[Paper Review] A framework for the extraction of Deep Neural Networks by leveraging public data

Soham Pal, Yash Gupta+4 more|arXiv (Cornell University)|May 22, 2019

Adversarial Robustness in Machine LearningComputer Science48 references41 citations

TL;DR

The paper presents a practical DNN model extraction framework using universal thief datasets and active learning to approximate secret MLaaS models under a limited query budget.

ABSTRACT

Machine learning models trained on confidential datasets are increasingly being deployed for profit. Machine Learning as a Service (MLaaS) has made such models easily accessible to end-users. Prior work has developed model extraction attacks, in which an adversary extracts an approximation of MLaaS models by making black-box queries to it. However, none of these works is able to satisfy all the three essential criteria for practical model extraction: (1) the ability to work on deep learning models, (2) the non-requirement of domain knowledge and (3) the ability to work with a limited query budget. We design a model extraction framework that makes use of active learning and large public datasets to satisfy them. We demonstrate that it is possible to use this framework to steal deep classifiers trained on a variety of datasets from image and text domains. By querying a model via black-box access for its top prediction, our framework improves performance on an average over a uniform noise baseline by 4.70x for image tasks and 2.11x for text tasks respectively, while using only 30% (30,000 samples) of the public dataset at its disposal.

Motivation & Objective

• Motivate model privacy concerns for MLaaS and why practical extraction is a threat to secret DNNs.
• Propose a framework that leverages universal public datasets as thief data and active learning to build substitute models.
• Demonstrate that the framework can extract DNNs in image and text domains with limited queries.
• Introduce ensemble active learning strategies to improve extraction performance.

Proposed method

• Define universal thief datasets for images and text (e.g., ImageNet for vision, WikiText for NLP).
• Use pool-based active learning to select informative samples from the thief dataset for querying the secret model.
• Train a substitute model on labeled samples obtained from queried thief data, iteratively refining with additional queries.
• Employ subset selection strategies (random, uncertainty, k-center, adversarial, DFAL) to maximize information gain under budget.
• Propose an ensemble Adversarial+-kcenter strategy to combine uncertainty, diversity, and boundary-focused sampling.
• Evaluate extraction via Agreement between secret and substitute models on test sets.

Experimental results

Research questions

• RQ1 Can universal thief datasets enable deep neural network extraction without domain knowledge?
• RQ2 How does active learning influence the number of queries needed to achieve high agreement with the secret model?
• RQ3 Do universal thief datasets outperform uniform noise in model extraction for image and text tasks?
• RQ4 What is the impact of different subset selection strategies on extraction performance?
• RQ5 Does an ensemble strategy improve extraction performance over individual active learning strategies?

Key findings

• The framework achieves higher agreement than uniform-noise baselines by 4.70x (image) and 2.11x (text) on average at a 30K query budget.
• Universal thief datasets effectively substitute for domain-specific data for both vision and NLP tasks.
• Ensemble Adversarial+-kcenter strategy improves extraction performance by combining boundary-focused and diverse sampling.
• Active learning strategies substantially reduce query requirements while maintaining high agreement across multiple datasets.
• For image tasks, agreements at 30K queries range across strategies, with full-thief-data and uniform-noise baselines providing context (e.g., full thief data yields 98.81% on MNIST variant).
• The approach demonstrates practical feasibility of DNN extraction under realistic query budgets.