Knockoff Nets: Stealing Functionality of Black-Box Models

TL;DR

This paper demonstrates that adversaries can effectively steal the functionality of black-box machine learning models through limited queries, even without knowledge of training data or model internals, using a two-step approach involving querying and training a knockoff.

Contribution

It introduces a novel black-box model stealing method that works with minimal assumptions and shows that high-quality knockoffs can be created with few queries and different architectures.

Findings

Random queries from different distributions still produce effective knockoffs.

Different model architectures can be used to create successful knockoffs.

Reinforcement learning enhances query efficiency and performance.

Abstract

Machine Learning (ML) models are increasingly deployed in the wild to perform a wide range of tasks. In this work, we ask to what extent can an adversary steal functionality of such "victim" models based solely on blackbox interactions: image in, predictions out. In contrast to prior work, we present an adversary lacking knowledge of train/test data used by the model, its internals, and semantics over model outputs. We formulate model functionality stealing as a two-step approach: (i) querying a set of input images to the blackbox model to obtain predictions; and (ii) training a "knockoff" with queried image-prediction pairs. We make multiple remarkable observations: (a) querying random images from a different distribution than that of the blackbox training data results in a well-performing knockoff; (b) this is possible even when the knockoff is represented using a different architecture; and (c) our reinforcement learning approach additionally improves query sample efficiency in certain settings and provides performance gains. We validate model functionality stealing on a range of datasets and tasks, as well as on a popular image analysis API where we create a reasonable knockoff for as little as $30.

Tables

Table 1. Table 1 : Four victim blackboxes F V subscript 𝐹 𝑉 F_{V} . Each blackbox is named in the format: [dataset][# output classes].

Blackbox ($F_V$)	$\left|{𝒟}_V^{\text{train}}\right|+\left|{𝒟}_V^{\text{test}}\right|$	Output classes $K$
Caltech256 [12]	23.3k + 6.4k	256 general object categories
CUBS200 [47]	6k + 5.8k	200 bird species
Indoor67 [35]	14.3k + 1.3k	67 indoor scenes
Diabetic5 [1]	34.1k + 1k	5 diabetic retinopathy scales

Table 2. Table 2 : Accuracy on test sets. Accuracy of blackbox F V subscript 𝐹 𝑉 F_{V} indicated in gray and knockoffs F A subscript 𝐹 𝐴 F_{A} in black. KD = Knowledge Distillation. Closed- and open-world accuracies reported at B 𝐵 B =60k.

		random					adaptive
	$P_A$	Caltech256	CUBS200	Indoor67	Diabetic5		Caltech256	CUBS200	Indoor67	Diabetic5
	$P_V\left(F_V\right)$	78.8 (1$\times$)	76.5 (1$\times$)	74.9 (1$\times$)	58.1 (1$\times$)		-	-	-	-
	$P_V$ (KD)	82.6 (1.05$\times$)	70.3 (0.92$\times$)	74.4 (0.99$\times$)	54.3 (0.93$\times$)		-	-	-	-
Closed	$D^2$	76.6 (0.97$\times$)	68.3 (0.89$\times$)	68.3 (0.91$\times$)	48.9 (0.84$\times$)		82.7 (1.05$\times$)	74.7 (0.98$\times$)	76.3 (1.02$\times$)	48.3 (0.83$\times$)
Open	ILSVRC	75.4 (0.96$\times$)	68.0 (0.89$\times$)	66.5 (0.89$\times$)	47.7 (0.82$\times$)		76.2 (0.97$\times$)	69.7 (0.91$\times$)	69.9 (0.93$\times$)	44.6 (0.77$\times$)
	OpenImg	73.6 (0.93$\times$)	65.6 (0.86$\times$)	69.9 (0.93$\times$)	47.0 (0.81$\times$)		74.2 (0.94$\times$)	70.1 (0.92$\times$)	70.2 (0.94$\times$)	47.7 (0.82$\times$)

Table 3. Table 3 : Overlap between P A subscript 𝑃 𝐴 P_{A} and P V subscript 𝑃 𝑉 P_{V} .

	$P_V$
$P_A$	Caltech256 ($K$=256)	CUBS200 ($K$=200)	Indoor67 ($K$=67)	Diabetic5 ($K$=5)
ILSVRC ($Z$=1000)	108 (42%)	2 (1%)	10 (15%)	0 (0%)
OpenImages ($Z$=601)	114 (44%)	1 (0.5%)	4 (6%)	0 (0%)

Equations

$${\mathcal{L}}_{\text{KD}}={\lambda }_1{\mathcal{L}}_{\text{CE}}({\mathbf{y}}_{\text{true}},{\mathbf{y}}_S)+{\lambda }_2{\mathcal{L}}_{\text{CE}}({\mathbf{y}}_S^{\tau },{\mathbf{y}}_T^{\tau })$$

$${\mathbf{x}}_t\sim {\mathbb{P}}_{\pi }(\{{\mathbf{x}}_i,{\mathbf{y}}_i{\}}_{i=1}^{t-1})$$

$$H_{t+1}(z_t)$$

$$H_{t+1}(z^{\prime })$$

$$\text{vspace}-0.5em{R}^{\text{cert}}({\mathbf{y}}_t)=P({\mathbf{y}}_{t,k_1}|{\mathbf{x}}_t)-P({\mathbf{y}}_{t,k_2}|{\mathbf{x}}_t)$$

$$\text{vspace}-0.5em{R}^{\text{div}}({\mathbf{y}}_{1:t})=\sum _k\max (0,{\bar{\mathbf{y}}}_{t,k}-{\bar{\mathbf{y}}}_{t-\Delta ,k})$$

$$\text{vspace}-0.5em{R}^{\mathcal{L}}({\mathbf{y}}_t,{\hat{\mathbf{y}}}_t)=\mathcal{L}({\mathbf{y}}_t,\widehat{{\mathbf{y}}_t})$$

Full text

1 Introduction

Machine Learning (ML) models and especially deep neural networks are deployed to improve productivity or experience e.g., photo assistants in smartphones, image recognition APIs in cloud-based internet services, and for navigation and control in autonomous vehicles. Developing and engineering such models for commercial use is a product of intense time, money, and human effort – ranging from collecting a massive annotated dataset to tuning the right model for the task. The details of the dataset, exact model architecture, and hyperparameters are naturally kept confidential to protect the models’ value. However, in order to be monetized or simply serve a purpose, they are deployed in various applications (e.g., home assistants) to function as blackboxes: input in, predictions out.

