MExMI: Pool-based Active Model Extraction Crossover Membership Inference
Anonymous Author(s)
AfﬁliationAddress email
Abstract
With increasing popularity of Machine Learning as a Service (MLaaS), ML modelstrained from public and proprietary data are deployed in the cloud and deliverprediction services to users.
However, as the prediction API becomes a newattack surface, growing concerns have arisen on the conﬁdentiality of ML models.
Existing literatures show their vulnerability under model extraction (ME) attacks,while their private training data is vulnerable to another type of attacks, namely,membership inference (MI).
In this paper, we show that ME and MI can reinforceeach other through a chained and iterative reaction, which can signiﬁcantly boost
ME attack accuracy and improve MI by saving the query cost.
As such, we build aframework MExMI for pool-based active model extraction (PAME) to exploit MIthrough three modules: “MI Pre-Filter”, “MI Post-Filter”, and “semi-supervisedboosting”.
Experimental results show that MExMI can improve up to 11 .
14% fromthe best known PAME attack and reach 94 .
07% ﬁdelity with only 16k queries.
Furthermore, the precision and recall of the MI attack in MExMI are on par withstate-of-the-art MI attack which needs 150k queries.
Introduction
Recent advances in machine learning (ML) has signiﬁcantly shifted the paradigm in all walks oflife.
Thanks to cloud computing, every business and individual can host black-box ML models in thecloud (e g., Microsoft Azure ML, Amazon AWS ML and Google Cloud AI) to provide pay-per-querypredictive services, known as Machine Learning as a Service (MLaaS).
Obviously, ML models areproprietary assets to the providers who spend great efforts training them.
However, by exploitingthe correspondence between queries and prediction results from an MLaaS model, an adversarycould learn the internals of that victim model to a large, or even full extent.
Such attack on model’sconﬁdentiality is known as model extraction (ME) [43].
It is a fundamental attack in adversarialmachine learning because it enables follow-up attacks such as adversarial samples [18], model evasion[7], and model inversion attacks that infer private information of the training set [15, 49].
State-of-the-art ME attacks can be categorized into direct discovery [21] and active-learning-based
ME attacks [6, 33].
Active learning (AL) refers to those semi-supervised training methods that aim toﬁnd the most informative training dataset with a limited query budget [16].
Since both AL and MEaim to train a model with as few queries as possible, AL has become increasingly popular in modelextraction attacks.
Depending on the availability of real-life samples for querying, AL-based ME canbe further divided into pool-based active model extraction (PAME) and query-synthesizing-basedactive model extraction (SAME).
The former assumes the presence of samples, from which querysamples are iteratively selected using a pool-based or stream-based AL.
Classic PAMEs include
ActiveThief [33] and Knockoff [32].
The latter does not assume the presence of such samples andobtains them by generative methods [41, 6].
Classic SAMEs include black-box DNNs [34] and
PRADA [23].
However, a critical difference between pool-based AL and pool-based ME has been long neglected.
Since pool-based AL is essentially a training method, the data pool is where training samples aredrawn, which means this pool must have the same feature distribution as the training dataset.
However,in an ME attack the adversary has no access to the victim model’s training dataset or even samples inthe same problem domain [10].
Unfortunately, all previous PAME works ignore this difference andassume the samples in the pool are homogeneous to those in the training dataset.
To demonstratehow non-homogeneous datasets can affect the ME performance, we build a Wide-ResNet-basedvictim model using the ﬁrst 25k training image samples of CIFAR10.
Then we extract this modelusing ActiveThief [33], a state-of-the-art PAME, from three adversary data pools: (1) pool A consistsof the second 25k training samples of CIFAR10, (2) pool B consists of the middle 25k trainingsamples, and (3) pool C consists of the ﬁrst 25k training samples.
In other words, the victim’s trainingset does not overlap with A (non-homogeneous) but overlaps with half of B (quasi-homogeneous),and completely with C (fully homogeneous).
Table 1 shows the ﬁdelity (i.e., similarity to the victimmodel) of the extracted copy models from A , B and C .
We observe that homogeneous samplescontributes more to the success of model extraction than non-homogeneous samples.
[Table]
In this paper, we address this issue by identifying homogeneous samples in the data pooland making full use of them for a “guided"model extraction.
We exploit membership inference (MI), an attack that infers the trainingsamples from a given dataset [40], to selectthem and train a copy model.
