Data-Free Model Extraction

TL;DR

This paper introduces data-free model extraction techniques that do not require surrogate datasets, enabling high-accuracy replication of victim models in black-box settings with limited data access.

Contribution

It presents novel data-free extraction methods adapting knowledge transfer techniques, addressing challenges of limited access and no surrogate data.

Findings

Achieves 99% and 92% accuracy on SVHN and CIFAR-10

Uses 2 million and 20 million queries respectively

High accuracy with reasonable query complexity

Abstract

Current model extraction attacks assume that the adversary has access to a surrogate dataset with characteristics similar to the proprietary data used to train the victim model. This requirement precludes the use of existing model extraction techniques on valuable models, such as those trained on rare or hard to acquire datasets. In contrast, we propose data-free model extraction methods that do not require a surrogate dataset. Our approach adapts techniques from the area of data-free knowledge transfer for model extraction. As part of our study, we identify that the choice of loss is critical to ensuring that the extracted model is an accurate replica of the victim model. Furthermore, we address difficulties arising from the adversary's limited access to the victim model in a black-box setting. For example, we recover the model's logits from its probability predictions to approximate gradients. We find that the proposed data-free model extraction approach achieves high-accuracy with reasonable query complexity -- 0.99x and 0.92x the victim model accuracy on SVHN and CIFAR-10 datasets given 2M and 20M queries respectively.