Results of the summarizing process for the arXiv paper: 2302.08466v1

In this paper, the authors focus on black-box model stealing attacks where an attacker can only query a machine learning model through publicly available APIs. The goal is to design a black-box model extraction attack that uses a minimal number of queries to create an informative and distributionally equivalent replica of the target model. To achieve this, the authors first define distributionally equivalent and max-information model extraction attacks and then reduce both attacks into a variational optimization problem. The attacker solves this problem to select the most informative queries that simultaneously maximize entropy and reduce the mismatch between the target and stolen models. This leads to an active sampling-based query selection algorithm called Marich. The authors evaluate Marich on various text and image datasets, including BERT and ResNet18 models. They find that Marich is able to extract models that achieve 69-96% of the true model's accuracy using 1,070-6,950 samples from publicly available query datasets that are different from private training datasets. Models extracted by Marich yield prediction distributions that are approximately 2-4 times closer to the target's distribution compared to existing active sampling-based algorithms. Additionally, these extracted models lead to 85-95% accuracy under membership inference attacks. In related works, the authors elaborate on previous research in model extraction literature and aim to mitigate some of its limitations. They generalize three approaches for extracting models: task accuracy, fidelity, and functional equivalence model extractions using a novel definition of distributional equivalence. They also introduce a novel information-theoretic objective for model extraction which maximizes mutual information between target and extracted models over the whole data domain. Furthermore, they discuss different classes of target models such as linear models or neural networks as well as types of query feedback used in learning-based attack algorithms such as probability vectors or gradients of last layers in neural networks. Finally, they highlight different types of query datasets used in previous research such as synthetically generated samples, adversarially perturbed private datasets, and publicly available datasets. The authors use publicly available datasets in Marich to avoid restricting access to knowledge of the private dataset or any perturbed version of it.

• - The paper focuses on black-box model stealing attacks where an attacker can only query a machine learning model through publicly available APIs.
• - The authors aim to design a black-box model extraction attack that uses a minimal number of queries to create an informative and distributionally equivalent replica of the target model.
• - They define distributionally equivalent and max-information model extraction attacks and reduce both attacks into a variational optimization problem.
• - The attacker solves this problem to select the most informative queries that simultaneously maximize entropy and reduce the mismatch between the target and stolen models, leading to an active sampling-based query selection algorithm called Marich.
• - Marich is evaluated on various text and image datasets, including BERT and ResNet18 models, yielding models that achieve 69-96% of the true model's accuracy using 1,070-6,950 samples from publicly available query datasets that are different from private training datasets.
• - Extracted models by Marich lead to prediction distributions that are approximately 2-4 times closer to the target's distribution compared to existing active sampling-based algorithms.
• - Additionally, these extracted models lead to 85-95% accuracy under membership inference attacks.
• - In related works, the authors elaborate on previous research in model extraction literature and aim to mitigate some of its limitations by generalizing three approaches for extracting models: task accuracy, fidelity, and functional equivalence model extractions using a novel definition of distributional equivalence.
• - They also introduce a novel information-theoretic objective for model extraction which maximizes mutual information between target and extracted models over the whole data domain.
• - Furthermore, they discuss different classes of target models such as linear models or neural networks as well as types of query feedback used in learning-based attack algorithms such as probability vectors or gradients of last layers in neural networks.
• - Finally, they highlight different types of query datasets used in previous research such as synthetically generated samples, adversarially perturbed private datasets, and publicly available datasets. The authors use publicly available datasets in Marich to avoid restricting access to knowledge of the private dataset or any perturbed version of it.

Summary: The paper talks about how someone can steal a machine learning model without having access to it. The authors made a tool called Marich that can copy the model by asking it questions and using the answers to make a new one. They tested Marich on different models and datasets, and it worked well. They also talked about other ways people have tried to steal models before. Definitions: - Black-box model stealing attacks: when someone tries to copy a machine learning model without having access to it. - APIs: a way for different computer programs to talk to each other. - Distributionally equivalent: when two things have the same pattern or distribution of information. - Variational optimization problem: a type of math problem where you try to find the best answer from many possible options. - Active sampling-based query selection algorithm: a tool that helps choose which questions to ask in order to get the most useful information. - Membership inference attacks: when someone tries to figure out if their data was used in creating a particular machine learning model. - Fidelity: how closely something matches another thing. - Information-theoretic objective: a way of measuring how much information is shared between two things. - Neural networks: computer programs that are designed to learn from data like humans do.

Black-Box Model Stealing Attacks

"In this paper, the authors focus on black-box model stealing attacks where an attacker can only query a machine learning model through publicly available APIs. The goal is to design a black-box model extraction attack that uses a minimal number of queries to create an informative and distributionally equivalent replica of the target model. "

Reducing Attack into Variational Optimization Problem

"To achieve this, the authors first define distributionally equivalent and max-information model extraction attacks and then reduce both attacks into a variational optimization problem. The attacker solves this problem to select the most informative queries that simultaneously maximize entropy and reduce the mismatch between the target and stolen models. This leads to an active sampling-based query selection algorithm called Marich. "

Evaluating Marich on Various Text & Image Datasets

"The authors evaluate Marich on various text and image datasets, including BERT and ResNet18 models. They find that Marich is able to extract models that achieve 69-96% of the true model's accuracy using 1,070-6,950 samples from publicly available query datasets that are different from private training datasets. Models extracted by Marich yield prediction distributions that are approximately 2-4 times closer to the target's distribution compared to existing active sampling based algorithms. Additionally, these extracted models lead to 85-95% accuracy under membership inference attacks."

Previous Research in Model Extraction Literature & Mitigating Limitations

"In related works, the authors elaborate on previous research in model extraction literature and aim to mitigate some of its limitations. They generalize three approaches for extracting models: task accuracy, fidelity, and functional equivalence model extractions using a novel definition of distributional equivalence. They also introduce a novel information theoretic objective for model extraction which maximizes mutual information between target and extracted models over the whole data domain.

Types Of Query Datasets Used In Previous Research

"Finally , they highlight different types of query datasets used in previous research such as synthetically generated samples , adversarially perturbed private datasets , and publicly available datasets.