In turn, the extracted model can enhance the accuracy of membership inference.
As such, we propose an iterativeextraction framework MExMI where ME and MI reinforce each other through iterations.
As such,within limited query budget, the ﬁnal outcome consists of both a high-ﬁdelity copy model and anaccurate set of training samples.
There are several challenges in the design of MExMI.
First, existing MI attacks do not considerquery cost [40, 38], which is essential in ME attacks.
We exploit the training data property of thecopy model to conduct MI attacks without consuming query budget.
Second, state-of-the-art MIattacks impose assumptions that are not available in MExMI or PAME in general.
For example, ashadow-model MI requires a labelled dataset drawn from the same distribution as the model’s trainingdataset with the same size [40].
In this paper, we propose a quality metric to evaluate and optimizea shadow model without the need of a large labelled dataset.
With this technique, we adapt bothshadow-model MI and unsupervised MI [38, 47] to the MExMI framework.
Third, existing PAMEattacks fail to utilize the training samples puriﬁed from the pool.
We designed three modules tofacilitate PAME to make the most of it.
In summary, we make the following contributions:
• We propose a taxonomy (SAME/PAME) on active-learning-based model extraction attacks,and an iterative framework MExMI where PAME and MI reinforce each other.• We adapt both shadow-model MI and unsupervised MI to MExMI.
To boot-strap shadowmodel MI, we develop an indicative quality metric of shadow models and design a metricbased shadow-model training algorithm.
• We conduct extensive experiments to compare the effectiveness of MExMI with state-ofthe-art PAMEs [33].
MExMI outperforms the latter by 11 .
14% to 94 .
07% in terms of MEﬁdelity, and its MI attack achieves 84 .
13% precision, on par with the state-of-the-art MIattack [38] ( 75 . 25% ) that assumes unlimited query budget.
The rest of the paper is organized as follows.
Section 2 introduces the background and deﬁnitionsof ME and MI attacks.
Section 3 overviews the MExMI framework and its key components, and
Section 4 introduces adaptive MI algorithms for MExMI.
Section 5 presents the evaluation results of
MExMI through extensive experiments.
Section 6 reviews related works, and Section 7 concludesthis work.
Background and Deﬁnition2.1 Victim Models
Our target victim models are multi-class neural network (NN) classiﬁers, where the input domain is 90 X ⊆ R d and the output is a probability vector of classes
Y ⊆
R K .
Here d denotes dimensionality of
[Figure]
the input data, and K denotes the number of output classes.
A neural network model makes inferenceon the output class probabilities y based on the input x : y =
[Pr ( Y = 0 | x ) , . . .
, Pr ( Y = K | x )] .
Totrain such a model, we assume a supervised learning process.
1 Let D =
( x i , y i )
ni
=1 ⊆
X × Y denotethe victim’s training dataset with n labelled samples, where x i is the i -th training sample, and y i is itsone-hot format label vector.
2.2 Threat Model
We assume a well-trained black-box victim model F is deployed in a machine-learning-as-a-service(MLaaS) with a chargeable query interface.
For ease of presentation we do not consider the case whenthe victim employs anti-ME [23] or anti-MI defenses, such as perturbation on the output probabilityvector [51].
We also assume that the adversary either only has black-box access to the MLaaS model,or knows its architecture (e.g. in AWS Marketplace [1] and Huawei AI Gallery [2]).
In addition, theadversary can collect a large number of unannotated public samples to construct an adversary data
[Figure]
pool P .
[Figure]
2.3 Problem Deﬁnition
[Figure]
We assume the adversary performs ME attacks against F within a query budget b , with the aim toproduce a copy model F (cid:48) .
The main objective of ME is to let F (cid:48) approximate the victim model Fwith high degree of resemblance, a.k.a., ﬁdelity [21], which is the proportion of label agreement oftwo models on an evaluation dataset D t .
Model Extraction Crossover Membership Inference
In this section, we present our iterative model extraction framework MExMI where ME and MIreinforce each other.
An MI attack aims to distinguish those individuals ˆ D from a population Pthat exist in the victim model F ’s training dataset [40].
As illustrated in Fig.
1 and pseudocode in
Appendix A, the input of MExMI is an adversary data pool P and the access to a black-box victimmodel F , and its outputs are the copy model F (cid:48) and the inferred training dataset ˆ D .
