Model Extraction Warning in MLaaS Paradigm

Abstract

Cloud vendors are increasingly offering machine learning services as part of their platform and services portfolios. These services enable the deployment of machine learning models on the cloud that are offered on a pay-per-query basis to application developers and end users. However recent work has shown that the hosted models are susceptible to extraction attacks. Adversaries may launch queries to steal the model and compromise future query payments or privacy of the training data. In this work, we present a cloudbased extraction monitor that can quantify the extraction status of models by observing the query and response streams of both individual and colluding adversarial users. We present a novel technique that uses information gain to measure the model learning rate by users with increasing number of queries. Additionally, we present an alternate technique that maintains intelligent query summaries to measure the learning rate relative to the coverage of the input feature space in the presence of collusion. Both these approaches have low computational overhead and can easily be offered as services to model owners to warn them of possible extraction attacks from adversaries. We present performance results for these approaches for decision tree models deployed on BigML MLaaS platform, using open source datasets and different adversarial attack strategies.

Protecting Decision Boundary of Machine Learning Model With Differentially Private Perturbation

“…It is a white-box attack which produces an extracted model f with the same hyperparameters and architectures as the original model f . To compare f and f , we adopt extraction rate [1], [6] to measure the proportion of matching predictions (i.e., both f and f predict the same label) in an evaluation query set. Formally,…”

“…Lee et al [27] proposed perturbations using the mechanism of reverse sigmoid to inject deceptive noises to output confidence, which preserved the validity of top and bottom rank labels. Kesarwani et al [6] monitored user-server streams to evaluate the threat level of model extraction with two strategies based on entropy and compact model summaries. The former derived information gain with a decision tree while the latter measured feature coverage of the input space partitioned by source model, both of which were highly correlated to extraction level.…”

“…However, even if the service provider completely eliminates this value in the prediction API, that is, to offer prediction label only, an adversary can still defeat this protection by issuing large number of fine-tuned queries and train a replica of the original model with great similarity [1], [3], [5]. The other countermeasure is to detect malicious extraction by monitoring feature coverage [6] or query distribution [7], and stop the service when a certain threshold is reached. However, since we cannot preclude user collusion, all queries and responses must be considered aggregately, which leads to significant false positive cases and eventually the early termination of service.…”

Securing Machine Learning in the Cloud: A Systematic Review of Cloud Machine Learning Security

“…• Exploration attacks (Sethi and Kantardzic, 2018); • Model extraction attacks (Correia-Silva et al, 2018;Kesarwani et al, 2018;Joshi and Tammana, 2019;Reith et al, 2019); • Model inversion attacks (Yang et al, 2019); • Model-reuse attacks (Ji et al, 2018); • Trojan attacks (Liu et al, 2018).…”

Simple Black-Box Adversarial Examples Generation with Very Few Queries

“…This substitute model is trained using queries issued by the attacker and their responses obtained by the target classifier as training data. Constructing substitute classifiers is known as model extraction attacks [19], [21], [22]. Although the authors of [21] do not refer to adversarial examples, subsequent research results [19], [22] discuss the relation between model extraction attacks and black-box adversarial examples generation.…”