model theft
**Model Extraction and Protection**
**What is Model Extraction?**
Attacks that steal ML models by querying them and training a copy, enabling intellectual property theft and attack development.
**Extraction Attack Types**
**Query-Based Extraction**
Train surrogate model on API outputs:
```python
def extract_model(target_api, num_queries=10000):
# Generate synthetic inputs
synthetic_inputs = generate_inputs(num_queries)
# Query target model
labels = [target_api.predict(x) for x in synthetic_inputs]
# Train surrogate
surrogate = train_model(synthetic_inputs, labels)
return surrogate
```
**Side-Channel Extraction**
Exploit hardware signals:
- Timing information
- Power consumption
- Cache access patterns
- Electromagnetic emissions
**Protection Strategies**
**Query-Based Defenses**
```python
class ProtectedAPI:
def __init__(self, model):
self.model = model
self.query_log = QueryLogger()
def predict(self, x):
# Rate limiting
if self.query_log.is_rate_limited():
raise RateLimitError()
# Detection: Check for suspicious patterns
if self.detection_model.is_extraction_attack(self.query_log):
raise SecurityError()
# Add noise/uncertainty
logits = self.model(x)
noisy_probs = add_prediction_noise(logits)
return noisy_probs
```
**Watermarking**
Embed identifiable patterns:
```python
def train_with_watermark(model, data, trigger_set):
for x, y in data:
loss = criterion(model(x), y)
loss.backward()
# Train on watermark trigger set
for trigger, secret_label in trigger_set:
loss = criterion(model(trigger), secret_label)
loss.backward()
```
**Fingerprinting**
Create model-specific test cases:
```python
def generate_fingerprints(model, n=100):
# Find inputs where model behavior is distinctive
fingerprints = []
for _ in range(n):
x = find_adversarial_example(model) # Unique to this model
fingerprints.append((x, model(x)))
return fingerprints
def verify_ownership(suspect_model, fingerprints):
matches = sum(
suspect_model(x) == expected
for x, expected in fingerprints
)
return matches / len(fingerprints) > threshold
```
**Defense Comparison**
| Defense | Protection | Impact on Utility |
|---------|------------|-------------------|
| Rate limiting | Detection delay | Low |
| Output perturbation | Accuracy degradation | Medium |
| Watermarking | Ownership proof | Low |
| Fingerprinting | Detection | Low |
| Differential privacy | Prevent exact copy | Medium |
**Best Practices**
- Layer multiple defenses
- Monitor for extraction patterns
- Log and analyze queries
- Consider legal protections (Terms of Service)
- Watermark for ownership verification