Large-scale deployments of deep learning models in the wild has motivated the community to ask: can someone abuse the model solely based on blackbox access? There has been a series of “inference attacks” [40, 27, 10, 38] which try to infer properties (e.g., training data [40], architecture [27]) about the model within the blackbox. In this work, we focus on model functionality stealing: can one create a “knockoff” of the blackbox model solely based on observed input-output pairs? In contrast to previous works [45, 32, 27], we work with minimal assumptions on the blackbox and intend to purely steal the functionality.

We formulate model functionality stealing as follows (shown in Figure 1). The adversary interacts with a blackbox “victim” CNN by providing it input images and obtaining respective predictions. The resulting image-prediction pairs are used to train a “knockoff” model. The adversary’s intention is for the knockoff to compete with the victim model at the victim’s task. Note that knowledge transfer [15, 5] approaches are a special case within our formulation, where the task, train/test data, and white-box teacher (victim) model are known to the adversary.

Within this formulation, we spell out questions answered in our paper with an end-goal of model functionality stealing:

Can we train a knockoff on a random set of query images and corresponding blackbox predictions? 2. 2.

What makes for a good set of images to query? 3. 3.

How can we improve sample efficiency of queries? 4. 4.

What makes for a good knockoff architecture?

2 Related Work

Privacy, Security and Computer Vision.

Privacy has been largely addressed within the computer vision community by proposing models [31, 30, 49, 28, 42, 50] which recognize and control privacy-sensitive information in visual content. The community has also recently studied security concerns entailing real-world usage of models e.g., adversarial perturbations [26, 25, 29, 2, 34, 20] in black- and white-box attack scenarios. In this work, we focus on functionality stealing of CNNs in a blackbox attack scenario.

Model Stealing.

Stealing various attributes of a blackbox ML model has been recently gaining popularity: parameters [45], hyperparameters [48], architecture [27], information on training data [40] and decision boundaries [32]. These works lay the groundwork to precisely reproduce the blackbox model. In contrast, we investigate stealing functionality of the blackbox independent of its internals. Although two works [45, 32] are related to our task, they make relatively stronger assumptions (e.g., model family is known, victim’s data is partly available). In contrast, we present a weaker adversary.

Knowledge Distillation.

Distillation [15] and related approaches [11, 51, 6, 5] transfer the knowledge from a complex “teacher” to a simpler “student” model. Within our problem formulation, this is a special case when the adversary has strong knowledge of the victim’s blackbox model e.g., architecture, train/test data is known. Although we discuss this, a majority of the paper makes weak assumptions of the blackbox.

Active Learning.

Active Learning [44, 7] (AL) aims to reduce labeling effort while gathering data to train a model. Ours is a special case of pool-based AL [39], where the learner (adversary) chooses from a pool of unlabeled data. However, unlike AL, the learner’s image pool in our case is chosen without any knowledge of the data used by the original model. Moreover, while AL considers the image to be annotated by a human-expert, ours is annotated with pseudo-labels by the blackbox.

3 Problem Statement

We now formalize the task of functionality stealing (see also Figure 2).

Functionality Stealing.

In this paper, we introduce the task as: given blackbox query access to a “victim” model $F_{V}:\mathcal{X}\rightarrow\mathcal{Y}$, to replicate its functionality using “knockoff” model $F_{A}$ of the adversary. As shown in Figure 2, we set it up as a two-player game between a victim $V$ and an adversary $A$. Now, we discuss the assumptions in which the players operate and their corresponding moves in this game.

Victim’s Move.

The victim’s end-goal is to deploy a trained CNN model $F_{V}$ in the wild for a particular task (e.g., fine-grained bird classification). To train this particular model, the victim: (i) collects task-specific images $\bm{x}\sim P_{V}(X)$ and obtains expert annotations resulting in a dataset $\mathcal{D}_{V}=\{(\bm{x}_{i},y_{i})\}$; (ii) selects the model $F_{V}$ that achieves best performance (accuracy) on a held-out test set of images $\mathcal{D}_{V}^{\text{test}}$. The resulting model is deployed as a blackbox which predicts output probabilities $\bm{y}=F_{V}(\bm{x})$ given an image $\bm{x}$. Furthermore, we assume each prediction incurs a cost (e.g., monetary, latency).

Adversary’s Unknowns.

The adversary is presented with a blackbox CNN image classifier, which given any image $\bm{x}\in\mathcal{X}$ returns a $K$-dim posterior probability vector $\bm{y}\in[0,1]^{K},\ \sum_{k}y_{k}=1$. We relax this later by considering truncated versions of $\bm{y}$. We assume remaining aspects to be unknown: (i) the internals of $F_{V}$ e.g., hyperparameters or architecture; (ii) the data used to train and evaluate the model; and (iii) semantics over the $K$ classes.

Adversary’s Attack.

