[Paper Review] Stealing Hyperparameters in Machine Learning

Binghui Wang, Neil Zhenqiang Gong|arXiv (Cornell University)|Feb 14, 2018

Adversarial Robustness in Machine Learning51 references53 citations

TL;DR

The paper introduces hyperparameter stealing attacks that infer hyperparameters used in objective functions by exploiting that learned model parameters are (near) minima, and provides a general framework with theoretical and empirical evaluation across multiple ML algorithms. It also evaluates rounding as a defense and discusses countermeasures.

ABSTRACT

Hyperparameters are critical in machine learning, as different hyperparameters often result in models with significantly different performance. Hyperparameters may be deemed confidential because of their commercial value and the confidentiality of the proprietary algorithms that the learner uses to learn them. In this work, we propose attacks on stealing the hyperparameters that are learned by a learner. We call our attacks hyperparameter stealing attacks. Our attacks are applicable to a variety of popular machine learning algorithms such as ridge regression, logistic regression, support vector machine, and neural network. We evaluate the effectiveness of our attacks both theoretically and empirically. For instance, we evaluate our attacks on Amazon Machine Learning. Our results demonstrate that our attacks can accurately steal hyperparameters. We also study countermeasures. Our results highlight the need for new defenses against our hyperparameter stealing attacks for certain machine learning algorithms.

Motivation & Objective

• Motivate the confidentiality risk of hyperparameters in ML due to cross-validation and proprietary algorithms.
• Propose a general attack framework to estimate hyperparameters from learned models.
• Show how the framework applies to linear, kernel, and some neural network settings.
• Provide theoretical guarantees and empirical evidence of attack effectiveness.
• Evaluate a rounding-based defense and discuss implications for security across algorithms.

Proposed method

• Compute the gradient of the objective function at the learned parameters and set it to zero to derive equations relating hyperparameters to model parameters.
• Form an overdetermined linear system from these equations and solve it using linear least squares to estimate the hyperparameters.
• Differentiate the approach for non-kernel vs kernel algorithms by using w or alpha vectors accordingly.
• Address nondifferentiability by using differentiable dimensions/instances to form the a and b vectors.
• Extend the framework to multiple hyperparameters by expanding the a vector into a matrix as needed.

Experimental results

Research questions

• RQ1 Can hyperparameters in the objective function be accurately recovered from learned model parameters?
• RQ2 How does the attack framework apply across linear, kernel, and certain neural network settings?
• RQ3 What are the theoretical guarantees when the learned parameters are exact or near-minima of the objective function?
• RQ4 How effective is rounding as a defense against hyperparameter stealing?
• RQ5 Do different regularization terms and loss functions affect the security properties against these attacks?

Key findings

• The attacks can exactly recover the true hyperparameter when the learned parameters are exact minima.
• When learned parameters are near a minimum, the estimation error is linearly related to their deviation.
• The framework applies to ridge, LASSO, kernel ridge, SVM variants, logistic regression, and some neural-network contexts with empirical success on real datasets.
• Rounding model parameters increases estimation error, but attacks remain effective for certain algorithms (e.g., LASSO) even with rounding.
• L2 regularization provides better security against these attacks than L1 under rounding, and some loss functions (cross-entropy, square hinge) offer improved defenses over hinge loss.
• The work emphasizes the need for new countermeasures beyond simple rounding.