Stealing Machine Learning Models via Prediction ?· Stealing Machine Learning Models via Prediction…

Download Stealing Machine Learning Models via Prediction ?· Stealing Machine Learning Models via Prediction…

Post on 11-Jun-2018

213 views

Category:

Documents

0 download

Embed Size (px)

TRANSCRIPT

<ul><li><p>Stealing Machine Learning Models via Prediction APIsFlorian Tramr1, Fan Zhang2, Ari Juels3, Michael Reiter4, Thomas Ristenpart3</p><p>1EPFL, 2Cornell, 3Cornell Tech, 4UNC</p><p>http://silver.web.unc.edu Cloud Security Horizons Summit, March 2016</p><p>Goals Approach cont.</p><p>ResultsApproach</p><p> Machine learning models may be deemed confidential due to </p><p> Sensitive training data Commercial value Use in security applications</p><p> In practice, ML models are deployed with public prediction APIs.</p><p> We show simple, efficient attacks that can steal the model through legitimate prediction queries.</p><p>DB#Data#owner#</p><p>Train#model##</p><p>Extrac3on#adversary#</p><p>f</p><p>ML#service#</p><p>f(x1)</p><p>f(xq)</p><p>xq</p><p>x1</p><p>#</p><p>Decision Tree: Path-Finding Attacks</p><p>Success of equation-solving attacks</p><p>SVM: Retraining</p><p> Retraining with uniform queries Line-search retraining Adaptive retraining</p><p> We propose a new Path-Finding attack Exploited the ability to query APIs with </p><p>incomplete inputs. Also apply to regression trees. </p><p>LR and MLP: Equation-Solving</p><p> Logistic Regression: = Multiclass LR (MLR) and Multilayer </p><p>Perceptron (MLP):</p><p> Kernelized LR: </p><p>(, , , ) = .()</p><p>(, 0 , , , 4 , )= .()</p><p>Makinguseoftheconfidencevalues.</p><p>Makinguseofonlytheclasslabel.</p><p>Model Unknowns Queries 1-R_test 1-R_unif Time (s)</p><p>Softmax 530265 99.96% 99.75% 2.6530 100.00% 100.00% 3.1</p><p>OvR 530265 99.98% 99.98% 2.8530 100.00% 100.00% 3.5</p><p>MLP 2,2252,225 98.68% 97.23% 1684,450 99.89% 99.82% 196</p><p>Training data extractionTraining data:</p><p>Recovered:</p><p>Model Extraction against MLaaS</p><p>Service Model Data set Queries Time (s)Amazon LR Digits 650 70</p><p>LR Adult 1,485 149BigML DT German Credits 1,150 632</p><p>DT Steak Survey 4,013 2,088</p><p> Tables shows the number of prediction queries made to the ML API in an attack that extracts a 100% equivalent model:</p></li></ul>