# Marich: A Query-efficient Distributionally Equivalent Model Extraction Attack using Public Data

**Authors:** Pratik Karmakar, Debabrota Basu  
**arXiv:** [2302.08466](https://arxiv.org/abs/2302.08466)  
**Date:** 2023-02-16  
**Summary page:** https://www.summarizepaper.com/en/paper/2302.08466v1/

## Key points

- The paper focuses on black-box model stealing attacks where an attacker can only query a machine learning model through publicly available APIs.
- The authors aim to design a black-box model extraction attack that uses a minimal number of queries to create an informative and distributionally equivalent replica of the target model.
- They define distributionally equivalent and max-information model extraction attacks and reduce both attacks into a variational optimization problem.
- The attacker solves this problem to select the most informative queries that simultaneously maximize entropy and reduce the mismatch between the target and stolen models, leading to an active sampling-based query selection algorithm called Marich.
- Marich is evaluated on various text and image datasets, including BERT and ResNet18 models, yielding models that achieve 69-96% of the true model's accuracy using 1,070-6,950 samples from publicly available query datasets that are different from private training datasets.
- Extracted models by Marich lead to prediction distributions that are approximately 2-4 times closer to the target's distribution compared to existing active sampling-based algorithms.
- Additionally, these extracted models lead to 85-95% accuracy under membership inference attacks.
- In related works, the authors elaborate on previous research in model extraction literature and aim to mitigate some of its limitations by generalizing three approaches for extracting models: task accuracy, fidelity, and functional equivalence model extractions using a novel definition of distributional equivalence.
- They also introduce a novel information-theoretic objective for model extraction which maximizes mutual information between target and extracted models over the whole data domain.
- Furthermore, they discuss different classes of target models such as linear models or neural networks as well as types of query feedback used in learning-based attack algorithms such as probability vectors or gradients of last layers in neural networks.
- Finally, they highlight different types of query datasets used in previous research such as synthetically generated samples, adversarially perturbed private datasets, and publicly available datasets. The authors use publicly available datasets in Marich to avoid restricting access to knowledge of the private dataset or any perturbed version of it.

## Summary

In this paper, the authors focus on black-box model stealing attacks where an attacker can only query a machine learning model through publicly available APIs. The goal is to design a black-box model extraction attack that uses a minimal number of queries to create an informative and distributionally equivalent replica of the target model. To achieve this, the authors first define distributionally equivalent and max-information model extraction attacks and then reduce both attacks into a variational optimization problem. The attacker solves this problem to select the most informative queries that simultaneously maximize entropy and reduce the mismatch between the target and stolen models. This leads to an active sampling-based query selection algorithm called Marich. The authors evaluate Marich on various text and image datasets, including BERT and ResNet18 models. They find that Marich is able to extract models that achieve 69-96% of the true model's accuracy using 1,070-6,950 samples from publicly available query datasets that are different from private training datasets. Models extracted by Marich yield prediction distributions that are approximately 2-4 times closer to the target's distribution compared to existing active sampling-based algorithms. Additionally, these extracted models lead to 85-95% accuracy under membership inference attacks. In related works, the authors elaborate on previous research in model extraction literature and aim to mitigate some of its limitations. They generalize three approaches for extracting models: task accuracy, fidelity, and functional equivalence model extractions using a novel definition of distributional equivalence. They also introduce a novel information-theoretic objective for model extraction which maximizes mutual information between target and extracted models over the whole data domain. Furthermore, they discuss different classes of target models such as linear models or neural networks as well as types of query feedback used in learning-based attack algorithms such as probability vectors or gradients of last layers in neural networks. Finally, they highlight different types of query datasets used in previous research such as synthetically generated samples, adversarially perturbed private datasets, and publicly available datasets. The authors use publicly available datasets in Marich to avoid restricting access to knowledge of the private dataset or any perturbed version of it.