MAZE-PD uses available data and a WGAN loss to move generated images closer to the target distribution.
  • MAZE-PD’s generated images are visually similar to representative images from the target distribution across the compared datasets.For FashionMNIST, one MAZE-PD image resembles a garment.
  • MAZE-PD images show clearer foreground-background separation than MAZE images.
  • The WGAN objective encourages synthetic images closer to the target distribution, likely helping MAZE-PD obtain higher-accuracy clones with fewer queries.

E. Work on Data-free Knowledge Distillation

Data-free knowledge-distillation methods generate inputs using teacher-model information, but their white-box requirements prevent direct use for black-box model stealing.

  • Related data-free KD methods: Data-free KD work is closely related to MAZE but assumes white-box access to the target model.
  • Adversarial Belief Matching: ABM trains a generator to maximize prediction dissimilarity between teacher and student models, while iteratively distilling knowledge into the student.
  • Adversarial Belief Matching: ABM additionally uses attention transfer to match intermediate activation attention maps between student and teacher networks.
  • Adversarial Belief Matching: ABM cannot directly support black-box model stealing because it requires backpropagation through the target and access to intermediate activations.
  • Dreaming To Distill: DTD optimizes the target model’s loss with image-prior terms, using batch-normalization statistics to steer generated images toward realistic target-class inputs.
  • Dreaming To Distill: DTD also requires white-box target access and batch-normalization running mean and variance unavailable in black-box model stealing.

F. Defending against MAZE

The paper discusses defenses against MAZE, including restricting prediction outputs, perturbing probabilities, and limiting queries. Each defense has trade-offs for benign users or can be circumvented.

  • MAZE is the first data-free model stealing attack designed for multiple vision-based DNN models.The paper also discusses the applicability and limitations of defenses against this attack.
  • Restricting model outputs to hard labels can make gradient estimation harder, although not necessarily impossible.MAZE requires prediction probabilities to estimate gradient information.
  • Perturbing output probabilities can destroy information needed for downstream processing and reduce benign classification accuracy.
  • Query limits may be bypassed through a distributed attack that splits model stealing across multiple users.The same limits may constrain legitimate benign queries.
Loading 2005.03161v2…