[Paper Review] Model Extraction and Defenses on Generative Adversarial Networks

Hailong Hu, Jun Pang|arXiv (Cornell University)|Jan 6, 2021

Adversarial Robustness in Machine Learning71 references4 citations

TL;DR

This paper systematically investigates model extraction attacks on generative adversarial networks (GANs), distinguishing between accuracy extraction (matching target model's data distribution) and fidelity extraction (matching training data distribution). It demonstrates that adversaries can successfully extract high-quality GANs using ~50k queries, transfer them to new domains, and proposes effective input and output perturbation-based defenses—especially semantic interpolation and Gaussian noise—that stabilize performance and hinder extraction without sacrificing model utility.

ABSTRACT

Model extraction attacks aim to duplicate a machine learning model through query access to a target model. Early studies mainly focus on discriminative models. Despite the success, model extraction attacks against generative models are less well explored. In this paper, we systematically study the feasibility of model extraction attacks against generative adversarial networks (GANs). Specifically, we first define accuracy and fidelity on model extraction attacks against GANs. Then we study model extraction attacks against GANs from the perspective of accuracy extraction and fidelity extraction, according to the adversary's goals and background knowledge. We further conduct a case study where an adversary can transfer knowledge of the extracted model which steals a state-of-the-art GAN trained with more than 3 million images to new domains to broaden the scope of applications of model extraction attacks. Finally, we propose effective defense techniques to safeguard GANs, considering a trade-off between the utility and security of GAN models.

Motivation & Objective

• Investigate the feasibility of model extraction attacks on generative adversarial networks (GANs), which remain underexplored compared to discriminative models.
• Define and evaluate two distinct attack goals: accuracy extraction (matching target model’s generated distribution) and fidelity extraction (matching real training data distribution).
• Demonstrate that extracted GAN models can be transferred to new domains, broadening the practical impact of model extraction.
• Propose and evaluate two novel defense strategies—input perturbation (latent code manipulation) and output perturbation (sample-level noise/filtering)—to protect GANs against extraction.
• Balance model utility and security by evaluating trade-offs in defense mechanisms, particularly focusing on stability and resilience under increasing query volume.

Proposed method

• Define accuracy extraction as matching the target GAN’s generated data distribution using only query access or publicly released samples.
• Define fidelity extraction as matching the true training data distribution, requiring additional background knowledge such as partial real data or the target discriminator.
• Use Progressive GAN (PGGAN) and Spectral Normalization GAN (SNGAN) as target models for evaluation on the CelebA dataset.
• Implement input perturbation defenses via semantic interpolation of latent codes and output perturbation defenses using random noise, adversarial noise, filtering, and JPEG compression.
• Evaluate defenses under black-box accuracy extraction, where adversaries obtain samples via queries or public releases, using FID and visual quality metrics.
• Apply transfer learning to demonstrate that extracted GANs can be fine-tuned and applied to new domains, validating the attack’s broader applicability.

Experimental results

Research questions

• RQ1 Can model extraction attacks be effectively mounted against GANs, and how do they differ from attacks on discriminative models?
• RQ2 To what extent can adversaries achieve high accuracy and fidelity in extracting a GAN using only query access or public samples?
• RQ3 How does access to partial real training data or the target discriminator’s architecture improve the fidelity of extracted models?
• RQ4 Can extracted GAN models be successfully transferred to new domains, and what are the implications for model security?
• RQ5 What defense mechanisms can effectively mitigate model extraction while preserving model utility and performance?

Key findings

• Model extraction against GANs is feasible with only ~50k queries, achieving acceptable performance in matching the target model’s generated data distribution.
• Fidelity extraction significantly improves model quality when adversaries have access to partial real training data or the target discriminator, enhancing alignment with the true data distribution.
• Semantic interpolation and Gaussian noise defenses show stable performance across increasing query volumes, outperforming other defense techniques in robustness.
• Adversarial noise and filtering defenses degrade in effectiveness as query count increases, indicating vulnerability to adaptive attackers.
• Extracted GAN models can be successfully transferred to new domains after knowledge distillation, demonstrating the real-world threat surface of model extraction.
• Output perturbation-based defenses, particularly Gaussian noise and JPEG compression, reduce attack success by disrupting the statistical consistency of generated samples.