PaperlayerView exact revision on arXiv

Source-linked AI summary

Data-Free Model Extraction

Jean-Baptiste Truong, Pratyush Maini, Robert J. Walls, Nicolas Papernot

arXiv:2011.14779v2cs.LG

TL;DR

Existing model extraction attacks depend on surrogate data similar to the victim’s proprietary training data, which is difficult to obtain for rare or hard-to-curate datasets. The paper proposes data-free model extraction using black-box predictions, recovering logits to approximate gradients and using data-free knowledge-transfer techniques. It achieves 0.99x victim accuracy on SVHN with 2M queries and 0.92x on CIFAR10 with 20M queries.

  • Problem

    Existing model extraction attacks typically require a surrogate dataset with semantic or distributional similarity to the victim’s proprietary training data.

  • Method

    DFME synthesizes queries with a generator, trains an extracted student against the victim, recovers logits from probability outputs, and uses an ℓ1 disagreement loss.

  • Results

    0.99x victim accuracy is achieved on SVHN with 2M queries, and 0.92x victim accuracy on CIFAR10 with 20M queries.

  • Takeaways & Limitations

    Data-free model extraction is practical and yields accurate copies of victim models, making extraction a credible threat to model intellectual property.

  • Takeaways & Limitations

    The generator cannot backpropagate through the black-box victim, so the method must rely on approximate gradients; KL divergence can also suffer from vanishing gradients during generator training.

Abstract

from arXiv · show

Current model extraction attacks assume that the adversary has access to a surrogate dataset with characteristics similar to the proprietary data used to train the victim model. This requirement precludes the use of existing model extraction techniques on valuable models, such as those trained on rare or hard to acquire datasets. In contrast, we propose data-free model extraction methods that do not require a surrogate dataset. Our approach adapts techniques from the area of data-free knowledge transfer for model extraction. As part of our study, we identify that the choice of loss is critical to ensuring that the extracted model is an accurate replica of the victim model. Furthermore, we address difficulties arising from the adversary's limited access to the victim model in a black-box setting. For example, we recover the model's logits from its probability predictions to approximate gradients. We find that the proposed data-free model extraction approach achieves high-accuracy with reasonable query complexity -- 0.99x and 0.92x the victim model accuracy on SVHN and CIFAR-10 datasets given 2M and 20M queries respectively.

1. Introduction

Existing model extraction attacks depend on surrogate data resembling the victim’s proprietary training distribution, limiting their applicability. The paper proposes data-free model extraction using black-box predictions and reports accurate copies with practical query budgets.

  • Motivation: Surrogate-distribution similarity is important because established distillation-based extraction depends on closeness to the victim’s proprietary training distribution.This dependence limits extraction when suitable surrogate data are expensive or difficult to curate.
  • Approach: Data-free model extraction (DFME) extracts models without knowledge of private training data using only the victim’s black-box predictions.The approach adapts data-free knowledge distillation for model extraction.
  • Approach: The method addresses black-box gradient access by recovering per-example logits from the victim’s probability-vector outputs.This enables approximate gradients despite the inability to backpropagate through the victim.
  • Results: 0.99x victim accuracy is achieved on SVHN with 2M queries, while 0.92x victim accuracy is achieved on CIFAR10 with 20M queries.These results validate DFME on both datasets.
  • Findings: The ℓ1 disagreement loss achieves higher extraction accuracy than previously considered losses, while weak gradient estimates provide sufficient signal to train the generator.These findings come from the paper’s ablation study.

2. Related Work

The paper situates data-free model extraction at the intersection of knowledge distillation, generative query synthesis, GAN-like optimization, and black-box gradient approximation. Its method uses an adversarial student-generator game and forward differences to reduce query demands.

  • Data-free distillation: Data-free knowledge distillation transfers teacher knowledge without access to the original training dataset, motivating its use for model extraction.The paper frames the victim as teacher and the stolen model as student.
  • Generative query synthesis: The method generates training queries with a generator that maximizes disagreement while the student minimizes the same objective against the victim.This forms a min-max game analogous to GAN optimization.
  • Dataset interpolation: Figure 1 interpolates inputs between the CIFAR10 target distribution at λ = 0 and the surrogate distribution at λ = 1.The interpolation examines how extraction changes as inputs move between the two distributions.
  • Black-box optimization: Black-box gradient approximation is necessary because the adversary cannot backpropagate through the victim model.The paper uses forward differences because of their relatively low query utilization.

3. How Hard is it to Find a Surrogate Dataset?

The difficulty of surrogate-based extraction depends on both task complexity and similarity between surrogate and victim domains. Experiments show severe degradation for mismatched surrogates on CIFAR10, while SVHN can remain extractable from random inputs.

