2019

A framework for the extraction of Deep Neural Networks by leveraging public data

Pal, Soham, Gupta, Yash, Shukla, Aditya et al.

Understand

Machine learning models trained on confidential datasets are increasingly being deployed for profit.

Machine Learning as a Service (MLaaS) has made such models easily accessible to end-users.
Prior work has developed model extraction attacks, in which an adversary extracts an approximation of MLaaS models by making black-box queries to it.
However, none of these works is able to satisfy all the three essential criteria for practical model extraction: (1) the ability to work on deep learning models, (2) the non-requirement of domain knowledge and (3) the ability to work with a limited query budget.

Built on

A sequential algorithm for training text classifiers
David D. Lewis and William A. Gale · 1994
Earlier work this paper cites.
Gradient-based learning applied to document recognition
Yann LeCun, Léon Bottou, Yoshua Bengio, Patrick Haffner, et al · 1998
Earlier work this paper cites.
Learning question classifiers
Xin Li and Dan Roth · 2002
Earlier work this paper cites.
Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales
Bo Pang and Lillian Lee · 2005
Earlier work this paper cites.
Active learning literature survey
Burr Settles · 2009
Earlier work this paper cites.
Learning multiple layers of features from tiny images
Alex Krizhevsky and Geoffrey Hinton · 2009
Earlier work this paper cites.
Learning word vectors for sentiment analysis
Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng, and Christopher Potts · 2011
Earlier work this paper cites.
Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition
Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel · 2012
Earlier work this paper cites.
Efficient estimation of word representations in vector space
Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean · 2013
Earlier work this paper cites.
Explaining and harnessing adversarial examples
Original
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy · 2014
Earlier work this paper cites.
Convolutional neural networks for sentence classification
Yoon Kim · 2014
Earlier work this paper cites.
Deep neural networks are easily fooled: High confidence predictions for unrecognizable images
Anh Nguyen, Jason Yosinski, and Jeff Clune · 2015
Earlier work this paper cites.
Model inversion attacks that exploit confidence information and basic countermeasures
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart · 2015
Earlier work this paper cites.
Deep learning
Yann LeCun, Yoshua Bengio, and Geoffrey Hinton · 2015
Earlier work this paper cites.
ImageNet Large Scale Visual Recognition Challenge
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei · 2015
Earlier work this paper cites.
Adam: A method for stochastic optimization
Original
Diederik Kingma and Jimmy Ba · 2015
Earlier work this paper cites.

Similar

The limitations of deep learning in adversarial settings
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami · 2016
Cited alongside, same era.
DeepFool: a simple and accurate method to fool deep neural networks
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard · 2016
Cited alongside, same era.
Stealing machine learning models via prediction APIs
Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart · 2016
Cited alongside, same era.
Towards evaluating the robustness of neural networks
Nicholas Carlini and David Wagner · 2017
Cited alongside, same era.
Practical black-box attacks against machine learning
Nicolas Papernot, Patrick D. McDaniel, Ian J. Goodfellow, Somesh Jha, Z. Berkay Celik, and Ananthram Swami · 2017
Cited alongside, same era.
Interpretability via model extraction
Osbert Bastani, Carolyn Kim, and Hamsa Bastani · 2017
Cited alongside, same era.
Deep learning-based large-scale automatic satellite crosswalk classification
Rodrigo F. Berriel, André Teixeira Lopes, Alberto F. de Souza, and Thiago Oliveira-Santos · 2017
Cited alongside, same era.
Fashion-MNIST: a novel image dataset for benchmarking machine learning algorithms
Original
Han Xiao, Kashif Rasul, and Roland Vollgraf · 2017
Cited alongside, same era.
A downsampled variant of ImageNet as an alternative to the CIFAR datasets
Original
Patryk Chrabaszcz, Ilya Loshchilov, and Frank Hutter · 2017
Cited alongside, same era.
Pointer sentinel mixture models
Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher · 2017
Cited alongside, same era.
How to steal a machine learning classifier with deep learning
Yi Shi, Yalin E. Sagduyu, and Alexander Grushin · 2017
Cited alongside, same era.
Fraternal twins: Unifying attacks on machine learning and digital watermarking
Original
Erwin Quiring, Daniel Arp, and Konrad Rieck · 2017
Cited alongside, same era.

Then

Stealing neural networks via timing side channels
Original
Vasisht Duddu, Debasis Samanta, D. Vijay Rao, and Valentina E. Balas · 2018
Later among the works it cites.
Cache telepathy: Leveraging shared resource attacks to learn DNN architectures
Original
Mengjia Yan, Christopher Fletcher, and Josep Torrellas · 2018
Later among the works it cites.
Security analysis of deep neural networks operating in the presence of cache side-channel attacks
Original
Sanghyun Hong, Michael Davinroy, Yiǧitcan Kaya, Stuart Nevans Locke, Ian Rackow, Kevin Kulda, Dana Dachman-Soled, and Tudor Dumitraş · 2018
Later among the works it cites.
Active learning for convolutional neural networks: A core-set approach
Ozan Sener and Silvio Savarese · 2018
Later among the works it cites.
Data driven exploratory attacks on black box classifiers in adversarial domains
Tegjyot Singh Sethi and Mehmed M. Kantardzic · 2018
Later among the works it cites.
Exploring connections between active learning and model extraction
Original
Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan · 2018
Later among the works it cites.
Active deep learning attacks under strict rate limitations for online API calls
Yi Shi, Yalin E. Sagduyu, Kemal Davaslioglu, and Jason H. Li · 2018
Later among the works it cites.
Generative adversarial networks for black-box API attacks with limited training data
Yi Shi, Yalin E. Sagduyu, Kemal Davaslioglu, and Jason H. Li · 2018
Later among the works it cites.
Defending against model stealing attacks using deceptive perturbations
Original
Taesung Lee, Benjamin Edwards, Ian Molloy, and Dong Su · 2018
Later among the works it cites.
MLCapsule: Guarded offline deployment of machine learning as a service
Original
Lucjan Hanzlik, Yang Zhang, Kathrin Grosse, Ahmed Salem, Max Augustin, Michael Backes, and Mario Fritz · 2018
Later among the works it cites.
DeepObfuscation: Securing the structure of convolutional neural networks via knowledge distillation
Original
Hui Xu, Yuxin Su, Zirui Zhao, Yangfan Zhou, Michael R Lyu, and Irwin King · 2018
Later among the works it cites.
Model extraction warning in MLaaS paradigm
Manish Kesarwani, Bhaskar Mukhoty, Vijay Arya, and Sameep Mehta · 2018
Later among the works it cites.
Adversarial examples: Attacks and defenses for deep learning
Xiaoyong Yuan, Pan He, Qile Zhu, Rajendra Rana Bhat, and Xiaolin Li · 2019
Closest in time.
One pixel attack for fooling deep neural networks
Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai · 2019
Closest in time.
Neural network model extraction attacks in edge devices by hearing architectural hints
Original
Xing Hu, Ling Liang, Lei Deng, Shuangchen Li, Xinfeng Xie, Yu Ji, Yufei Ding, Chang Liu, Timothy Sherwood, and Yuan Xie · 2019
Closest in time.
PRADA: Protecting against DNN model stealing attacks
Mika Juuti, Sebastian Szyller, Alexey Dmitrenko, Samuel Marchal, and N. Asokan · 2019
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…