In the ﬁrstiteration, the adversary chooses k initial seed samples [ x 1 , . . .
, x k ] 0 from P without putting themback, where k is the query budget per iteration.
These samples are fed to the victim model F , whichoutputs a probability vector F ( x ) .
Then an MI attack model F MIA is constructed using the querieddataset [ { x 1 , F ( x 1 ) } , . .
0 or the copy model (see Section 4).
F MIA is used in both MI Post-Filterand MI Pre-Filter modules.
The queried dataset is then passed through the MI Post-Filter, whichweighs them according to their probability of being a training sample of the victim model.
Then theweighted queried dataset is used to train the copy model F (cid:48) , which is then fed to the MI Pre-Filter toreﬁne the adversary data pool for AL sample selection of k queries in the next iteration.
The processis repeated until the total query budget b is depleted.
Thereafter, without consuming any query budget,
F MIA is used to launch MI attacks on F (cid:48) and the data pool to obtain the ﬁnal inferred training datasetˆ D .
This dataset will be used in a semi-supervised learning on F (cid:48) to release the ﬁnal copy model F (cid:48) .
From Fig.
1, MExMI has three key modules on top of the basic PAME iterative framework [33],namely, MI Pre-Filter, MI Post-Filter and semi-supervised boosting that will be elaborated in rest ofthis section.
As will become clear, they are orthogonal to each other, so they can be turned on or offindependently.
For ease of presentation, the construction of the MI attack model F MIA , a key issuein the MExMI framework, will be back introduced in Section 4.
3.1 MI Pre-Filter
MI Pre-Filter works before AL sample selection.
The core idea is to use an MI attack model F MIAto choose from the adversary data pool P only those samples that are highly homogeneous to thevictim’s training data D .
Training the copy model with them, both models can thus exhibit strongresemblance.
Ideally, F MIA should perform membership inference attack directly on the victimmodel F , which is truly trained from D .
However, since such training causes extra query budget on
F , F MIA attacks the copy model F (cid:48) instead as the latter exhibit similar training data property.3.2 MI Post-Filter
MI Post-Filter works after querying a sample x from the victim model.
The rationale of this ﬁlter isthat since the victim model returns the probability vectors F ( x ) , the adversary can infer if x belongsto the training dataset D by an MI atttack model F MIA .
Obviously a negative membership resultmeans this sample may not lead to a high-ﬁdelity copy model F (cid:48) , so its contribution to the trainingprocess should be lowered by reducing its weight in the training loss calculation.
We use a parameterω ( ω > 1 ) to denote the weighted loss ratio of a positive membership sample to a negative one.
3.3 Semi-Supervised Boosting
The main idea of this module is that MExMI gain the results of its MI attack— an inferred trainingdataset ˆ D of the victim model.
Although this dataset is not labelled and there is no more querybudget to label them in the end of MExMI, we can still train the copy model F (cid:48) on this datasettogether with the queried set using semi-supervised learning algorithms.
Note that this module isunique in MExMI as other PAME methods cannot distinguish training samples from others in thedata pool.
Nonetheless, this module is intended to improve model accuracy only, not ﬁdelity, becausesemi-supervised learning can divert the copy model’s ability to follow the same label distribution asthe victim model’s training data.
Therefore, MExMI only applies semi-supervised boosting afterthe ﬁnal iteration and when higher accuracy is needed .
Adaptive Membership
Inference
In MExMI an MI attack model F MIA is trained after the initial seeds query.
For MI to play a role in
MExMI framework in early stage iterations, F MIA must be accurate enough even when there areonly few samples.
In this section we renovate existing MI algorithms to be adaptive to their trainingsample sizes and thus suitable for the MExMI framework.
We focus on two state-of-the-art black-box
MI attack paradigms: (1) shadow-model MI [40, 38], and (2) unsupervised MI [38].
4.1 Shadow-Model Membership Inference
The rationale of shadow-model MI is to obtain a shadow model similar to the victim model, so thattheir output probability vectors for training and non-training samples are also distinguishable in asimilar manner.
As such, the adversary can build a binary MI classiﬁer from these samples instead offrom those of the victim model.
In order to approximate the victim model, a shadow model should(1) draw its training dataset from the same distribution as in the victim model, (2) have roughly thesame size of training set as the victim model, and (3) have the same training algorithm.
