2016 StealingMachineLearningModelsvi
- (Tramer et al., 2016) ⇒ Florian Tramer, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. (2016). “Stealing Machine Learning Models via Prediction APIs.” In: Proceedings of the 25th USENIX Security Symposium. ISBN:978-1-931971-32-4. arXiv:1609.02943
Subject Headings: Machine Learning Model; Machine Learning Model Deployment System; Machine Learning Platform; Software Deployment Task
Notes
Cited By
Quotes
Abstract
Machine learning (ML) models may be deemed confidential due to their sensitive training data, commercial value, or use in security applications. Increasingly often, confidential ML models are being deployed with publicly accessible query interfaces. ML-as-a-service ("predictive analytics") systems are an example: Some allow users to train models on potentially sensitive data and charge others for access on a pay-per-query basis. The tension between model confidentiality and public access motivates our investigation of model extraction attacks. In such attacks, an adversary with black-box access, but no prior knowledge of an ML model's parameters or training data, aims to duplicate the functionality of (i.e., " steal ") the model. Unlike in classical learning theory settings, ML-as-a-service offerings may accept partial feature vectors as inputs and include confidence values with predictions. Given these practices, we show simple, efficient attacks that extract target ML models with near-perfect fidelity for popular model classes including logistic regression, neural networks, and decision trees. We demonstrate these attacks against the online services of BigML and Amazon Machine Learning. We further show that the natural countermeasure of omitting confidence values from model outputs still admits potentially harmful model extraction attacks. Our results highlight the need for careful ML model deployment and new model extraction countermeasures.
References
;
| Author | volume | Date Value | title | type | journal | titleUrl | doi | note | year | |
|---|---|---|---|---|---|---|---|---|---|---|
| 2016 StealingMachineLearningModelsvi | Florian Tramer Fan Zhang Ari Juels Michael K. Reiter Thomas Ristenpart | Stealing Machine Learning Models via Prediction APIs | 2016 |