Towards Model Extraction Attacks in GAN-Based Image Translation via Domain Shift Mitigation

TL;DR

This paper explores model extraction attacks on GAN-based image translation models, proposing a novel domain shift mitigation method that significantly improves attack effectiveness and reveals vulnerabilities in real-world APIs.

Contribution

It introduces a new regularization technique to enhance model extraction attacks on I2IT models by addressing domain shift issues, a challenge not previously tackled.

Findings

The proposed method outperforms baseline attacks across multiple metrics.

Real-world I2IT APIs are highly vulnerable to the new attack.

Mitigation of domain shift improves attack success rate.

Abstract

Model extraction attacks (MEAs) enable an attacker to replicate the functionality of a victim deep neural network (DNN) model by only querying its API service remotely, posing a severe threat to the security and integrity of pay-per-query DNN-based services. Although the majority of current research on MEAs has primarily concentrated on neural classifiers, there is a growing prevalence of image-to-image translation (I2IT) tasks in our everyday activities. However, techniques developed for MEA of DNN classifiers cannot be directly transferred to the case of I2IT, rendering the vulnerability of I2IT models to MEA attacks often underestimated. This paper unveils the threat of MEA in I2IT tasks from a new perspective. Diverging from the traditional approach of bridging the distribution gap between attacker queries and victim training samples, we opt to mitigate the effect caused by the different distributions, known as the domain shift. This is achieved by introducing a new regularization term that penalizes high-frequency noise, and seeking a flatter minimum to avoid overfitting to the shifted distribution. Extensive experiments on different image translation tasks, including image super-resolution and style transfer, are performed on different backbone victim models, and the new design consistently outperforms the baseline by a large margin across all metrics. A few real-life I2IT APIs are also verified to be extremely vulnerable to our attack, emphasizing the need for enhanced defenses and potentially revised API publishing policies.