Defending against Data-Free Model Extraction by Distributionally Robust Defensive Training
Data-Free Model Extraction (DFME) aims to clone a black-box model without knowing its original training data distribution, making it much easier for attackers to steal commercial models. Defense against DFME faces several challenges: (i) effectiveness; (ii) efficiency; (iii) no prior on the attacker's query data distribution and strategy. However, existing defense methods: (1) are highly computation and memory inefficient; or (2) need strong assumptions about attack data distribution; or (3) can only delay the attack or prove a model theft after the model stealing has happened. In this work, we propose a Memory and Computation efficient defense approach, named MeCo, to prevent DFME from happening while maintaining the model utility simultaneously by distributionally robust defensive training on the target victim model. Specifically, we randomize the input so that it: (1) causes a mismatch of the knowledge distillation loss for attackers; (2) disturbs the zeroth-order gradient estimation; (3) changes the label prediction for the attack query data. Therefore, the attacker can only extract misleading information from the black-box model. Extensive experiments on defending against both decision-based and score-based DFME demonstrate that MeCo can significantly reduce the effectiveness of existing DFME methods and substantially improve running efficiency.
Code (0)
등록된 구현이 없습니다.
Tasks
Knowledge DistillationModel extractionMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Defending against Data-Free Model Extraction by Distributionally Robust Defensive Training
Data-Free Model Extraction (DFME) aims to clone a black-box model without knowing its original training data distribution, making it much easier for attackers to steal commercial models. Defense against DFME faces severa…
Knowledge DistillationModel extractionDefense Against Model Extraction Attacks on Recommender Systems
The robustness of recommender systems has become a prominent topic within the research community. Numerous adversarial attacks have been proposed, but most of them rely on extensive prior knowledge, such as all the white…
Model extractionRecommendation SystemsMISLEADER: Defending against Model Extraction with Ensembles of Distilled Models
Model extraction attacks aim to replicate the functionality of a black-box model through query access, threatening the intellectual property (IP) of machine-learning-as-a-service (MLaaS) providers. Defending against such…
Bilevel OptimizationData AugmentationModel extractionNo Free Lunch for Defending Against Prefilling Attack by In-Context Learning
The security of Large Language Models (LLMs) has become an important research topic since the emergence of ChatGPT. Though there have been various effective methods to defend against jailbreak attacks, prefilling attacks…
In-Context LearningSafety AlignmentSentenceDetecting and Defending Against Adversarial Attacks on Automatic Speech Recognition via Diffusion Models
Automatic speech recognition (ASR) systems are known to be vulnerable to adversarial attacks. This paper addresses detection and defence against targeted white-box attacks on speech signals for ASR systems. While existin…
Adversarial AttackAdversarial PurificationAutomatic Speech RecognitionSpeech Recognition