Dual-Model API Protection Against Model Extraction Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting machine learning models against model extraction attacks are inadequate in potentially harmful situations where an extraction attack is suspected but not yet confirmed, leading to potential service disruption and information leakage.
Innovation Solution
Implement a method that identifies potential adversaries by analyzing query patterns and responds with a second machine learning model trained on a different dataset, thereby preventing further data extraction while maintaining service continuity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single machine learning model is used to provide service, then service quality and accuracy are maintained, but the model becomes vulnerable to model extraction attacks where adversaries can build up databases of query-response pairs to replicate the model
Solution Approach 1:
A second machine learning model trained on a different dataset is introduced as an intermediary to handle queries from identified adversaries. This mediator model provides responses without exposing the training data or internal structure of the first model, thus preventing information leakage while maintaining service continuity.
Solution Approach 2:
The service system is segmented into multiple models (first model and second model) that serve different user types. The first model serves genuine users while the second model serves identified adversaries, allowing differentiated protection strategies without compromising overall service quality.
2Reliability
If model extraction attacks are prevented by stopping service to suspected adversaries, then model protection is improved, but service disruption occurs and genuine users may be affected
Solution Approach 1:
The system dynamically switches between the first model and second model based on user identification. When an adversary is detected, the system transitions from using the first model to the second model, providing adaptive protection while maintaining service availability without static service interruption.
3Productivity
If the first machine learning model continues to serve all users, then service availability is maintained, but adversaries can successfully extract model information through repeated queries
Solution Approach 1:
Different quality levels of model responses are provided to different user groups. Genuine users receive high-quality responses from the first model, while adversaries receive responses from the second model that are sufficient for service continuity but designed to prevent effective model extraction, thus applying local quality differentiation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for use in protecting a first machine learning model that is queryable over an application programming interface, API, against an adversary querying the first machine learning model through the API in order to build up a database of query-response pairs. The method comprises: identifying (202) a user of the API as a potential adversary. In response to a query from the potential adversary, through the API, then method comprises providing (204) a response from a second machine learning model instead of the first machine learning model, wherein the first machine learning model has been trained on a first dataset and wherein the second machine learning model has been trained on a second dataset that is different to the first dataset.