MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AI

Abstract

The advance of explainable artificial intelligence, which provides reasons for its predictions, is expected to accelerate the use of deep neural networks in the real world like Machine Learning as a Service (MLaaS) that returns predictions on queried data with the trained model. Deep neural networks deployed in MLaaS face the threat of model extraction attacks. A model extraction attack is an attack to violate intellectual property and privacy in which an adversary steals trained models in a cloud using only their predictions. In particular, a data-free model extraction attack has been proposed recently and is more critical. In this attack, an adversary uses a generative model instead of preparing input data. The feasibility of this attack, however, needs to be studied since it requires more queries than that with surrogate datasets. In this paper, we propose MEGEX, a data-free model extraction attack against a gradient-based explainable AI. In this method, an adversary uses the explanations to train the generative model and reduces the number of queries to steal the model. Our experiments show that our proposed method reconstructs high-accuracy models -0.97× and 0.98× the victim model accuracy on SVHN and CIFAR-10 datasets given 2M and 20M queries, respectively. This implies that there is a trade-off between the interpretability of models and the difficulty of stealing them.1 https://cloud.google.com/explainable-ai Preprint. Under review.

Membership Inference Attacks Against Sequential Recommender Systems

“…Unlike adversarial attacks [14,19,42], which try to undermine the performance and credibility of the target model, privacy attacks aim to violate the target model's privacy by abusing its permissions. Model stealing attack [43,67,72,88], which steals various components of a black-box machine learning(ML) model(e.g. hyperparameters [75], architecture [46]), is one of the most common privacy attacks.…”

“…For instance, Zhang et al [44] proposes to use randomized recommendation lists to resist membership inference attacks on recommender systems. Model stealing attack [14,20,32,33] aims to steal internal information of the target model, including hyperparameters [34], architecture [23], etc. Model stealing attacks can also be used to realize functional stealing attacks [11,14,24], which means building a clone model to imitate the predictions of the target model.…”

“…These methods pose serious threats to the security of recommender systems from the perspective of data privacy. However, there is still a lack of relevant research on the model privacy leakage threats faced by recommender systems, such as model stealing attacks [20,32,33]. Model stealing attacks seek to obtain a good copy of the target model, namely the clone model.…”

Explainable artificial intelligence for cybersecurity: a literature survey

“…Miura et al [84] proposed a data-free model extraction (DFME) attack called MEGEX. The objective of that study was to clone a model without the initial dataset using both the prediction and explanation of the results.…”

From the Editors and Nguyen Tat Thanh University

“…for each feature 𝑖. A high partial differential value indicates that a pixel significantly affects the prediction, and analysing the map these values (so-called gradient map) can explain a model's decision-making [125]. Shrikumar et al [168] suggest enhancing numerical explanations by using the input feature value multiplied by the gradient, 𝜙 𝑖 (𝑥) = 𝑥 𝑖 × 𝜕𝑓 𝜕𝑥 𝑖 (𝑥).…”