论文标题
ES攻击：模型窃取没有数据障碍的深度神经网络
ES Attack: Model Stealing against Deep Neural Networks without Data Hurdles
论文作者
论文摘要
深度神经网络（DNN）已成为各种商业化机器学习服务的重要组成部分，例如机器学习为服务（MLAAS）。最近的研究表明，机器学习服务面临着严重的隐私威胁 - MLAAS提供者拥有的训练有素的DNN可以通过公共API偷走，即模型窃取攻击。但是，大多数现有作品都低估了此类攻击的影响，在这种攻击中，成功的攻击必须获得有关受害者DNN的机密培训数据或辅助数据。在本文中，我们提出了ES Attack，这是一种新颖的模型窃取攻击而没有任何数据障碍。通过使用启发式生成的合成数据，ES攻击迭代训练替代模型，并最终获得了受害者DNN的功能等效副本。实验结果揭示了ES攻击的严重性：I）ES攻击成功地窃取了受害者模型而没有数据障碍，并且在模型准确性方面，使用辅助数据超过了大多数现有的模型窃取攻击； ii）大多数对策在捍卫ES攻击方面无效； iii）ES攻击有助于依靠被盗模型的进一步攻击。
Deep neural networks (DNNs) have become the essential components for various commercialized machine learning services, such as Machine Learning as a Service (MLaaS). Recent studies show that machine learning services face severe privacy threats - well-trained DNNs owned by MLaaS providers can be stolen through public APIs, namely model stealing attacks. However, most existing works undervalued the impact of such attacks, where a successful attack has to acquire confidential training data or auxiliary data regarding the victim DNN. In this paper, we propose ES Attack, a novel model stealing attack without any data hurdles. By using heuristically generated synthetic data, ES Attack iteratively trains a substitute model and eventually achieves a functionally equivalent copy of the victim DNN. The experimental results reveal the severity of ES Attack: i) ES Attack successfully steals the victim model without data hurdles, and ES Attack even outperforms most existing model stealing attacks using auxiliary data in terms of model accuracy; ii) most countermeasures are ineffective in defending ES Attack; iii) ES Attack facilitates further attacks relying on the stolen model.