To train a knockoff, the adversary: (i) interactively queries images $\{\bm{x}_{i}\stackrel{{\scriptstyle\pi}}{{\sim}}P_{A}(X)\}$ using strategy $\pi$ to obtain a “transfer set” of images and pseudo-labels $\{(\bm{x}_{i},F_{V}(\bm{x}_{i}))\}_{i=1}^{B}$; and (ii) selects an architecture $F_{A}$ for the knockoff and trains it to mimic the behaviour of $F_{V}$ on the transfer set.

Objective.

We focus on the adversary, whose primary objective is training a knockoff that performs well on the task for which $F_{V}$ was designed i.e., on an unknown $\mathcal{D}_{V}^{\text{test}}$. In addition, we address two secondary objectives: (i) sample-efficiency: maximizing performance within a budget of $B$ blackbox queries; and (ii) understanding what makes for good images to query the blackbox.

Victim’s Defense.

Although we primarily address the adversary’s strategy in the paper, we briefly discuss victim’s counter strategies (in Section 6) of reducing informativeness of predictions by truncation e.g., rounding-off.

Remarks: Comparison to Knowledge Distillation (KD).

Training the knockoff model is reminiscent of KD approaches [15, 36], whose goal is to transfer the knowledge from a larger teacher network $T$ (white-box) to a compact student network $S$ (knockoff) via the transfer set. We illustrate key differences between KD and our setting in Figure 3: (a) Independent distribution $P_{A}$: $F_{A}$ is trained on images $\bm{x}\sim P_{A}(X)$ independent to distribution $P_{V}$ used for training $F_{V}$; (b) Data for supervision: Student network $S$ minimize variants of KD loss:

[TABLE]

where $\bm{y}^{\tau}_{T}=\text{softmax}(\bm{a}_{T}/\tau)$ is the softened posterior distribution of logits $\bm{a}$ controlled by temperature $\tau$. In contrast, the knockoff (student) in our case lacks logits $\bm{a}_{T}$ and true labels $\bm{y}_{\text{true}}$ to supervise training.

4 Generating Knockoffs

In this section, we elaborate on the adversary’s approach in two steps: transfer set construction (Section 4.1) and training knockoff $F_{A}$ (Section 4.2).

4.1 Transfer Set Construction

The goal is to obtain a transfer set i.e., image-prediction pairs, on which the knockoff will be trained to imitate the victim’s blackbox model $F_{V}$.

Selecting $P_{A}(X)$.

The adversary first selects an image distribution to sample images. We consider this to be a large discrete set of images. For instance, one of the distributions $P_{A}$ we consider is the 1.2M images of ILSVRC dataset [8].

Sampling Strategy $\pi$.

Once the image distribution $P_{A}(X)$ is chosen, the adversary samples images $\bm{x}\stackrel{{\scriptstyle\pi}}{{\sim}}P_{A}(X)$ using a strategy $\pi$. We consider two strategies.

4.1.1 Random Strategy

In this strategy, we randomly sample images (without replacement) $\bm{x}\stackrel{{\scriptstyle\text{iid}}}{{\sim}}P_{A}(X)$ to query $F_{V}$. This is an extreme case where adversary performs pure exploration. However, there is a risk that the adversary samples images irrelevant to learning the task (e.g., over-querying dog images to a birds classifier).

4.1.2 Adaptive Strategy

We now incorporate a feedback signal resulting from each image queried to the blackbox. A policy $\pi$ is learnt:

[TABLE]

to achieve two goals: (i) improving sample-efficiency of queries; and (ii) aiding interpretability of blackbox $F_{V}$. The approach is outlined in Figure 4a. At each time-step $t$, the policy module $\mathbb{P}_{\pi}$ produces a sample of images to query the blackbox. A reward signal $r_{t}$ is shaped based on multiple criteria and is used to update the policy with an end-goal of maximizing the expected reward.

Supplementing $\bm{P_{A}}$.

To encourage relevant queries, we enrich images in the adversary’s distribution by associating each image $\bm{x}_{i}$ with a label $z_{i}\in Z$. No semantic relation of these labels with the blackbox’s output classes is assumed or exploited. As an example, when $P_{A}$ corresponds to 1.2M images of the ILSVRC [8] dataset, we use labels defined over 1000 classes. These labels can be alternatively obtained by unsupervised measures e.g., clustering or estimating graph-density [9, 3]. We find using labels aids understanding blackbox functionality. Furthermore, since we expect labels $\{z_{i}\in Z\}$ to be correlated or inter-dependent, we represent them within a coarse-to-fine hierarchy, as nodes of a tree as shown in Figure 4b.

Actions.

At each time-step $t$, we sample actions from a discrete action space $z_{t}\in Z$ i.e., adversary’s independent label space. Drawing an action is a forward-pass (denoted by a blue line in Figure 4b) through the tree: at each level, we sample a node with probability $\pi_{t}(z)$ . The probabilities are determined by a softmax distribution over the node potentials: $\pi_{t}(z)=\frac{e^{H_{t}(z)}}{\sum_{z^{\prime}}H_{t}(z^{\prime})}$. Upon reaching a leaf-node, a sample of images is returned corresponding to label $z_{t}$.

Learning the Policy.

We use the received reward $r_{t}$ for an action $z_{t}$ to update the policy $\pi$ using the gradient bandit algorithm [43]. This update is equivalent to a backward-pass through the tree (denoted by a green line in Figure 4b), where the node potentials are updated as:

[TABLE]

where $\alpha=1/N(z)$ is the learning rate, $N(z)$ is the number of times action $z$ has been drawn, and $\bar{r}_{t}$ is the mean-reward over past $\Delta$ time-steps.

Rewards.

