A Protection against the Extraction of Neural Network Models

TL;DR

This paper proposes a novel protection method against neural network model extraction attacks by adding parasitic layers that preserve performance while complicating reverse-engineering efforts.

Contribution

It introduces a new defense mechanism using parasitic layers and explains why this approach increases the difficulty of model extraction attacks.

Findings

Parasitic layers maintain the original model's predictions.

The protection method effectively complicates model extraction.

Experimental results show minimal impact on accuracy.

Abstract

Given oracle access to a Neural Network (NN), it is possible to extract its underlying model. We here introduce a protection by adding parasitic layers which keep the underlying NN's predictions mostly unchanged while complexifying the task of reverse-engineering. Our countermeasure relies on approximating a noisy identity mapping with a Convolutional NN. We explain why the introduction of new parasitic layers complexifies the attacks. We report experiments regarding the performance and the accuracy of the protected NN.