Knowledge Extraction Attacks

Knowledge Extraction Attacks (Model Stealing) are attacks that create a functionally equivalent copy of a victim model by querying its API — the attacker trains a surrogate model to mimic the victim's predictions, stealing its intellectual property without direct access to model parameters or training data.

Knowledge Extraction Methods

• Query Synthesis: Generate synthetic queries designed to maximally extract information from the victim model.
• Active Learning: Use active learning strategies to minimize the number of queries needed for high-fidelity extraction.
• Knockoff Nets: Train a surrogate on a transfer dataset labeled by the victim model.
• Logit Matching: Train the surrogate to match the victim's full probability outputs (logits) for improved fidelity.

Why It Matters

• IP Theft: Expensive, proprietary models (trained on proprietary semiconductor data) can be stolen.
• Attack Enablement: The stolen surrogate model enables white-box adversarial attacks on the victim.
• Defense: Query rate limiting, watermarking, output perturbation, and PATE prevent effective extraction.

Knowledge Extraction is stealing the model through its API — querying and cloning a victim model to steal IP and enable further attacks.