To evaluate the quality of sampled images $\bm{x}_{t}$, we study three rewards. We use a margin-based certainty measure [39, 19] to encourage images where the victim is confident (hence indicating the domain $F_{V}$ was trained on):

[TABLE]

To prevent the degenerate case of image exploitation over a single label, we introduce a diversity reward:

[TABLE]

To encourage images where the knockoff prediction $\hat{\bm{y}}_{t}=F_{A}(\bm{x}_{t})$ does not imitate $F_{V}$, we reward high loss:

[TABLE]

We sum up individual rewards when multiple measures are used. To maintain an equal weighting, each reward is individually rescaled to [0, 1] and subtracted with a baseline computed over past $\Delta$ time-steps.

4.2 Training Knockoff $F_{A}$

As a product of the previous step of interactively querying the blackbox model, we have a transfer set $\{(\bm{x}_{t},F_{V}(\bm{x}_{t})\}_{t=1}^{B},\ \bm{x}_{t}\stackrel{{\scriptstyle\pi}}{{\sim}}P_{A}(X)$. Now we address how this is used to train a knockoff $F_{A}$.

Selecting Architecture $F_{A}$.

Few works [27, 48] have recently explored reverse-engineering the blackbox i.e., identifying the architecture, hyperparameters, etc. We however argue this is orthogonal to our requirement of simply stealing the functionality. Instead, we represent $F_{A}$ with a reasonably complex architecture e.g., VGG [41] or ResNet [14]. Existing findings in KD [15, 11] and model compression [5, 13, 17] indicate robustness to choice of reasonably complex student models. We investigate the choice under weaker knowledge of the teacher ($F_{V}$) e.g., training data and architecture is unknown.

Training to Imitate.

To bootstrap learning, we begin with a pretrained Imagenet network $F_{A}$. We train the knockoff $F_{A}$ to imitate $F_{V}$ on the transfer set by minimizing the cross-entropy (CE) loss: $\mathcal{L}_{\text{CE}}(\bm{y},\hat{\bm{y}})=-\sum_{k}p(y_{k})\cdot\log p(\hat{y_{k}})$. This is a standard CE loss, albeit weighed with the confidence $p(y_{k})$ of the victim’s label. This formulation is equivalent to minimizing the KL-divergence between the victim’s and knockoff’s predictions over the transfer set.

5 Experimental Setup

We now discuss the experimental setup of multiple victim blackboxes (Section 5.1), followed by details on the adversary’s approach (Section 5.2).

5.1 Black-box Victim Models $F_{V}$

We choose four diverse image classification CNNs, addressing multiple challenges in image classification e.g., fine-grained recognition. Each CNN performs a task specific to a dataset. A summary of the blackboxes is presented in Table 1 (extended descriptions in appendix).

Training the Black-boxes.

All models are trained using a ResNet-34 architecture (with ImageNet [8] pretrained weights) on the training split of the respective datasets. We find this architecture choice achieve strong performance on all datasets at a reasonable computational cost. Models are trained using SGD with momentum (of 0.5) optimizer for 200 epochs with a base learning rate of 0.1 decayed by a factor of 0.1 every 60 epochs. We follow the train-test splits suggested by the respective authors for Caltech-256 [12], CUBS-200-2011 [47], and Indoor-Scenes [35]. Since GT annotations for Diabetic-Retinopathy [1] test images are not provided, we reserve 200 training images for each of the five classes for testing. The number of test images per class for all datasets are roughly balanced. The test images of these datasets $\mathcal{D}_{V}^{\text{test}}$ are used to evaluate both the victim and knockoff models.

After these four victim models are trained, we use them as a blackbox for the remainder of the paper: images in, posterior probabilities out.

5.2 Representing $P_{A}$

In this section, we elaborate on the setup of two aspects relevant to transfer set construction (Section 4.1).

5.2.1 Choice of $P_{A}$

Our approach for transfer set construction involves the adversary querying images from a large discrete image distribution $P_{A}$. In this section, we present four choices considered in our experiments. Any information apart from the images from the respective datasets are unused in the random strategy. For the adaptive strategy, we use image-level labels (chosen independent of blackbox models) to guide sampling.

$\bm{P_{A}=P_{V}}$.

For reference, we sample from the exact set of images used to train the blackboxes. This is a special case of knowledge-distillation [15] with unlabeled data at temperature $\tau=1$.

$\bm{P_{A}=}$** ILSVRC [37, 8].**

We use the collection of 1.2M images over 1000 categories presented in the ILSVRC-2012 [37] challenge.

$\bm{P_{A}=}$** OpenImages [22].**

OpenImages v4 is a large-scale dataset of 9.2M images gathered from Flickr. We use a subset of 550K unique images, gathered by sampling 2k images from each of 600 categories.

$\bm{P_{A}=D^{2}}$.

We construct a dataset wherein the adversary has access to all images in the universe. In our case, we create the dataset by pooling training data from: (i) all four datasets listed in Section 5.1; and (ii) both datasets presented in this section. This results in a “dataset of datasets” $D^{2}$ of 2.2M images and 2129 classes.

Overlap between $P_{A}$ and $P_{V}$.

We compute overlap between labels of the blackbox ($K$, e.g., 256 Caltech classes) and the adversary’s dataset ($Z$, e.g., 1k ILSVRC classes) as: $100\times|K\cap Z|/|K|$. Based on the overlap between the two image distributions, we categorize $P_{A}$ as:

$\bm{P_{A}=P_{V}}$: Images queried are identical to the ones used for training $F_{V}$. There is a 100% overlap. 2. 2.

Closed-world ($\bm{P_{A}=D^{2}}$): Blackbox train data $P_{V}$ is a subset of the image universe $P_{A}$. There is a 100% overlap. 3. 3.

