ML Model Extraction Protection via Distinguisher Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models provided as a service are vulnerable to model extraction attacks, where attackers can create a near-identical copy of the model using only input and output access, leading to potential misuse and additional attacks, and existing countermeasures often require modifying the model, affecting its accuracy.
Innovation Solution
A method using a distinguisher ML model trained on a separate dataset to classify input samples as either problem domain or non-problem domain, allowing only valid problem domain samples to be processed by the original model and indicating potential extraction attacks when non-problem domain samples are detected, without modifying the original model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If model extraction countermeasures are implemented, then model security is improved, but model accuracy deteriorates
Solution Approach 1:
A distinguisher model is introduced as an intermediary component between the input data and the original model. The distinguisher classifies inputs as problem-domain or non-problem-domain, and only allows problem-domain inputs to reach the original model. This mediator protects the original model from extraction attacks while maintaining its accuracy for valid inputs.
Solution Approach 2:
The system is segmented into two separate models: the original model for processing problem-domain inputs and the distinguisher model for detecting extraction attempts. This segmentation allows the original model to maintain its accuracy for legitimate use cases while the distinguisher handles security functions.
2Reliability
If the ML model is modified to protect against extraction, then security is improved, but the complexity of the system increases
Solution Approach 1:
Instead of modifying the original model, a separate distinguisher model is introduced as an intermediary layer. This approach protects the original model from modification while adding security functionality through the distinguisher, which filters inputs before they reach the original model.
3Difficulty of detecting and measuring
If a distinguisher model is added to detect extraction attacks, then detection capability is improved, but computational resources increase
Solution Approach 1:
The distinguisher model acts as a computational intermediary that filters inputs before they reach the original model. By performing detection tasks in advance, the distinguisher reduces the computational burden on the original model during actual inference, as only validated inputs need to be processed by the more computationally intensive original model.
Data Source
AI summary
A method for protecting a first machine learning (ML) model is provided. In the method, a dataset of non-problem domain (NPD) data is selected from a large dataset using a second ML model. The second ML model classifies the large dataset into NPD classifications and PD classifications. The PD classified data is excluded. A distinguisher includes a third ML model that is trained using selected NPD data from the large dataset. The distinguisher receives input samples that are intended for the first ML model. The third ML model provides either a PD classification or NPD classification in response to receiving each input sample. An indication of a likely extraction attempt may be provided when a predetermined number of NPD classifications are provided. The method provides an efficient way to create a training dataset for a distinguisher and for protecting a ML model with the distinguisher.