However, in
MExMI, neither (1) nor (2) holds because:
a) The queried samples may not be drawn from the same distribution as in the victim’s training
samples.b)
The number of queried samples is signiﬁcantly smaller than that of the victim’s training set size,especially in the beginning phase.
As such, the design principle of our adaptive shadow-model MI attack is to work under a limitednumber of labelled training samples in a different distribution from the victim model.
To startwith, we need to know how to estimate the quality of a shadow model so that we can tell when it isgood enough for MExMI.
Intuitively, the ﬁdelity of the shadow model against the victim model canserve as the performance indicator, but it is inaccessible from the adversary’s side, especially when
MExMI just starts.
As such, we need an easy-to-access performance metric.
4.1.1 Measuring Quality of Shadow-model MI
An MI attack works by distinguishing the output probability vector distribution Y of the victim model
F on training samples X from non-training samples.
A shadow-model MI estimates the above on ashadow model — it distinguishes the output probability vector distribution Y ( s ) of shadow models
F s on training samples X
( s ) from non-training samples.
As such, to improve the attack accuracy,
Y ( s ) should be as similar as possible to the victim
’s Y .
We measure the similarity by the bias of theexpectation values between Y ( s ) and Y , denoted by b .
For each shadow model that targets at classj ∈ [1 , . . .
, K ] , b j is formally deﬁned as:
[Equation]
where n denotes the size of training set, and the superscript ( s ) denotes the shadow model.
Thefollowing theorem shows that the gap between the training loss ∆ l is positively correlated to the biasof expectations between Y ( s ) and Y .
Therefore, it can serve as a quality measurement for F s .
We canminimize it to enhance the quality of Y ( s ) approximating Y .
Theorem 1 ( Quality measurement for shadow-model MI ).
Given a shadow model F s which hasthe same model structure and hyper-parameters as the victim model F , the gap ∆ l between thetraining loss of F s and F is positively correlated to the bias of expectations between Y ( s ) and Y , i.e.,∆ l ∝ b .
See Appendix C for the proof.
4.1.2 Metric-based Shadow-model MI
To obtain ∆ l , the gap between the training loss of both models, we need them both.
However, thevictim’s training loss is not available to the adversary.
Nonetheless, in practice a victim model isvaluable for extraction mainly because this model accurately predicts the training data, or equivalently,its training loss is smaller than other models of the same training set size.
As such, we can replace∆ l with the loss of the shadow model, denoted by l s , compensated by its training dataset size n ( s ) .
Furthermore, for the sake of comparing various shadow models, only the relative rather than theabsolute value of ∆ l is needed.
So we propose the following metric Q as a relative value of ∆ l .
Thelarger the Q , the better the quality of a shadow model.
Formally,
[Equation]
where f ( · ) is a non-negative non-linear decreasing function, and a ∈ [0 , 1] scales down the impact ofn ( s ) .
Note that Q does not require that shadows’ training data come from the same distribution as thevictim’s.
From the above equation, there are two ways to increase the quality metric Q : (1) reducing l s usinggood training algorithms on shadow models, and (2) increasing n ( s ) by augmenting the training set.
Few-shot learning (FSL), a training paradigm to improve models’ accuracy with a limited numberof examples [45], can serve both purposes.
For example, we can use FSL approaches, namely dataaugmentation [27] and transfer learning [42], to train shadow models.
This leads to two metric-basedshadow-model MIs, which are elaborated in Appendix D.
4.2 Unsupervised Membership Inference
Recent works [38, 47] have shown the effectiveness of unsupervised learning on MI attack models.
Insuch models, the feature values are usually the top- m score, loss or entropy of the output probabilities,and the output value serves as the conﬁdence of membership inference — if the value is higher thanan adversary-speciﬁed threshold c , the sample is inferred as in the training dataset and vice versa.
Toset this threshold, the adversary ﬁrst gets a set of non-member samples and then query them to getcorresponding top- m scores.
The top t percentile of these scores can serve as a threshold [38].
Tosave the query cost, the copy model instead of the victim model should be queried.
Experiment
In this section, we ﬁrst conduct experiments to validate the shadow model quality metric Q .
Thenwe evaluate the attack performance of four variants of MExMI — Pre-Filter only, Post-Filter only,
MExMI without semi-supervised boosting, and MExMI — against state-of-the-art ME and MI attacks.
5.1 Experiment Setup
Datasets .