Open-world ($\bm{P_{A}\in}$ {ILSVRC, OpenImages}): Any overlap between $P_{V}$ and $P_{A}$ is purely coincidental. Overlaps are: Caltech256 (42% ILSVRC, 44% OpenImages), CUBS200 (1%, 0.5%), Indoor67 (15%, 6%), and Diabetic5 (0%, 0%).

5.2.2 Adaptive Strategy

In the adaptive strategy (Section 4.1.2), we make use of auxiliary information (labels) in the adversary’s data $P_{A}$ to guide the construction of the transfer set. We represent these labels as the leaf nodes in the coarse-to-fine concept hierarchy tree. The root node in all cases is a single concept “entity”. We obtain the rest of the hierarchy as follows: (i) $D^{2}$: we add as parents the dataset the images belong to; (ii) ILSVRC: for each of the 1K labels, we obtain 30 coarse labels by clustering the mean visual features of each label obtained using 2048-dim pool features of an ILSVRC pretrained Resnet model; (iii) OpenImages: We use the exact hierarchy provided by the authors.

6 Results

We now discuss the experimental results.

Training Phases.

The knockoff models are trained in two phases: (a) Online: during transfer set construction (Section 4.1); followed by (b) Offline: the model is retrained using transfer set obtained thus far (Section 4.2). All results on knockoff are reported after step (b).

Evaluation Metric.

We evaluate two aspects of the knockoff: (a) Top-1 accuracy: computed on victim’s held-out test data $\mathcal{D}_{V}^{\text{test}}$ (b) sample-efficiency: best performance achieved after a budget of $B$ queries. Accuracy is reported in two forms: absolute ($x$%) or relative to blackbox $F_{V}$ ($x\times$).

In each of the following experiments, we evaluate our approach with identical hyperparameters across all blackboxes, highlighting the generalizability of model functionality stealing.

6.1 Transfer Set Construction

In this section, we analyze influence of transfer set $\{(\bm{x}_{i},F_{V}(\bm{x}_{i})\}$ on the knockoff. For simplicity, for the remainder of this section we fix the architecture of the victim and knockoff to a Resnet-34 [14].

Reference: $\bm{P_{A}=P_{V}}$ (KD).

From Table 2 (second row), we observe: (i) all knockoff models recover $0.92$-$1.05\times$ performance of $F_{V}$; (ii) a better performance than $F_{V}$ itself (e.g., 3.8% improvement on Caltech256) due to regularizing effect of training on soft-labels [15].

Can we learn by querying randomly from an independent distribution?

Unlike KD, the knockoff is now trained and evaluated on different image distributions ($P_{A}$ and $P_{V}$ respectively). We first focus on the random strategy, which does not use any auxiliary information.

We make the following observations from Table 2 (random): (i) closed-world: the knockoff is able to reasonably imitate all the blackbox models, recovering $0.84$-$0.97\times$ blackbox performance; (ii) open-world: in this challenging scenario, the knockoff model has never encountered images of numerous classes at test-time e.g., $>$90% of the bird classes in CUBS200. Yet remarkably, the knockoff is able to obtain $0.81$-$0.96\times$ performance of the blackbox. Moreover, results marginally vary (at most $0.04\times$) between ILSVRC and OpenImages, indicating any large diverse set of images makes for a good transfer set.

Upon qualitative analysis, we find the image and pseudo-label pairs in the transfer set are semantically incoherent (Fig. 6a) for output classes non-existent in training images $P_{A}$. However, when relevant images are presented at test-time (Fig. 6b), the adversary displays strong performance. Furthermore, we find the top predictions by knockoff relevant to the image e.g., predicting one comic character (superman) for another.

How sample-efficient can we get?

Now we evaluate the adaptive strategy (discussed in Section 4.1.2). Note that we make use of auxiliary information of the images in these tasks (labels of images in $P_{A}$). We use the reward set which obtained the best performance in each scenario: {certainty} in closed-world and {certainty, diversity, loss} in open-world.

From Figure 5, we observe: (i) closed-world: adaptive is extremely sample-efficient in all but one case. Its performance is comparable to KD in spite of samples drawn from a $36$-$188\times$ larger image distribution. We find significant sample-efficiency improvements e.g., while CUBS200-random reaches 68.3% at $B$=60k, adaptive achieves this 6$\times$ quicker at $B$=10k. We find comparably low performance in Diabetic5 as the blackbox exhibits confident predictions for all images resulting in poor feedback signal to guide policy; (ii) open-world: although we find marginal improvements over random in this challenging scenario, they are pronounced in few cases e.g., $1.5\times$ quicker to reach an accuracy 57% on CUBS200 with OpenImages. (iii) as an added-benefit apart from sample-efficiency, from Table 2, we find adaptive display improved performance (up to 4.5%) consistently across all choices of $F_{V}$.

What can we learn by inspecting the policy?

From previous experiments, we observed two benefits of the adaptive strategy: sample-efficiency (although more prominent in the closed-world) and improved performance. The policy $\pi_{t}$ learnt by adaptive (Section 4.1.2) additionally allows us to understand what makes for good images to query. $\pi_{t}(z)$ is a discrete probability distribution indicating preference over action $z$. Each action $z$ in our case corresponds to labels in the adversary’s image distribution.

We visualize $\pi_{t}(z)$ in Figure 7, where each bar represents an action and its color, the parent in the hierarchy. We observe: (i) closed-world (Fig. 7 top): actions sampled with higher probabilities consistently correspond to output classes of $F_{V}$. Upon analyzing parents of these actions (the dataset source), the policy also learns to sample images for the output classes from an alternative richer image source e.g., “ladder” images in Caltech256 sampled from OpenImages instead; (ii) open-world (Fig. 7 bottom): unlike closed-world, the optimal mapping between adversary’s actions to blackbox’s output classes is non-trivial and unclear. However, we find top actions typically correspond to output classes of $F_{V}$ e.g., indigo bunting. The policy, in addition, learns to sample coarser actions related to the $F_{V}$’s task e.g., predominantly drawing from birds and animals images to knockoff CUBS200.

