knowledge extraction attacks

**Knowledge Extraction Attacks** (Model Stealing) are **attacks that create a functionally equivalent copy of a victim model by querying its API** — the attacker trains a surrogate model to mimic the victim's predictions, stealing its intellectual property without direct access to model parameters or training data. **Knowledge Extraction Methods** - **Query Synthesis**: Generate synthetic queries designed to maximally extract information from the victim model. - **Active Learning**: Use active learning strategies to minimize the number of queries needed for high-fidelity extraction. - **Knockoff Nets**: Train a surrogate on a transfer dataset labeled by the victim model. - **Logit Matching**: Train the surrogate to match the victim's full probability outputs (logits) for improved fidelity. **Why It Matters** - **IP Theft**: Expensive, proprietary models (trained on proprietary semiconductor data) can be stolen. - **Attack Enablement**: The stolen surrogate model enables white-box adversarial attacks on the victim. - **Defense**: Query rate limiting, watermarking, output perturbation, and PATE prevent effective extraction. **Knowledge Extraction** is **stealing the model through its API** — querying and cloning a victim model to steal IP and enable further attacks.