Model Theft

Model Extraction and Protection

What is Model Extraction?
Attacks that steal ML models by querying them and training a copy, enabling intellectual property theft and attack development.

Extraction Attack Types

Query-Based Extraction
Train surrogate model on API outputs:

def extract_model(target_api, num_queries=10000):
    # Generate synthetic inputs
    synthetic_inputs = generate_inputs(num_queries)

    # Query target model
    labels = [target_api.predict(x) for x in synthetic_inputs]

    # Train surrogate
    surrogate = train_model(synthetic_inputs, labels)

    return surrogate

Side-Channel Extraction
Exploit hardware signals:
- Timing information
- Power consumption
- Cache access patterns
- Electromagnetic emissions

Protection Strategies

Query-Based Defenses

class ProtectedAPI:
    def __init__(self, model):
        self.model = model
        self.query_log = QueryLogger()

    def predict(self, x):
        # Rate limiting
        if self.query_log.is_rate_limited():
            raise RateLimitError()

        # Detection: Check for suspicious patterns
        if self.detection_model.is_extraction_attack(self.query_log):
            raise SecurityError()

        # Add noise/uncertainty
        logits = self.model(x)
        noisy_probs = add_prediction_noise(logits)

        return noisy_probs

Watermarking
Embed identifiable patterns:

def train_with_watermark(model, data, trigger_set):
    for x, y in data:
        loss = criterion(model(x), y)
        loss.backward()

    # Train on watermark trigger set
    for trigger, secret_label in trigger_set:
        loss = criterion(model(trigger), secret_label)
        loss.backward()

Fingerprinting
Create model-specific test cases:

def generate_fingerprints(model, n=100):
    # Find inputs where model behavior is distinctive
    fingerprints = []
    for _ in range(n):
        x = find_adversarial_example(model)  # Unique to this model
        fingerprints.append((x, model(x)))
    return fingerprints

def verify_ownership(suspect_model, fingerprints):
    matches = sum(
        suspect_model(x) == expected
        for x, expected in fingerprints
    )
    return matches / len(fingerprints) > threshold

Defense Comparison
| Defense | Protection | Impact on Utility |
|---------|------------|-------------------|
| Rate limiting | Detection delay | Low |
| Output perturbation | Accuracy degradation | Medium |
| Watermarking | Ownership proof | Low |
| Fingerprinting | Detection | Low |
| Differential privacy | Prevent exact copy | Medium |

Best Practices
- Layer multiple defenses
- Monitor for extraction patterns
- Log and analyze queries
- Consider legal protections (Terms of Service)
- Watermark for ownership verification