  • Surrogate similarity: 93.5% extraction accuracy is obtained for a 95.5%-accurate CIFAR10 victim when CIFAR100 serves as the surrogate.The paper attributes this relatively strong result to both datasets being subsets of TinyImages.
  • Surrogate similarity: 66.6% is the maximum extraction performance when SVHN serves as the surrogate for the CIFAR10 victim.This contrasts with the CIFAR100 surrogate result.
  • Task complexity: Over 84% accuracy is achieved on the original SVHN test set even when the victim is queried with completely random inputs.The paper hypothesizes that simpler digit classification and less complex representations explain this result.
  • Distribution shift: Extraction accuracy decreases as the input distribution diverges from the CIFAR10 target distribution in interpolation experiments using SVHN and MNIST surrogates.Inputs are formed as x_in = (1 − λ) · x_t + λ · x_s.
  • Conclusions: Distillation-based extraction depends largely on task complexity, while source-domain similarity appears critical for complex tasks.The authors posit that finding a good surrogate for such models may approach the cost of training from scratch.

4. Data-Free Model Extraction

DFME trains a student model on synthesized queries without access to the victim’s private domain, using an adversarial generator–student setup and black-box gradient approximation. The approach uses logit-based ℓ1 disagreement to avoid vanishing gradients and alternates generator and student optimization.

  • Data-Free Model Extraction: DFME minimizes student error on a synthesized dataset because the victim’s private domain is unavailable.The loss measures disagreement between victim and student predictions on synthesized inputs.
  • Loss Function: DFME measures disagreement with the ℓ1 norm between victim and student logits, recovering logits from probability outputs because only softmax predictions are available.The ℓ1 loss is used to prevent vanishing gradients and yields better practical results than KL divergence.
  • Adversarial Query Generation: A generator synthesizes images that maximize disagreement while the student learns to match the victim’s predictions.This creates an adversarial game in which the generator produces difficult examples for the student.
  • Black-Box Optimization: Black-box victim access prevents direct backpropagation, so DFME approximates gradients through oracle interactions using zeroth-order optimization.Gradients are approximated with respect to input images and back-propagated through the generator to reduce query dimensionality.
  • Optimization Procedure: The attack alternates generator and student training, repeating each phase n_G and n_S times before proceeding to the next epoch.The balance between n_G and n_S affects generator difficulty and query efficiency and requires tuning.
  • Loss Function: KL divergence can suffer from vanishing gradients as the student approaches the victim, hindering generator training.The paper identifies this behavior as a convergence problem and evaluates it empirically.

5. Experimental Validation

DFME is evaluated on SVHN and CIFAR-10 with ResNet-34-8x victims and a ResNet-18-8x student. It reaches high normalized accuracy under finite query budgets, while the study notes that hyperparameter-tuning costs are excluded.

  • CIFAR-10 Results: 88.1% accuracy, or 0.92x the target, is achieved on CIFAR-10 with Q = 20M.With Q = 30M, accuracy reaches 89.9%, or 0.94x the target.
  • Comparative Results: DFME accuracy exceeds the reported accuracy of concurrent work MAZE, which reached 45.6%, or 0.48x the target, in the authors’ reproduction.The paper also reports that MAZE could not learn with extremely few gradient directions on CIFAR-10, whereas weak approximations benefited DFME’s query budget.
  • SVHN Results: 95.2% accuracy, or 0.99x the target, is achieved on SVHN with 2M queries.The victim uses a ResNet-34-8x architecture, while the student uses ResNet-18-8x.
  • Evaluation Scope: The reported query budgets exclude hyperparameter-tuning costs.Preliminary experiments suggest extraction accuracy can be sensitive to hyperparameter choices.

6. Ablation Studies

The ablations examine loss choice, gradient approximation, and logit recovery under black-box access. They find that ℓ1 disagreement, weak gradient estimates, and mean-corrected logits support effective extraction while trading query efficiency against gradient accuracy.

  • 6.1. Choice of Loss Function: ℓ1 logit disagreement improves convergence and stability over KL divergence in data-free model extraction.On CIFAR10, normalized test accuracy rises from 76.7% with KL divergence to 88.1% with ℓ1 loss at 20M queries.
  • 6.1. Choice of Loss Function: KL divergence gradients vanish more strongly than ℓ1 gradients as the student approaches the victim, reducing the signal available to train the generator.The authors hypothesize that this gradient decay causes the degraded accuracy observed with KL divergence.
  • 6.2. Gradient Approximation: m = 1 and m = 10 allocate 71% and 31% of queries to directly train the student, respectively, yet m = 10 achieves comparable accuracy.Lower m values reach 85% CIFAR10 accuracy in fewer queries, reflecting a trade-off between gradient-estimate quality and student-training budget.
  • 6.2. Gradient Approximation: Randomly flipping the m = 1 gradient direction prevents CIFAR10 student accuracy from exceeding 20%, showing that even weak estimates require the correct ascent direction.With m = 1, the approximate gradient has low cosine similarity with the true gradient but remains positively aligned with it.
  • 6.3. Logit Access: Mean-corrected log-probabilities approximate victim logits sufficiently for extraction, whereas plain log-probabilities produce errors comparable to the logits themselves.The correction works because the true-logit mean is nearly zero, making mean subtraction equivalent to removing the additive probability-to-logit constant.

7. Conclusions

The paper concludes that data-free model extraction is practical and can produce accurate copies of victim models. It identifies detection of extraction queries without reducing legitimate utility as a future direction.

