无数据模型提取
Data-Free Model Extraction
摘要：
当前的模型窃取攻击假设对手可以访问具有与用于训练受害者模型的专有数据类似的特征的代理数据集。这一要求排除了在有价值的模型上使用现有的模型提取技术，例如在稀有或难以获取的数据集上训练的模型。相比之下，我们提出了不需要代理数据集的无数据模型提取方法。我们的方法采用了无数据知识转移领域的技术进行模型提取。作为我们研究的一部分，我们确定损失的选择对于确保提取的模型是受害者模型的准确副本至关重要。此外，我们解决的困难所产生的对手的有限的访问受害者模型中的黑箱设置。例如，我们将模型的logit从概率预测恢复为近似梯度。我们发现，所提出的无数据模型提取方法在合理的查询复杂度下实现了高准确性-在SVHN和CIFAR-10数据集上分别给出2 M和20 M查询的受害者模型准确度为0.99倍和0.92倍。
英文摘要：
Current model extraction attacks assume that the adversary has access to a surrogate dataset with characteristics similar to the proprietary data used to train the victim model. This requirement precludes the use of existing model extraction techniques on valuable models, such as those trained on rare or hard to acquire datasets. In contrast, we propose data-free model extraction methods that do not require a surrogate dataset. Our approach adapts techniques from the area of data-free knowledge transfer for model extraction. As part of our study, we identify that the choice of loss is critical to ensuring that the extracted model is an accurate replica of the victim model. Furthermore, we address difficulties arising from the adversary's limited access to the victim model in a black-box setting. For example, we recover the model's logits from its probability predictions to approximate gradients. We find that the proposed data-free model extraction approach achieves high-accuracy with reasonable query complexity -- 0.99x and 0.92x the victim model accuracy on SVHN and CIFAR-10 datasets given 2M and 20M queries respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
