Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper proposes a new framework that combines model extraction (ME) and membership inference attack methods such that, both attacks can mutually reinforce each other in the attack process, and eventually lead to efficient and effective ME and MI attacks. The experimental results show that, using the combined approach, the fidelity of the attack can be enhanced greatly compared to baseline ME attacks, while the MI in the mean time maintain relatively comparable performance compared to existing MI attacks that uses much more queries. 
strengths_and_weaknesses: The idea of combining ME and MI attack seems to be novel and interesting, and the empirical results also mostly support the claims made in the paper. Overall, I like the originality of the idea presented in this paper and the presentation is also clear. However, I also have the following concerns:
1) it is better to explain how much of a fidelity improvement is considered significant in practical applications. For example, in Table 1, the author listed the different fidelity scores when the level of training data homogeneity varies, and to me, all the fidelity scores are very high and the improvements may not be that significant. Explaining this will also help readers to better understand significance of the results.
2) I am not sure how accurate it is claim that training shadow MI model [40] requires training data of same size as the victim's training set. Their method is definitely applicable even if the shadow model training data only contains subset of the victim's training data. Therefore, this part should be stated clearly.
3) for MI attack results, it is extremely difficulty to properly compare the baseline MI attack [38] and the MExMI approach. The term "on par" is vague especially when we use "precision" and "recall" to compare them individually. Using some unified metrics such as F1-score, AUC scores or simply the MI accuracy might give us better pictures. Note that, MexMI does not have to outperform existing MI attacks that require significantly more resources. 
4) the baseline methods for both ME and MI attacks might not be sufficient. For example, the MI attack [40] is also not included in the paper for baseline comparisons. In general, I believe the authors can first compare MExMI against various existing baselines and then do an ablation study on the impact of each module in MExMI.  
questions: The weakness part in the review lists up the requested changes and clarifications. An additional question for the authors is: (ME and MI attacks are not in my area) are the considered baselines in this paper reflect the state-of-the-art? It seems the adopted ones in this paper are rather "old", considering how hot the area is.  
limitations: The limitations of the paper and the possible ways of improvements are outlined in the weakness section.
review_title: null

final_score: rating: 7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
review_content: summary: In this paper, the authors show that ME and MI can reinforce
each other through a chained and iterative reaction, which can significantly boost
ME attack accuracy and improve MI by saving the query cost.Al
strengths_and_weaknesses: Pros:

Paper is well organized

Paper is written in Good English


Cons:

Related work should be moved to the beginning

Methodology and algorithmic content is missing

Text in Figures is small (graphs)
questions: Why are there so many references?
limitations: N/A
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: This paper proposes a new pool-based active model extraction (PAME) attack. The key observation is that in PAME, the data pool that the attacker has access to may be different from the data samples used to train the model, which can hurt attack performance. Based on this observation, the paper proposes an iterative attack framework where a membership inference (MI) attack is utilized to identify training samples in the data pool, which is used to improve the extracted model through active learning. In turn, the extracted model can be used to improve the accuracy of membership inference. It is shown through experiments that MExMI outperforms ActiveThief [33], a PAME attack, in terms of model fidelity and obtains similar MI performance as an existing MI attack [38] that has an unlimited query budget. 
strengths_and_weaknesses: Both ME and MI have been intensively studied recently. The observation that the attacker may not have access to the victim's training data in ME attacks is not new. But the idea of letting ME and MI reinforce each other is new. To achieve this, the paper has adapted shadow-model MI attacks to the setting when there is a query budget and when queried samples are not drawn from the same distribution as the victim's training samples. Although these adaptations are mainly straightforward, they are clearly explained and seem effective according to the experiment results. That being said, I have two concerns about the paper. 

