AI Model Replication Vulnerability Analysis With Contrastive Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional model stealing attack techniques require a large number of queries and fail to consider class imbalance, leading to high attack costs and detection risks in replicating AI-based classification models.
Innovation Solution
A vulnerability analysis method using contrastive learning that constructs a training dataset with queried and unqueried datasets, trains a clone model to minimize cross entropy, and analyzes vulnerability within a query budget, employing minority class-priority sampling and entropy-based sampling to reduce query numbers and improve clone model performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional model stealing attack techniques are used, then clone model performance can be achieved, but a very large number of queries are required which increases attack cost and detection risk
Solution Approach 1:
The patent changes the learning parameter from cross-entropy loss to contrastive loss function. This parameter change enables the model to learn from both queried and unqueried data effectively, reducing the number of queries needed while maintaining high clone model performance. The contrastive loss function allows the model to distinguish between different data distributions without requiring exhaustive queries.
Solution Approach 2:
The patent performs preliminary action by pre-processing the dataset to identify and separate queried and unqueried data points before training. This preliminary organization of data allows the contrastive learning model to efficiently utilize both types of data, reducing the overall query requirement while achieving high performance.
2Ease of manufacture
If conventional model stealing attack techniques train clone model through supervised learning, then clone model can be built, but the query process must be repeated multiple times which increases attack cost
Solution Approach 1:
The patent replaces the mechanical repeated query process with a contrastive learning approach that processes both queried and unqueried data simultaneously. This substitution eliminates the need for multiple repeated queries while maintaining training effectiveness, as the contrastive loss function naturally handles the learning process in a single pass through efficient data utilization.
3Device complexity
If conventional model stealing attack techniques do not consider class imbalance, then training process is simplified, but clone model performance is limited
Solution Approach 1:
The patent applies local quality by handling different data points (queried and unqueried) with different weights and loss functions in the contrastive learning process. This allows the model to pay special attention to minority classes and important data points while maintaining overall training efficiency, achieving high performance without excessive complexity.
Data Source
AI summary
The present disclosure relates to vulnerability analysis methods and devices for model replication of a target model, which is an artificial intelligence (AI)-based classification model, the method comprising: acquiring a queried dataset by querying a query obtained by sampling a part of a pre-prepared unqueried dataset on the target model, and training a clone model for the target model, wherein the method comprises: training the clone model in different ways according to the unqueried dataset and the dataset; further training the clone model to minimize cross entropy between a classification result of the clone model and a classification result of the target model; and analyzing the vulnerability of the model replication of the target model according to whether the clone model for the target model is generated with a query within a preset total query budget.