arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2302.02162cs.LGcs.CR
收藏

AUTOLYCUS:利用可解释人工智能(XAI)针对可解释模型开展模型提取攻击

AUTOLYCUS: Exploiting Explainable AI (XAI) for Model Extraction Attacks against Interpretable Models

Case Western Reserve University(凯斯西储大学);IBM Research - Dublin(IBM都柏林研究院)

Abdullah Caglar Oksuz, Anisa Halimi, Erman Ayday

AI总结:

本研究提出基于重训练的模型提取攻击框架AUTOLYCUS,利用LIME和SHAP两种XAI工具推断目标模型决策边界构建替代模型,在6个数据集和多种可解释模型上验证了其低查询量、高准确率的攻击效果及抗防御性。

摘要:

可解释人工智能(XAI)旨在揭示AI模型的决策过程,但用于生成此类解释的数据可能带来安全与隐私风险。现有研究已明确针对机器学习模型的各类攻击,包括成员推断攻击、模型反演攻击和模型提取攻击,这些攻击根据场景与参与方的不同,要么针对模型本身,要么针对训练数据。\nXAI工具会提升模型提取攻击的可利用性——当模型所有者希望仅提供黑盒访问权限、以此保密模型参数与架构时,这一问题尤为值得关注。为利用这一风险,我们提出AUTOLYCUS,这是一种在黑盒场景下针对可解释模型的新型基于重训练(学习)的模型提取攻击框架。作为利用的XAI工具,我们借助局部可解释模型-不可知解释(Local Interpretable Model-Agnostic Explanations,LIME)和沙普利值(Shapley values,SHAP)来推断决策边界,构建能够复现目标模型功能的替代模型。选择LIME和SHAP的主要原因是它们生成的解释贴合实际且信息丰富,同时应用广泛、简单易用。\n我们在6个机器学习数据集上评估AUTOLYCUS的性能,衡量替代模型与目标模型的准确率及相似度。结果表明,AUTOLYCUS攻击效率极高:与当前最优攻击方法相比,它所需的查询次数显著更少,同时能保持相当的准确率与相似度。我们在多种可解释机器学习模型(包括决策树、逻辑回归、朴素贝叶斯和k近邻)上验证了该方法的性能与可迁移性。此外,我们还证明AUTOLYCUS能够抵御已提出的各类防御对策。

英文摘要:

Explainable Artificial Intelligence (XAI) aims to uncover the decision-making processes of AI models. However, the data used for such explanations can pose security and privacy risks. Existing literature identifies attacks on machine learning models, including membership inference, model inversion, and model extraction attacks. These attacks target either the model or the training data, depending on the settings and parties involved. XAI tools can increase the vulnerability of model extraction attacks, which is a concern when model owners prefer black-box access, thereby keeping model parameters and architecture private. To exploit this risk, we propose AUTOLYCUS, a novel retraining (learning) based model extraction attack framework against interpretable models under black-box settings. As XAI tools, we exploit Local Interpretable Model-Agnostic Explanations (LIME) and Shapley values (SHAP) to infer decision boundaries and create surrogate models that replicate the functionality of the target model. LIME and SHAP are mainly chosen for their realistic yet information-rich explanations, coupled with their extensive adoption, simplicity, and usability. We evaluate AUTOLYCUS on six machine learning datasets, measuring the accuracy and similarity of the surrogate model to the target model. The results show that AUTOLYCUS is highly effective, requiring significantly fewer queries compared to state-of-the-art attacks, while maintaining comparable accuracy and similarity. We validate its performance and transferability on multiple interpretable ML models, including decision trees, logistic regression, naive bayes, and k-nearest neighbor. Additionally, we show the resilience of AUTOLYCUS against proposed countermeasures.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