芝麻街上的小偷！基于BERT的API模型提取
Thieves on Sesame Street! Model Extraction of BERT-based APIs
摘要：
我们研究了自然语言处理中的模型提取问题，在这个问题中，一个只对受害者模型进行查询访问的对手试图重建该模型的本地副本。假设对手和受害者模型都对大型预训练语言模型进行了微调，如BERT（Devlin et al. 2019），我们证明对手不需要任何真实的训练数据来成功发起攻击。事实上，攻击者甚至不需要使用语法或语义上有意义的查询：我们表明，随机的单词序列加上任务特定的语法，形成有效的查询模型提取不同的NLP任务，包括自然语言推理和问答。因此，我们的工作突出了一个只有在NLP社区转向迁移学习方法时才变得可行的漏洞：对于几百美元的查询预算，攻击者可以提取一个性能仅略差于受害者模型的模型。最后，我们研究了两种防御策略对模型提取-成员分类和API水印-而成功的对天真的对手，是无效的对更复杂的。
英文摘要：
We study the problem of model extraction in natural language processing, in which an adversary with only query access to a victim model attempts to reconstruct a local copy of that model. Assuming that both the adversary and victim model fine-tune a large pretrained language model such as BERT (Devlin et al. 2019), we show that the adversary does not need any real training data to successfully mount the attack. In fact, the attacker need not even use grammatical or semantically meaningful queries: we show that random sequences of words coupled with task-specific heuristics form effective queries for model extraction on a diverse set of NLP tasks, including natural language inference and question answering. Our work thus highlights an exploit only made feasible by the shift towards transfer learning methods within the NLP community: for a query budget of a few hundred dollars, an attacker can extract a model that performs only slightly worse than the victim model. Finally, we study two defense strategies against model extraction---membership classification and API watermarking---which while successful against naive adversaries, are ineffective against more sophisticated ones.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