What makes for a good reward?

Using the adaptive sampling strategy, we now address influence of three rewards (discussed in Section 4.1.2). We observe: (i) closed-world (Fig. 8 left): All reward signals in adaptive helps with the sample efficiency over random. Reward cert (which encourages exploitation) provides the best feedback signal. Including other rewards (cert+div+$\mathcal{L}$) slightly deteriorates performance, as they encourage exploration over related or unseen actions – which is not ideal in a closed-world. Reward uncert, a popular measure used in AL literature [9, 3, 39] underperforms in our setting since it encourages uncertain (in our case, irrelevant) images. (ii) open-world (Fig. 8 right): All rewards display only none-to-marginal improvements for all choices of $F_{V}$, with the highest improvement in CUBS200 using cert+div+$\mathcal{L}$. However, we notice an influence on learnt policies where adopting exploration (div + $\mathcal{L}$) with exploitation (cert) goals result in a softer probability distribution $\pi$ over the action space and in turn, encouraging related images.

Can we train knockoffs with truncated blackbox outputs?

So far, we found adversary’s attack objective of knocking off blackbox models can be effectively carried out with minimal assumptions. Now we explore the influence of victim’s defense strategy of reducing informativeness of blackbox predictions to counter adversary’s model stealing attack. We consider two truncation strategies: (a) top-$k$: top-$k$ (out of $K$) unnormalized posterior probabilities are retained, while rest are zeroed-out; (b) rounding $r$: posteriors are rounded to $r$ decimals e.g., round(0.127, $r$=2) = 0.13. In addition, we consider the extreme case “argmax”, where only index $k=\operatorname*{arg\,max}_{k}y_{k}$ is returned.

From Figure 9 (with $K$ = 256), we observe: (i) truncating $\bm{y}_{i}$ – either using top-$k$ or rounding – slightly impacts the knockoff performance, with argmax achieving 0.76-0.84$\times$ accuracy of original performance for any budget $B$; (ii) top-$k$: even small increments of $k$ significantly recovers the original performance – $0.91\times$ at $k=2$ and $0.96\times$ at $k=5$; (iii) rounding: recovery is more pronounced, with $0.99\times$ original accuracy achieved at just $r=2$. We find model functionality stealing minimally impacted by reducing informativeness of blackbox predictions.

6.2 Architecture choice

In the previous section, we found model functionality stealing to be consistently effective while keeping the architectures of the blackbox and knockoff fixed. Now we study the influence of the architectural choice $F_{A}$ vs. $F_{V}$.

How does the architecture of $F_{A}$ influence knockoff performance?

We study the influence using two choices of the blackbox $F_{V}$ architecture: Resnet-34 [14] and VGG-16 [41]. Keeping these fixed, we vary architecture of the knockoff $F_{A}$ by choosing from: Alexnet [21], VGG-16 [41], Resnet-{18, 34, 50, 101} [14], and Densenet-161 [16].

From Figure 10, we observe: (i) performance of the knockoff ordered by model complexity: Alexnet (lowest performance) is at one end of the spectrum while significantly more complex Resnet-101/Densenet-161 are at the other; (ii) performance transfers across model families: Resnet-34 achieves similar performance when stealing VGG-16 and vice versa; (iii) complexity helps: selecting a more complex model architecture of the knockoff is beneficial. This contrasts KD settings where the objective is to have a more compact student (knockoff) model.

6.3 Stealing Functionality of a Real-world Black-box Model

Now we validate model functionality stealing on a popular image analysis API. Such image recognition services are gaining popularity allowing users to obtain image-predictions for a variety of tasks at low costs ($1-2 per 1k queries). These image recognition APIs have also been used to evaluate other attacks e.g., adversarial examples [23, 4, 18]. We focus on a facial characteristics API which given an image, returns attributes and confidences per face. Note that in this experiment, we have semantic information of blackbox output classes.

Collecting $P_{A}$.

The API returns probability vectors per face in the image and thus, querying irrelevant images leads to a wasted result with no output information. Hence, we use two face image sets $P_{A}$ for this experiment: CelebA (220k images) [24] and OpenImages-Faces (98k images). We create the latter by cropping faces (plus margin) from images in the OpenImages dataset [22].

Evaluation.

Unlike previous experiments, we cannot access victim’s test data. Hence, we create test sets for each image set by collecting and manually screening seed annotations from the API on $\sim$5K images.

How does this translate to the real-world?

We model two variants of the knockoff using the random strategy (adaptive is not used since no relevant auxiliary information of images are available). We present each variant using two choices of architecture $F_{A}$: a compact Resnet-34 and a complex Resnet-101. From Figure 11, we observe: (i) strong performance of the knockoffs achieving $0.76$-$0.82\times$ performance as that of the API on the test sets; (ii) the diverse nature OpenImages-Faces helps improve generalization resulting in $0.82\times$ accuracy of the API on both test-sets; (iii) the complexity of $F_{A}$ does not play a significant role: both Resnet-34 and Resnet-101 show similar performance indicating a compact architecture is sufficient to capture discriminative features for this particular task.

We find model functionality stealing translates well to the real-world with knockoffs exhibiting a strong performance. The knockoff circumvents monetary and labour costs of: (a) collecting images for the task; (b) obtaining expert annotations; and (c) tuning a model. As a result, an inexpensive knockoff is trained which exhibits strong performance, using victim API queries amounting to only $30.

