HODA: Hardness-Oriented Detection of Model Extraction Attacks

TL;DR

This paper introduces HODA, a novel detection method for model extraction attacks that leverages the hardness degree of samples, demonstrating high detection accuracy with minimal sample monitoring.

Contribution

HODA is the first approach to use sample hardness degree histograms for detecting model extraction attacks, outperforming previous methods.

Findings

HODA detects attack sequences with high success rate.

HODA outperforms existing detection methods.

Detection requires monitoring only 100 samples.

Abstract

Model Extraction attacks exploit the target model's prediction API to create a surrogate model in order to steal or reconnoiter the functionality of the target model in the black-box setting. Several recent studies have shown that a data-limited adversary who has no or limited access to the samples from the target model's training data distribution can use synthesis or semantically similar samples to conduct model extraction attacks. In this paper, we define the hardness degree of a sample using the concept of learning difficulty. The hardness degree of a sample depends on the epoch number that the predicted label of that sample converges. We investigate the hardness degree of samples and demonstrate that the hardness degree histogram of a data-limited adversary's sample sequences is distinguishable from the hardness degree histogram of benign users' samples sequences. We propose Hardness-Oriented Detection Approach (HODA) to detect the sample sequences of model extraction attacks. The results demonstrate that HODA can detect the sample sequences of model extraction attacks with a high success rate by only monitoring 100 samples of them, and it outperforms all previous model extraction detection methods.