  • 7. Conclusions: Data-free model extraction yields accurate copies of victim models and therefore represents a credible threat to model intellectual property.The authors suggest detecting extraction queries without decreasing utility for legitimate users.

A. How Hard is it to Find a Surrogate Dataset?

Existing extraction attacks depend strongly on surrogate-data similarity, especially for complex victim tasks. The section characterizes dataset mismatch and motivates data-free extraction when suitable surrogate data is costly or unavailable.

  • A. How Hard is it to Find a Surrogate Dataset?: Surrogate-based extraction requires query samples from a distribution close to the victim’s proprietary training distribution.The paper identifies differences in input domain, marginal input distribution, and class-conditional distributions as forms of mismatch.
  • A. How Hard is it to Find a Surrogate Dataset?: Model-extraction APIs typically expose class probabilities rather than logits, creating a need to recover approximate logits for black-box attacks.The paper notes that temperature scaling can make probability outputs more informative in distillation settings.
  • A. How Hard is it to Find a Surrogate Dataset?: Surrogate and victim datasets can differ in input feature space, marginal input distribution, or class-conditional distribution.These cases correspond respectively to domain mismatch, semantic or marginal-distribution mismatch, and class imbalance.

A.2. Experimental Setting

The experiments compare extraction across surrogate datasets for CIFAR10 and SVHN, with distinct dataset adaptations and query caps. Results show that source similarity matters greatly for CIFAR10, whereas SVHN is comparatively easy to extract even from mismatched or random inputs.

  • A.2. Experimental Setting: The experiments train CIFAR10 students for 100 epochs and SVHN students for 50 epochs while evaluating cyclic and step-decay learning schedules.The temperature coefficient search uses τ ∈ {1, 3, 5, 10} with SGD.
  • A.2. Experimental Setting: CIFAR10 extraction uses CIFAR10, CIFAR100, SVHN, and MNIST surrogates, while SVHN extraction uses SVHN, SVHNskew, MNIST, and CIFAR10 surrogates.Each comparison caps the maximum number of distinct queried samples at 50,000.
  • A.2. Experimental Setting: 93.5% versus 95.5%: an identical CIFAR10 source distribution produces an extracted model close to the victim’s accuracy.The experiments also include completely random queries as a control.
  • A.2. Experimental Setting: Over 84% SVHN accuracy is achieved even with completely random inputs, and nearly all surrogate datasets exceed 90%.The authors associate this relative ease with the simpler digit-classification task and less complex underlying representations.
  • A.2. Experimental Setting: Model-extraction success depends on victim-task complexity and source-domain similarity, with weaker or non-task-specific surrogates trading lower cost for lower accuracy.This conclusion frames the experimental results across CIFAR10 and SVHN.

B. Recovering logits from probabilities

The method recovers approximate victim logits from black-box probability outputs by taking log-probabilities and removing their per-image mean. This enables the ℓ1 disagreement loss despite the unknown additive logit constant.

  • The ℓ1 loss requires individual victim logits, but black-box access exposes only post-softmax class probabilities.Log-probabilities recover logits only up to an unknown image-dependent additive constant.
  • Approximate logits are computed by taking the logarithm of the probability vector and subtracting its own mean.
  • Mean subtraction cancels the unknown additive constant because the mean log-probability equals the mean true logits plus that constant.
  • The authors provide empirical evidence that the recovered logits closely approximate the true logits because mean true-logit values are negligible relative to logit values.
  • Four generated CIFAR-10 images near the attack’s end showed no similarities to the original training images.

D.1. Preliminary results

The preliminary analysis establishes spectral properties of the softmax Jacobian: its eigenvalues lie in [0, 1], and it becomes closely related across student and victim models as their outputs converge.

  • The softmax Jacobian is real-valued symmetric and therefore admits an eigen-decomposition with real eigenvalues.
  • All eigenvalues of the softmax Jacobian are nonnegative.
  • The eigenvalues of the softmax Jacobian lie in the interval [0, 1].
  • The eigen-decomposition lets the analysis bound the norm of the Jacobian applied to an arbitrary vector Z using eigenvalues with absolute value at most 1.
  • As the student output S converges to the victim output V, the residual matrix ϵ̄(x) converges to the null matrix.

D.2. Justification of the hypothesis.

The hypothesis predicts that, as student outputs converge to victim outputs, input gradients of KL divergence become smaller than those of the ℓ1 loss. The analysis supports this comparison asymptotically but notes that a rigorous proof needs additional assumptions.

  • Hypothesis 1 states that KL-divergence input gradients should be smaller than ℓ1-loss gradients as student outputs converge to victim outputs.
  • The proof computes gradients for both the ℓ1 norm loss and the KL divergence loss under convergence of S to V.
  • Each term in the KL-divergence gradient is expected to be negligible relative to its counterpart in the ℓ1 gradient.
  • Summing the terms suggests that KL-divergence gradients are smaller in magnitude than ℓ1 gradients.
  • A rigorous proof remains unavailable without further assumptions about the data distribution or how the student output converges.
Loading 2011.14779v2…