Killing One Bird with Two Stones: Model Extraction and Attribute Inference Attacks against BERT-based APIs
This work addresses privacy and security risks for users and providers of machine learning as a service (MLaaS) using BERT models, though it is incremental as it builds on prior model extraction research.
The paper tackles security and privacy vulnerabilities in BERT-based APIs by developing a model extraction attack that steals the model with limited queries and an attribute inference attack that leaks sensitive training data attributes, achieving high accuracy (e.g., over 90% in some cases) and showing that existing defenses are ineffective.
The collection and availability of big data, combined with advances in pre-trained models (e.g., BERT, XLNET, etc), have revolutionized the predictive performance of modern natural language processing tasks, ranging from text classification to text generation. This allows corporations to provide machine learning as a service (MLaaS) by encapsulating fine-tuned BERT-based models as APIs. However, BERT-based APIs have exhibited a series of security and privacy vulnerabilities. For example, prior work has exploited the security issues of the BERT-based APIs through the adversarial examples crafted by the extracted model. However, the privacy leakage problems of the BERT-based APIs through the extracted model have not been well studied. On the other hand, due to the high capacity of BERT-based APIs, the fine-tuned model is easy to be overlearned, but what kind of information can be leaked from the extracted model remains unknown. In this work, we bridge this gap by first presenting an effective model extraction attack, where the adversary can practically steal a BERT-based API (the target/victim model) by only querying a limited number of queries. We further develop an effective attribute inference attack which can infer the sensitive attribute of the training data used by the BERT-based APIs. Our extensive experiments on benchmark datasets under various realistic settings validate the potential vulnerabilities of BERT-based APIs. Moreover, we demonstrate that two promising defense methods become ineffective against our attacks, which calls for more effective defense methods.