$\delta$-STEAL: LLM Stealing Attack with Local Differential Privacy

TL;DR

This paper introduces $oldsymbol{ ext{ extdelta}- ext{STEAL}}$, a novel LLM model stealing attack that uses local differential privacy to bypass watermarks while maintaining high attack success rates, threatening intellectual property protections.

Contribution

The paper presents $ ext{ extdelta}- ext{STEAL}$, a new attack method that obfuscates watermarks in LLM outputs using LDP, effectively bypassing watermark detectors without losing model utility.

Findings

Achieves up to 96.95% attack success rate

Effectively bypasses watermark detection methods

Balances attack success and model utility via noise scale

Abstract

Large language models (LLMs) demonstrate remarkable capabilities across various tasks. However, their deployment introduces significant risks related to intellectual property. In this context, we focus on model stealing attacks, where adversaries replicate the behaviors of these models to steal services. These attacks are highly relevant to proprietary LLMs and pose serious threats to revenue and financial stability. To mitigate these risks, the watermarking solution embeds imperceptible patterns in LLM outputs, enabling model traceability and intellectual property verification. In this paper, we study the vulnerability of LLM service providers by introducing $\delta$-STEAL, a novel model stealing attack that bypasses the service provider's watermark detectors while preserving the adversary's model utility. $\delta$-STEAL injects noise into the token embeddings of the adversary's model during fine-tuning in a way that satisfies local differential privacy (LDP) guarantees. The adversary queries the service provider's model to collect outputs and form input-output training pairs. By applying LDP-preserving noise to these pairs, $\delta$-STEAL obfuscates watermark signals, making it difficult for the service provider to determine whether its outputs were used, thereby preventing claims of model theft. Our experiments show that $\delta$-STEAL with lightweight modifications achieves attack success rates of up to $96.95\%$ without significantly compromising the adversary's model utility. The noise scale in LDP controls the trade-off between attack effectiveness and model utility. This poses a significant risk, as even robust watermarks can be bypassed, allowing adversaries to deceive watermark detectors and undermine current intellectual property protection methods.