Split AI Inference Output to Resist Model Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing model extraction attacks in vehicle-integrated AI systems are ineffective, as they rely on restricting API requests or detecting data distribution anomalies, which are challenging to implement in real-time environments like vehicles where input data is continuously processed and post-processing is critical.
Innovation Solution
The information processing system employs a pre-processing, model processing, and post-processing architecture that hides the prediction results by outputting intermediate feature data or altering labels and output orders, making it difficult for attackers to extract meaningful predictions from the AI model outputs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system outputs complete prediction results from the machine learning model, then the post-processing can accurately identify prediction outcomes, but the system becomes vulnerable to model extraction attacks
Solution Approach 1:
The machine learning model is divided into multiple parts, with the model processing processor executing only a portion of the model and outputting intermediate results, while the remaining part is executed by the post-processing processor. This segmentation prevents attackers from obtaining complete prediction results that could be used for model extraction attacks.
Solution Approach 2:
The system introduces an intermediary processing mechanism where the model processing processor outputs intermediate results that are then further processed by the post-processing processor. This intermediary step obscures the complete prediction logic, making it difficult for attackers to extract the full model while still enabling functional post-processing.
2Reliability
If the system executes the complete machine learning model in the model processing processor, then accurate prediction results are obtained, but the system complexity and attack surface increase
Solution Approach 1:
The machine learning model is divided into multiple parts, with the model processing processor executing only a portion of the model and outputting intermediate results, while the remaining part is executed by the post-processing processor. This segmentation prevents attackers from obtaining complete prediction results that could be used for model extraction attacks.
Solution Approach 2:
The post-processing processor not only performs its designated post-processing functions but also executes the remaining part of the machine learning model itself. This self-service approach reduces the need for complex centralized model management while maintaining security.
3Reliability
If intermediate feature data is output instead of complete prediction results, then model extraction attacks are suppressed, but the post-processing requires additional computation to identify predictions
Solution Approach 1:
The model processing processor performs preliminary processing by executing part of the machine learning model and outputting intermediate results in advance. This preliminary action is designed to balance security requirements with post-processing efficiency, reducing the computational burden on the post-processing processor while maintaining attack resistance.
Data Source
AI summary
An information processing system includes a pre-processor that obtains input data; a model processor that obtains output data by inputting the input data to part of a machine learning model, and outputs the output data; and a post-processor which obtains the output data from the model processor, and executes post-processing using the output data. The model processor obtains data indicating a feature as the output data, the data being data output from the part of the machine learning model for the input data and being obtained in the middle of the prediction performed by the data. The post-processor identifies the result of the prediction performed by the machine learning model by inputting the output data to a remaining part of the machine learning model, and executes post-processing on the result of the prediction.