We perform PAME attacks on two image datasets, namely CIFAR10 [26] and Street
View House Number (SVHN) [31], and a text dataset AG’S NEWS which contains corpus of AG’snews articles [11] (see Appendix E.1 for details).
Victim Model .
For the image classiﬁcation task, we use Wide-ResNet-28-10 [50] trained on
CIFAR10 as the victim model with an accuracy of 96 .
We also use a cloud MLaaS, ModelArts[3], to train an online victim model on SVHN that leads to 94 .
30% accuracy.
In the text classiﬁcationtask, we use DPCNN [22] as the victim model which achieves an accuracy of 89 . 88% .
Adversarial data pool .
In the default CIFAR10 experiments, the pool consists of 50k trainingsamples and 100k from the ImageNet32 [9].
In the default AG’S NEWS experiments, the pool has50k training samples and 100k from Dbpedia [4].
Note that as with existing pool-based ME [33],
MExMI does not require the pool to contain training samples .
The main reason for such a mixeddataset composition is for us to evaluate the performance of MI [40] and show how much it canbe enhanced by ME.
In Section 5.4, we evaluate the performance of MExMI when the pool has notraining sample at all.
5.2 Metric-based Shadow-Model MI
Implementation Details .
Recall that the hyper-parameters (such as epoch, initial learning rate, andoptimizer) of shadow models F s can be adjusted to maximize the metric Q .
Parameter a in Q is setas 0 .
05 and f ( · ) is set as − log 10 ( · ) .
The training dataset of F s , denoted by D ( s ) , is constructedby random sampling from P , and its size varies from the set { 2000 , 5000 } .
A non-training dataset,denoted by D ( s ) n , is also randomly sampled from P \ D ( s ) .
We implement two metric-based shadowmodel MI methods in Section 4: original shadow-model MI [40] and FSL shadow-model MI thatutilizes transfer learning [20] and data augmentation respectively.
(See Appendix E.5 for experimentaldetails.)
For each MI method, we vary their hyper-parameters and thus Q in various settings.
Anideal shadow-model MI is built as a reference by using the same training dataset as the victim model.
[Figure]
Results .
We plot the MI attack models’ accuracy with respect to shadow metric Q in Fig.
We observe that Q is positively correlated withthe attack accuracy of shadow-model MI andtherefore can guide the training process of theshadow models, whether using the original or
FSL training algorithms.
The recall rate of all
MI attacks is almost 100% , so it is omitted fromthe ﬁgure.
In addition, once the metric Q is largeenough ( ≥ 6 ), metric-based shadow-model MIattack models can achieve almost the same accuracy as the ideal shadow-model MI [38] even for2k samples.
5.3 Overall Performance of MExMI5.3.1 Implementation Details
We compare six PAME attacks, including four MExMI variants, namely, baseline ME without MI,
Pre-Filter only, Post-Filter only, MExMI without semi-supervised boosting, regular MExMI (whichadopts Mix-Match semi-supervised methods [5] for image classiﬁers, and consistency regularization [37] semi-supervised methods for text classiﬁers), and the ideal ME attack.
The baseline ME is
ActiveThief [33], which is the state-of-the-art PAME attack.
The ideal ME uses the real trainingsamples as its pool.
Each MExMI variant has a MI result.
In our experiments we compare our MI attacks that don’t cost additional query budget with the existing MI attacks [38] that assume inﬁnitequery budget.
The AL algorithms used are entropy uncertainty [29], greedy k-center [39] and adversarial deepfool [13] (see Appendix B for a brief explanation).
The last algorithm is not evaluated on AG’S
NEWS since there is no trivial way to adapt it to text classiﬁcation.
The copy models in MExMI sharethe same architecture as the victim models.
The MI attack model F MIA is trained on initial seedsamples.
The preset weights ratio ω in MI Post-Filter is 5 : 1 .
For CIFAR10 experiments, MExMIqueries 2k samples in each round with a total of 8 rounds.
For AG’S NEWS experiments, there are6 rounds, each with 5k samples.
All experimental results are the average measures of 5 trials.
See
Appendix E for more implementation details and Appendix F for supplementary experimental results.
5.3.2 Overall Results of MExMI
We use ﬁdelity and model’s accuracy obtained from the test datasets D t (CIFAR10 and AG’S NEWStest sets) to evaluate copy models against the victim model (see Section 2.2), and use precision andrecall of the inferred training datasets against ground truth to evaluate the MI accuracy.