First, the paper considers a relatively simple setting when no defense is applied for either ME or MI. Given that various defenses have been proposed for both attacks, it is important to understand if ME and MI can still reinforce each other effectively in the presence of defenses. In particular,  it is unclear if the adaption proposed for shadow-model MI still works in the presence of defenses against MI. Note that without defenses, ActiveThief already obtains a very good ME attack performance. Although the experiments show that MExMI can do even better, the results are not very impressive from a practice point of view. It would be much more interesting if similar results could be shown when state-of-the-art defenses are applied. 

Second, I also have some doubts about the exact role that MI plays in MExMI. According to the introduction and the example in Table 1, the MI component is used to infer training samples from the data pool and best utilize them. However, it is claimed in the experiments that MExMI does not require the data pool to contain training samples. Table 3 shows that even when the data pool does not contain any training samples, MExMI still outperforms ActiveThief, although the improvement is rather limited. Is the improvement because of MI or something else? Note that the MExMI attack becomes less useful from a practice point of view if the MI component only helps when the data pool contains a certain amount of training data, as the attacker typically has no access to true training samples in ME attacks. The proposed attack would be more useful if the MI component could help identify data samples that can best assist ME even if they are not exactly the same as training samples. 
questions: What is the ideal ME attack considered in the experiments? According to Table 2, MExMI can sometimes outperforms the ideal ME attack. How is that possible?

Table 3 shows that even when the data pool does not contain any training samples, MExMI still outperforms ActiveThief, although the improvement is rather limited. Is the improvement because of MI or something else?


limitations: It would help to briefly discuss potential defenses against the proposed attack.
review_title: null

final_score: rating: 5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
review_content: summary: In this paper, the authors propose a method to boost model extraction attacks. Specifically, they propose to use MIA (membership inference attack) to identify homogeneous samples in the adversary data pool and make full use of them to improve the effectiveness of model extraction.
strengths_and_weaknesses: Pros:

1. The authors proposed a method to boost model extraction attacks under the scenario that the attacker has no knowledge of the victim training dataset.

2. The idea of using membership attacks to boost model extraction attacks is novel.

Cons:

1. The author mentioned that the proposed attack does not require the pool to contain training samples. However, the key to the proposed attack is to use MIA (membership inference attack) to infer the victim's training data (or the distribution of the training data) and use these data to perform a model extraction attack. If the pool does not contain the victim training data, the MIA success rate will be low, and the effect of boosting model extraction boost is limited. 

2. The attack setting about the adversary pool is impractical. In practice, the adversary always cannot guarantee that the adversary data pool contains the victim training data (especially containing all the victim training data). The assumption that the victim training data accounts for 1/3 of the adversary pool is not reasonable. The attack process is more like the adversary first finds the victim training data through MIA and trains the surrogate model with it.

3 The author only considered ActiveThief as the baseline. Although the proposed method is aimed at boosting the model stealing attack based on active learning, it should also be compared with other types of model stealing attacks (such as PRADA [1], KnockoffNet [2], etc.) in query efficiency.

[1] Mika Juuti, Sebastian Szyller, Samuel Marchal, and N Asokan. Prada: protecting against dnn model stealing attacks. In Proceedings of Euro S&P, pages 512–527, 2019.
[2] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoffnets: Stealing functionality of black-box models. In Proceedings of CVPR, pages 4954–4963, 2019.

questions: Please refer to Cons.
limitations: Please refer to Cons.
review_title: null

Meta-review: metareview: This paper studies the problem of securing a model once it is published as a service. In most prior studies the focus was on either protecting the model from extraction attacks (ME) or from identifying the data used for training the model (MI). The authors propose that a simultaneous attack on both surfaces is even more powerful since the MI attack provides more information to the ME attack.

The reviewers found that this work is interesting, and results are relevant to the committee as they can highlight the need for protecting the multiple surfaces of attack against ML models. However, there is a concern about the results presented in response to the comments of reviewer LJzA: in the response, the authors reported on the result of an experiment in which a defense against MI was simulated. From the gist of the paper, one would expect that this will result in some level of protection against ME attacks too. However, the results provide only weak support to this assertion. Therefore, we think the paper should address this inconsistency. 

confidence: Less certain
Decision: Accept