Student Surpasses Teacher: Imitation Attack for Black-Box NLP API s (2022)

Abstract: Machine-learning-as-a-service (MLaaS) has attracted millions of users to their splendid large-scale models. Although published as black-box APIs, the valuable models behind these services are still vulnerable to imitation attacks. Recently, a series of works have demonstrated that attackers manage to steal or extract the victim models. Nonetheless, none of the previous stolen models can outperform the original black-box APIs. In this work, we conduct unsupervised domain adaptation and multi-victim ensemble to showing that attackers could potentially surpass victims, which is beyond previous understanding of model extraction. Extensive experiments on both benchmark datasets and real-world APIs validate that the imitators can succeed in outperforming the original black-box models on transferred domains. We consider our work as a milestone in the research of imitation attack, especially on NLP APIs, as the superior performance could influence the defense or even publishing strategy of API providers.

## introduction task-oriented nlp apis have received tremendous success, partly due to commercial cloud services @xcite . the enormous commercial benefit allures other companies or individual users to extract the backend decision models of these successful apis. some recent works have demonstrated that many existing nlp apis can be locally imitated or extracted @xcite @xcite , violating the intellectual property (ip) of nlp apis. equipped with recent advanced models pre-trained on large-scale corpus, it is getting easier to train a decent attack model with limited training samples retrieved from victims @xcite . ## imitation attack paradigm in this section, we first explain the problem and motivation of imitation attack (ima) under domain adaptation setting. then, we connect our ima practice with a corresponding domain adaptation theory @xcite . after that, we introduce a multi-victim ensemble methodology for ima. finally, we explain the rationality of a family of existing defense technologies under the domain adaptation theory. ## experimental results in this section, we analyze our experimental results. our experiments are designed to answer the following research questions (rqs), locally simulated experiments. we first conduct the experiments of imitation attack on local models, shown in experiments on commercial apis. we then demonstrate the vulnerability of some real-world commercial apis to our ima approach, in we attribute this to the fact that bing trans and its attack model has already achieved a decent result on law, outperforming google trans with a gap of 3% to 4%. ## discussion we consider our imitation attack approach has achieved outperforming results that challenge the current understanding of ima. as a result, api publishing strategies and defense methodologies should be converted accordingly. ## conclusion we demonstrate a powerful imitation attack paradigm which may produce better attack models that surpasses the imitated models including the real-world nlp apis via domain adaptation and ensemble. we believe such achievements would potentially influence the price decision and publishing strategies of primary nlp services. we also take the first step of grounding our new attacking approach with unsupervised domain adaptation the-ory and model ensemble. more broadly, we hope to arouse prominent concerns on security and privacy of api services in nlp applications. in future, we plan to further explore the possibility of detecting and defending the imitation attack.