Fig.
3 plots the ﬁdelity of various PAME attacks with respect to iterations on CIFAR10 and AG’S
NEWS (see more ﬁgures in Appendix F.1), respectively 4 , and Table 2 shows the ﬁnal results.
Fig.
4plots the precision and recall of the MI attack of each MExMI variant.
The results indicate that
MExMI greatly boosts the potential of AL algorithms in PAME, and breaks the curse on query budgetof existing MI.
Overall, MExMI performs the best and achieves a ﬁdelity gain of 7 .
76% , 7 . 8% , and11 .
14% on CIFAR10 over the baseline ME attack in all three AL methods.
A similar gain of 4 .
46%and 3 .
46% is observed on AG’S NEWS over the baseline PAME attacks in both two AL methods.
Without additional queries, the MI attacks of MExMI yield up to 84 .
13% precision and 75 .
93% recallon CIFAR10, and 71 .
73% precision and 82 .
53% recall on AG’S NEWS respectively, both on the parwith existing MI attacks [38] that assume inﬁnite query budgets
[Figure] [Figure]
[Figure]
Impact of MI Post-Filter and MI Pre-Filter .
In Fig.
3, on CIFAR10 attacks with MI Post-Filteralways outperform those without it, by up to a 1 .
64% increase on ﬁdelity in the ﬁnal results.
Thegain is more eminent in the beginning iterations, and then gradually decreases.
On AG’S NEWS, MI
Post-Filter also performs effectively, with a maximum boost of 1 .
57% on ﬁdelity over those withoutit.
As for MI Pre-Filter, except for the greedy k-center one in CIFAR10 experiments, attacks with
Pre-Filter always outperform those without it.
In addition, the gain does not decrease with moreiterations, because the adversary data pool is much larger than the total query budget.
Interestingly,we ﬁnd that when MI Pre-ﬁlter and MI Post-ﬁlter work together, they can achieve a greater gain onﬁdelity than the sum of individual gains when they work separately.
This suggests that the two ﬁlterstruly reinforce each other in our MExMI framework.
[Table]
Impact of Semi-Supervised Boosting .
In Fig.
3 and Table 2, MExMI outperforms MExMI withoutsemi-supervised boosting by at least 3 .
11% on CIFAR10 and 0 .
56% on AG’S NEWS in terms ofaccuracy, which indicates that MExMI does beneﬁt from effective MI attacks.
A ﬁdelity gain isobserved in MExMI since the copy models’ accuracy is closer to that of the victim model.
MI Performance in MExMI .
The precision and recall of the adaptive shadow-model MI attacks ofthree MExMI variants are shown in Fig.
MExMI always performs the best and can achieve upto 84 .
13% precision and 75 .
93% recall on CIFAR10, and 71 .
73% precision and 82 .
53% recall on
AG’S NEWS.
This precision is even better than the state-of-the-art MI — ML-leaks [38] ( 75 .
25%on CIFAR10, 65 . 37% on AG’S NEWS) which assumes unlimited query budget.
Furthermore, ouradaptive MI attacks have no additional cost when inferring training samples.
5.4 Impact of Adversary Data Pool on PAME
In this experiment, we study how the quality of adversary data pool affects the outcome of PAMEattacks.
Since there are cases where the data pool does not contain any training data, the resultsof MI attack are not evaluated.
To be fair, we ﬁx the size of the pool to 150k samples and changethe proportion of training data in it to vary its quality.
Since the total training samples are 50k, thisproportion is capped at 1 / 3 .
The results on CIFAR10 are shown in Table 3.
We can see that the quality of the data pool greatlyaffects each PAME attack.
MExMI consistently outperforms the baseline irrespective of the quality,even in the complete absence of victim’s training data, i.e., when the adversary has no access to thetrue training samples.
In such extreme case, we also observe that Pre-Filter only is outperformedby the baseline.
This is due to the fact that the Pre-Filter cannot ﬁnd any training data in the pooland thus excludes most of them for training.
Since the ﬁltered data pool is too small, active learningmight not be effective.
[Table]
5.5 Impact of Output Access
We investigate the impact of output access granted to our PAME attacks.
We limit the output accessto top-1 score and show the results on CIFAR10 in Table 4.
