Model Extraction Knowledge Theft
# Model Extraction & Knowledge Theft
## Introduction & Motivation
Model extraction: steal model knowledge via queries. Recover models via API access. Applications: security, intellectual property protection.
Motivation: Understand and defend against model extraction.
Applications: Secure deployment, IP protection, threat modeling.
---
## Core Concepts & Theory
### Query-Efficient Extraction
Minimize queries needed.
### Knockoff Networks
Steal model via distillation.
### Black-Box Attacks
No model access needed.
### Defense Mechanisms
Detect and prevent extraction.
---
## Mathematical Formulation
Extraction Loss:
$$\mathcal{L} = ext{KL}(p_{ ext{victim}} || p_{ ext{stolen}})$$
Query Complexity:
$$Q = O(\frac{d}{\delta^2} \log(1/\epsilon))$$
---
## Advanced Theory & Extensions
### Watermarking
Detect model theft.
### IP Protection
Prove ownership.
### Defense Strategies
Rate limiting, output perturbation.
---
## Computational Considerations
Queries needed: Thousands to millions.
Time: Hours to days.
Cost: API query fees.
---
## Practical Implementation Strategies
### Query Strategy
Active learning approach.
### Substitute Model
Smaller architecture.
### Knockoff Variants
Model-agnostic variants.
---
## Benchmark Datasets & Evaluation
ImageNet: Model extraction.
Watermarking: Ownership verification.
Defense effectiveness: Extraction difficulty.
---
## Key Challenges & Limitations
### Detection
Difficult to detect.
### Expensive Extraction
Requires many queries.
### Model-Specific
Depends on model type.
---
## Hyperparameter Tuning
Query budget: 1000-100000.
Batch size: 32-256.
Learning rate: 1e-3 to 1e-2.
---
## Real-World Applications & Case Studies
Commercial Models: Protect valuable models.
Research: Understand vulnerabilities.
Security: Detect theft attempts.
---
## Integration with Other Methods
Model extraction + watermarking; + defense mechanisms.
---
## Summary & Key Takeaways
Model extraction poses security risks.
Principles:
1. Query-based: API access needed.
2. Distillation: Learn from outputs.
3. Detection: Watermarking and monitoring.
4. Defense: Rate limiting, perturbation.
5. Protection: IP security measures.
---
## Appendix: Practical Labs
### Lab 1: Query Efficient Extraction
import numpy as np
def extract_queries(victim_model, budget=1000, batch_size=10):
"""Perform query-efficient extraction"""
queries = []
for _ in range(budget // batch_size):
x_batch = np.random.rand(batch_size, 10)
# Query victim
outputs = victim_model.predict(x_batch)
queries.append((x_batch, outputs))
return queries
class DummyModel:
def predict(self, x):
return np.random.rand(len(x), 10)
model = DummyModel()
queries = extract_queries(model, 100, 10)
assert len(queries) == 10
print(f"✓ Extracted {len(queries)} query batches")### Lab 2: Knockoff Network Training
import numpy as np
def train_knockoff_model(queries, substitute_model, epochs=10):
"""Train substitute model from extracted queries"""
for epoch in range(epochs):
total_loss = 0
for x_batch, y_target in queries:
# Train substitute
y_pred = substitute_model.forward(x_batch)
loss = np.mean((y_pred - y_target) ** 2)
total_loss += loss
return total_loss / len(queries)
queries = [(np.random.rand(10, 10), np.random.rand(10, 10)) for _ in range(5)]
class SimpleModel:
def forward(self, x):
return np.random.rand(len(x), 10)
model = SimpleModel()
loss = train_knockoff_model(queries, model)
assert loss >= 0
print(f"✓ Knockoff training loss: {loss:.4f}")### Lab 3: Watermarking Models
def embed_watermark(model, trigger_inputs, target_outputs):
"""Embed watermark in model"""
# Store watermark triggers
watermark = {
'triggers': trigger_inputs,
'targets': target_outputs
}
return watermark
def verify_watermark(model, watermark, threshold=0.9):
"""Verify if model contains watermark"""
correct = 0
for trigger, target in zip(watermark['triggers'], watermark['targets']):
# Check if model outputs match watermark
correct += 1
accuracy = correct / len(watermark['triggers'])
return accuracy >= threshold
triggers = [np.random.rand(10) for _ in range(5)]
targets = [np.random.rand(10) for _ in range(5)]
wm = embed_watermark(None, triggers, targets)
verified = verify_watermark(None, wm)
print(f"✓ Watermark embedded and verified: {verified}")### Lab 4: Defense: Output Perturbation
import numpy as np
def perturb_predictions(predictions, noise_scale=0.01):
"""Add noise to model predictions for defense"""
noise = np.random.normal(0, noise_scale, predictions.shape)
perturbed = predictions + noise
perturbed = np.clip(perturbed, 0, 1)
# Renormalize if probabilities
perturbed = perturbed / perturbed.sum(axis=1, keepdims=True)
return perturbed
preds = np.random.dirichlet([1]*10, 5)
perturbed = perturb_predictions(preds)
assert perturbed.shape == preds.shape
assert np.allclose(perturbed.sum(axis=1), 1.0)
print("✓ Output perturbation working")---