ES Attack: Model Stealing Against Deep Neural Networks Without Data Hurdles
Document Type
Article
Publication Date
3-3-2022
Department
College of Computing; Department of Electrical and Computer Engineering
Abstract
Deep neural networks (DNNs) have become the essential components for various commercialized machine learning services, such as Machine Learning as a Service (MLaaS). Recent studies show that machine learning services face severe privacy threats - well-trained DNNs owned by MLaaS providers can be stolen through public APIs, namely model stealing attacks. However, most existing works undervalued the impact of such attacks, where a successful attack has to acquire confidential training data or auxiliary data regarding the victim DNN. In this paper, we propose ES Attack, a novel model stealing attack without any data hurdles. By using heuristically generated synthetic data, ES Attack iteratively trains a substitute model and eventually achieves a functionally equivalent copy of the victim DNN. The experimental results reveal the severity of ES Attack: i) ES Attack successfully steals the victim model without data hurdles, and ES Attack even outperforms most existing model stealing attacks using auxiliary data in terms of model accuracy; ii) most countermeasures are ineffective in defending ES Attack; iii) ES Attack facilitates further attacks relying on the stolen model.
Publication Title
IEEE Transactions on Emerging Topics in Computational Intelligence
Recommended Citation
Yuan, X.,
Ding, L.,
Zhang, L.,
Li, X.,
&
Wu, D.
(2022).
ES Attack: Model Stealing Against Deep Neural Networks Without Data Hurdles.
IEEE Transactions on Emerging Topics in Computational Intelligence, 1-13.
http://doi.org/10.1109/TETCI.2022.3147508
Retrieved from: https://digitalcommons.mtu.edu/michigantech-p/15854