7 Conclusion

We investigated the problem of model functionality stealing where an adversary transfers the functionality of a victim model into a knockoff via blackbox access. In spite of minimal assumptions on the blackbox, we demonstrated the surprising effectiveness of our approach. Finally, we validated our approach on a popular image recognition API and found strong performance of knockoffs. We find functionality stealing poses a real-world threat that potentially undercuts an increasing number of deployed ML models.

Acknowledgement.

This research was partially supported by the German Research Foundation (DFG CRC 1223). We thank Yang Zhang for helpful discussions.

Appendix A Contents

The appendix contains:

1. A.

Contents (this section) 2. B.

Extended descriptions

Blackbox models 2. 2.

Overlap between $P_{V}$ and $P_{A}$ 3. 3.

Aggregating OpenImages and OpenImages-Faces 4. 4.

Additional implementation details 3. C.

Extensions of existing results

Qualitative Results 2. 2.

Sample-efficiency of GT 3. 3.

Policies learnt by adaptive strategy 4. 4.

Reward Ablation 4. D.

Auxiliary experiments

Seen and unseen classes 2. 2.

Adaptive strategy: With/without hierarchy 3. 3.

Semi-open world: $\tau D^{2}$

Appendix B Extended Descriptions

In this section, we provide additional detailed descriptions and implementation details.

B.1 Black-box models

We supplement Section 5.1 by providing extended descriptions of the blackboxes listed in Table 1. Each blackbox $F_{V}$ is trained on one particular image classification dataset.

Black-box 1: Caltech256 [12].

Caltech-256 is a popular dataset for general object recognition gathered by downloading relevant examples from Google Images and manually screening for quality and errors. The dataset contains 30k images covering 256 common object categories.

Black-box 2: CUBS200 [47].

A fine-grained bird-classifier is trained on the CUBS-200-2011 dataset. This dataset contains roughly 30 train and 30 test images for each of 200 species of birds. Due to the low intra-class variance, collecting and annotating images is challenging even for expert bird-watchers.

Black-box 3: Indoor67 [35].

We introduce another fine-grained task of recognizing 67 types of indoor scenes. This dataset consists of 15.6k images collected from Google Images, Flickr, and LabelMe.

Black-box 4: Diabetic5 [1].

Diabetic Retinopathy (DR) is a medical eye condition characterized by retinal damage due to diabetes. Cases are typically determined by trained clinicians who look for presence of lesions and vascular abnormalities in digital color photographs of the retina captured using specialized cameras. Recently, a dataset of such 35k retinal image scans was made available as a part of a Kaggle competition [1]. Each image is annotated by a clinician on a scale of 0 (no DR) to 4 (proliferative DR). This highly-specialized biomedical dataset also presents challenges in the form of extreme imbalance (largest class contains 30$\times$ as the smallest one).

B.2 Overlap: Open-world

In this section, we supplement Section 5.2.1 in the main paper by providing more details on how overlap was calculated in the open-world scenarios. We manually compute overlap between labels of the blackbox ($K$, e.g., 256 Caltech classes) and the adversary’s dataset ($Z$, e.g., 1k ILSVRC classes) as: $100\times|K\cap Z|/|K|$. We denote two labels $k\in K$ and $z\in Z$ to overlap if: (a) they have the same semantic meaning; or (b) $z$ is a type of $k$ e.g., $z$ = “maltese dog” and $k$ = “dog”. The exact numbers are provided in Table 3. We remark that this is a soft-lower bound. For instance, while ILSVRC contains “Hummingbird” and CUBS-200-2011 contains three distinct species of hummingbirds, this is not counted towards the overlap as the adversary lacks annotated data necessary to discriminate among the three species.

B.3 Dataset Aggregation

All datasets used in the paper (expect OpenImages) have been used in the form made publicly available by the authors. We use a subset of OpenImages due to storage constraints imposed by its massive size (9M images). The description to obtain these subsets are provided below.

OpenImages.

We retrieve 2k images for each of the 600 OpenImages [22] “boxable” categories, resulting in 554k unique images. $\sim$19k images are removed for either being corrupt or representing Flickr’s placeholder for unavailable images. This results in a total of 535k unique images.

OpenImages-Faces.

We download all images (422k) from OpenImages [22] with label “/m/0dzct: Human face” using the OID tool [46]. The bounding box annotations are used to crop faces (plus a margin of 25%) containing at least 180$\times$180 pixels. We restrict to at most 5 faces per image to maintain diversity between train/test splits. This results in a total of 98k faces images.

B.4 Additional Implementation Details

In this section, we provide implementation details to supplement discussions in the main paper.

Training $F_{V}=$ Diabetic5.

Training this victim model is identical to other blackboxes except for one aspect: weighted loss. Due to the extreme imbalance between classes of the dataset, we weigh each class as follows. Let $n_{k}$ denote the number of images belonging to class $k$ and let $n_{\min}=\min_{k}n_{k}$. We weigh the loss for each class $k$ as $n_{\min}/n_{k}$. From our experiments with weighted loss, we found approximately 8% absolute improvement in overall accuracy on the test set. However, the training of knockoffs of all blackboxes are identical in all aspects, including a non-weighted loss irrespective of the victim blackbox targeted.

Creating ILSVRC Hierarchy.

We represent the 1k labels of ILSVRC as a hierarchy Figure 4b in the form: root node “entity” $\rightarrow$ $N$ coarse nodes $\rightarrow$ 1k leaf nodes. We obtain $N$ (30 in our case) coarse labels as follows: (i) a 2048-d mean feature vector representation per 1k labels is obtained using an Imagenet-pretrained ResNet ; (ii) we cluster the 1k features into $N$ clusters using scikit-learn’s [33] implementation of agglomerative clustering; (iii) we obtain semantic labels per cluster (i.e., coarse node) by finding the common parent in the Imagenet semantic hierarchy.