It indicates that even with limited outputaccess, the three modules of MExMI still perform consistently well.
Among various PAME attacks,
MExMI always performs the best and can outperform the baseline by 11 .
47% on ﬁdelity
[Table] [Table]
[Figure]
We use a real case study to show the feasibility and real-life impact of MExMI.
Wetarget at ModelArts , the MLaaS provided by
Huawei Cloud [3] where developers can trainand deploy their ML models in the cloud, andthen access them via Web API (e.g., CURL).
We train and deploy a classiﬁcation model on ModelArts without the knowledge of its architecture using
SVHN and then perform various PAME attacks on itwith VGG16.
See Appendix E.6 for more implementation details.
[Table]
The experimental results of the adversarial deep-fool
PAME are shown in Fig.
All four MExMI variantsoutperform the baseline.
MExMI achieves the highest90 .
32% ﬁdelity and MExMI without semi-supervisedboosting comes the second with 89 .
45% ﬁdelity.
Theﬁnal MI results of MExMI framework are shown in
Table 5.
We observe similar precision and recall ofthe three variants, all on the par with ML leaks [38],the state-of-the-art unsupervised MI attack that exhausts all pool data, which costs ten times higher.
Related Works
Model Extraction .
Model extraction (ME) on MLaaS models has drawn a lot of attention since
Tram ` e r, et al.
[43], mainly because it can be used for downstream attacks.
In terms of querydata availability, ME can be categorized into query-synthesizing ME and query-acquiring ME.
Theformer is used when the adversary does not possess enough real data for query, which includesiterative active frameworks [34, 23] and minimax-game frameworks [44, 24].
Despite saving the datacollection cost, it suffers from huge query budget demands.
The latter is used when the adversaryspares extra cost to actively collect real data for query [10, 21, 33, 10].
We summarize the above MEattacks in Table 6, and highlight the data pool requirement of each work and their dependency ondata selection and data synthesis.
Memership Inference .
Membership inference (MI) attacks exploit the vulnerability of MLaaSmodels’ training data property.
Existing works exploit different sources of information such asoutputs [40, 38] and model parameters [28] in either black-box or white-box setting to infer thetraining data.
More recent works focus on extending MI attacks to less favorable scenarios, forexample when the model output is label only [8, 28], and extremely low query budget.
A morecomprehensive review on model extraction and membership inference literature is in Appendix G.
[Table]
(this work)
[Table]
(cid:88)
Conclusion
In this paper, we proposed a PAME crossover MI framework called MExMI where the model andtraining data privacy can trigger a chain reaction to boost the performance of both attacks.
Theframework is generic in that it can adopt various PAME and MI attacks.
In our experiments, MExMIimproves the ﬁdelity of copy models to 94 .
07% , up from the basic PAME by 11 .
Meanwhile,the MI precision and recall rate can reach 84 .
13% and 75 .
93% without additional query budget, onpar with state-of-the-art MI attack which requires about 10 times more queries.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s contribu-
tions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes] See Section 5.4.
(c) Did you discuss any potential negative societal impacts of your work?
[Yes] See Section 1 andSection 5.6.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes] See Appendix C.
(b) Did you include complete proofs of all theoretical results?
[Yes] See Appendix C.3.
If you ran experiments
(a) Did you include the code, data, and instructions needed to reproduce the main experimental
results (either in the supplemental material or as a URL)?
[Yes] See Section 5.
(b) Did you specify all the training details (e
g., data splits, hyperparameters, how they were chosen)?
[Yes] See Section
1, Section 5.2, Section 5.3.1, Section 5.6, Appendix E.
(c) Did you report error bars (e.g., with respect to the random seed after running experimentsmultiple times)?
[Yes] See Figure 3 and Figure 8 in Appendix F.1.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs,
internal cluster, or cloud provider)?
[Yes] See Appendix E.2.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[Yes]
(c) Did you include any new assets either in the supplemental material or as a URL?
[Yes] See
Section
Did you discuss whether and how consent was obtained from people whose data you’re us-
ing/curating?
[N/A]
The data sets that I used are public.
) Did you discuss whether the data you are using/curating contains personally identiﬁable informa-
tion or offensive content?
[N/A]
crowdsourcing or conducted research with human subjects...
you describe
participant
Institutional
Board
approvals,
applicable
you include the estimated hourly wage paid to participants and the total amount spent on
participant compensation
N
A]