The rise of Machine Learning as a Service (MLaaS) has led to the widespread deployment of machine learning models trained on diverse datasets. These models are employed for predictive services through APIs, raising concerns about the security and confidentiality of the models due to emerging vulnerabilities in prediction APIs. Of particular concern are model cloning attacks, where individuals with limited data and no knowledge of the training dataset manage to replicate a victim model's functionality through black-box query access. This commonly entails generating adversarial queries to query the victim model, thereby creating a labeled dataset.
This paper proposes "MisGUIDE", a two-step defense framework for Deep Learning models that disrupts the adversarial sample generation process by providing a probabilistic response when the query is deemed OOD. The first step employs a Vision Transformer-based framework to identify OOD queries, while the second step perturbs the response for such queries, introducing a probabilistic loss function to MisGUIDE the attackers. The aim of the proposed defense method is to reduce the accuracy of the cloned model while maintaining accuracy on authentic queries. Extensive experiments conducted on two benchmark datasets demonstrate that the proposed framework significantly enhances the resistance against state-of-the-art data-free model extraction in black-box settings.
Do Defenses Against LLM Extraction Work Across Attacks? A Lifecycle Benchmark of Black-Box Model Extraction
Florida State University（佛罗里达州立大学）；Brigham Young University（杨百翰大学）；University of Michigan, Ann Arbor（密歇根大学安娜堡分校）；State University of New York at Buffalo（纽约州立大学布法罗分校）；Wake Forest University（维克森林大学）；University of Georgia（佐治亚大学）
Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation
University of Oregon（俄勒冈大学）；Michigan State University（密歇根州立大学）；Adobe Research（Adobe研究院）；PNNL（太平洋西北国家实验室）；Cisco AI Research（思科AI研究院）；Florida State University（佛罗里达州立大学）；University of Southern California（南加州大学）；Texas A&M University（德克萨斯农工大学）
A Survey on Model Extraction Attacks and Defenses for Large Language Models
University of Notre Dame（圣约翰大学）；Florida State University（佛罗里达州立大学）；Northwestern University（西北大学）；Duke University（杜克大学）；University of Southern California（南加州大学）
BODAME: Bilevel Optimization for Defense Against Model Extraction
Graduate School of Information Science and Technology, The University of Tokyo（东京大学信息科学与技术研究生院）；Center for Advanced Intelligence Project, RIKEN（理化学研究所先进智能项目中心）；Japan Science and Technology Agency（日本科学技术振兴机构）
A Survey of Model Extraction Attacks and Defenses in Distributed Computing Environments
University of Notre Dame（圣母大学）；Florida State University（佛罗里达州立大学）；Northwestern University（西北大学）；Duke University（杜克大学）；University of Southern California（南加州大学）
A Systematic Survey of Model Extraction Attacks and Defenses: State-of-the-Art and Perspectives
University of Notre Dame（诺丁汉大学）；Florida State University（佛罗里达州立大学）；Northwestern University（西北大学）；Duke University（杜克大学）；University of Southern California（南加州大学）
Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；Beijing University of Post and Telecommunications（北京邮电大学）；Stanford University（斯坦福大学）；North China Electric Power University（华北电力大学）；AI Sec Lab, Beijing Chaitin Technology Co.,Ltd（北京长亭科技有限公司AI安全实验室）
TRAP: Benchmark for Task-completion and Resistance to Active Privacy-extraction
Dept. of Electrical Engineering, POSTECH（POSTECH电子工程系）；Grad. School of Artificial Intelligence, POSTECH（POSTECH人工智能研究生院）；School of Computing, KAIST（韩国科学技术院计算机学院）
Pareto-Secure Machine Learning (PSML): Fingerprinting and Securing Inference Serving Systems
Georgia Institute of Technology（佐治亚理工学院）；University of California, Riverside（加州大学河滨分校）；University of Wisconsin–Madison（威斯康星大学麦迪逊分校）；University of Virginia（弗吉尼亚大学）；George Washington University（乔治华盛顿大学）
Spore: Efficient and Training-Free Privacy Extraction Attack on LLMs via Inference-Time Hybrid Probing
School of Cyberspace Science and Technology, Beijing Institute of Technology（北京理工大学网络空间安全学院）；Chengdu Institute of Computer Applications, Chinese Academy of Sciences（中国科学院成都计算机应用研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Yangtze Delta Region Institute of Tsinghua University, Zhejiang（清华大学长三角研究院（浙江））；Jiaxing Key Laboratory of Artificial Intelligence and Cyber Resilience（嘉兴人工智能与网络韧性重点实验室）
我们研究了自然语言处理中的模型提取问题，在这个问题中，一个只对受害者模型进行查询访问的对手试图重建该模型的本地副本。假设对手和受害者模型都对大型预训练语言模型进行了微调，如BERT（Devlin et al. 2019），我们证明对手不需要任何真实的训练数据来成功发起攻击。事实上，攻击者甚至不需要使用语法或语义上有意义的查询：我们表明，随机的单词序列加上任务特定的语法，形成有效的查询模型提取不同的NLP任务，包括自然语言推理和问答。因此，我们的工作突出了一个只有在NLP社区转向迁移学习方法时才变得可行的漏洞：对于几百美元的查询预算，攻击者可以提取一个性能仅略差于受害者模型的模型。最后，我们研究了两种防御策略对模型提取-成员分类和API水印-而成功的对天真的对手，是无效的对更复杂的。