Adaptive Strategy.

Recall from Section 6, we train the knockoff in two phases: (a) Online: during transfer set construction; followed by (b) Offline: the model is retrained using transfer set obtained thus far. In phase (a), we train $F_{A}$ with SGD (with 0.5 momentum) with a learning rate of 0.0005 and batch size of 4 (i.e., 4 images sampled at each $t$). In phase (b), we train the knockoff $F_{A}$ from scratch on the transfer set using SGD (with 0.5 momentum) for 100 epochs with learning rate of 0.01 decayed by a factor of 0.1 every 60 epochs.

Appendix C Extensions of Existing Results

In this section, we present extensions of existing results discussed in the main paper.

C.1 Qualitative Results

Qualitative results to supplement Figure 6 are provided in Figures 13-16. Each row in the figures correspond to an output class of the blackbox whose images the knockoff has never encountered before. Images in the “transfer set” column were randomly sampled from ILSVRC [37, 8]. In contrast, images in the “test set” belong to the victim’s test set (Caltech256, CUBS-200-2011, etc.).

C.2 Sample Efficiency: Training Knockoffs on GT

We extend Figure 5 in the main paper to include training on the same ground-truth data used to train the blackboxes. This extension “$P_{V}(F_{V})$” is illustrated in Figure 12, displayed alongside KD approach. The figure represents the sample-efficiency of the first two rows of 2. Here we observe: (i) comparable performance in all but one case (Diabetic5, discussed shortly) indicating KD is an effective approach to train knockoffs; (ii) we find KD achieve better performance in Caltech256 and Diabetic5 due to regularizing effect of training on soft-labels [15] on an imbalanced dataset.

C.3 Policies learnt by Adaptive

We inspected the policy $\pi$ learnt by the adaptive strategy in Section 6.1. In this section, we provide policies over all blackboxes in the closed- and open-world setting. Figures 17(a) and 17(c) display probabilities of each action $z\in Z$ at $t=2500$.

Since the distribution of rewards is non-stationary, we visualize the policy over time in Figure 17(b) for CUBS200 in a closed-world setup. From this figure, we observe an evolution where: (i) at early stages ($t\in[0,2000]$), the approach samples (without replacement) images that overlaps with the victim’s train data; and (ii) at later stages ($t\in[2000,4000]$), since the overlapping images have been exhausted, the approach explores related images from other datasets e.g., “ostrich”, “jaguar”.

C.4 Reward Ablation

The reward ablation experiment 8 for the remaining datasets are provided in Figure 18. We make similar observations as before for Indoor67. However, since $F_{V}=$ Diabetic5 demonstrates confident predictions in all images (discussed in 563-567), we find little-to-no improvement for knockoffs of this victim model.

Appendix D Auxiliary Experiments

In this section, we present experiments to supplement existing results in the main paper.

D.1 Seen and Unseen classes

We now discuss evaluation to supplement Section 5.2.1 and Section 6.

In 6.1 we highlighted strong performance of the knockoff even among classes that were never encountered (see Table 3 for exact numbers) during training. To elaborate, we split the blackbox output classes into “seen” and “unseen” categories and present mean per-class accuracies in Figure 19. Although we find better performance on classes seen while training the knockoff, performance of unseen classes is remarkably high, with the knockoff achieving $>$70% performance in both cases.

D.2 Adaptive: With and without hierarchy

The adaptive strategy presented in Section 4.1.2 uses a hierarchy discussed in Section 5.2.2. As a result, we approached this as a hierarchical multi-armed bandit problem. Now, we present an alternate approach adaptive-flat, without the hierarchy. This is simply a multi-armed bandit problem with $|Z|$ arms (actions).

Figure 20 illustrates the performance of these approaches using $P_{A}=D^{2}$ ($|Z|$ = 2129) and rewards {certainty, diversity, loss}. We observe adaptive consistently outperforms adaptive-flat. For instance, in CUBS200, adaptive is 2$\times$ more sample-efficient to reach accuracy of 50%. We find the hierarchy helps the adversary (agent) better navigate the large action space.

D.3 Semi-open World

The closed-world experiments ($P_{A}=D^{2}$) presented in Section 6.1 and discussed in Section 5.2.1 assumed access to the image universe. Thereby, the overlap between $P_{A}$ and $P_{V}$ was 100%. Now, we present an intermediate overlap scenario semi-open world by parameterizing the overlap as: (i) $\tau_{\text{d}}$: The overlap between images $P_{A}$ and $P_{V}$ is $100\times\tau_{\text{d}}$; and (ii) $\tau_{\text{k}}$: The overlap between labels $K$ and $Z$ is $100\times\tau_{\text{k}}$. In both these cases $\tau_{\text{d}},\tau_{\text{k}}\in(0,1]$ represents the fraction of $P_{A}$ used. $\tau_{\text{d}}=\tau_{\text{k}}=1$ depicts the closed-world scenario discussed in Section 6.1.

From Figure 21, we observe: (i) the random strategy is unaffected in the semi-open world scenario, displaying comparable performance for all values of $\tau_{\text{d}}$ and $\tau_{\text{k}}$; (ii) $\tau_{\text{d}}$: knockoff obtained using adaptive obtains strong performance even with low overlap e.g., a difference of at most 3% performance in Caltech256 even at $\tau_{\text{d}}=0.1$; (iii) $\tau_{\text{k}}$: although the adaptive strategy is minimally affected in few cases (e.g., CUBS200), we find the performance drop due to a pure exploitation (certainty) that is used. We observed recovery in performance by using all rewards indicating exploration goals (diversity, loss) are necessary when transitioning to an open-world scenario.