Data-Free Model Extraction
This work is significant for adversaries seeking to extract valuable models trained on rare or hard-to-acquire datasets, by removing the need for a surrogate dataset.
This paper proposes data-free model extraction methods that do not require a surrogate dataset, addressing a limitation in current model extraction attacks. The approach achieves high accuracy, extracting models that are 0.99x and 0.92x the victim model accuracy on SVHN and CIFAR-10 datasets, respectively, with 2M and 20M queries.
Current model extraction attacks assume that the adversary has access to a surrogate dataset with characteristics similar to the proprietary data used to train the victim model. This requirement precludes the use of existing model extraction techniques on valuable models, such as those trained on rare or hard to acquire datasets. In contrast, we propose data-free model extraction methods that do not require a surrogate dataset. Our approach adapts techniques from the area of data-free knowledge transfer for model extraction. As part of our study, we identify that the choice of loss is critical to ensuring that the extracted model is an accurate replica of the victim model. Furthermore, we address difficulties arising from the adversary's limited access to the victim model in a black-box setting. For example, we recover the model's logits from its probability predictions to approximate gradients. We find that the proposed data-free model extraction approach achieves high-accuracy with reasonable query complexity -- 0.99x and 0.92x the victim model accuracy on SVHN and CIFAR-10 datasets given 2M and 20M queries respectively.