SnatchML：无需训练访问权限即可劫持机器学习模型
SnatchML: Hijacking ML models without Training Access
AI总结：
本文提出无需训练的模型劫持攻击SnatchML，利用过度参数化模型的额外能力在推理时执行新任务，可突破原始任务类别限制，还提出元遗忘和压缩对策缓解风险。
摘要：
模型劫持可能导致严重的问责和安全风险，因为被劫持模型的所有者可能会被诬陷其模型提供非法或不道德的服务。以往的研究将模型劫持视为训练时攻击，即攻击者需要完全访问机器学习模型的训练过程。在本文中，我们考虑了一种更强的推理时劫持攻击威胁模型，其中攻击者无法访问受害者模型的训练阶段。我们的直觉是，通常过度参数化的机器学习模型可能（无意中）具备学习超出其训练目标任务的额外能力。我们提出了SnatchML，一种新的无需训练的模型劫持攻击方法，它利用受害者模型所具备的额外能力来推断与原始任务在语义上相关或不相关的不同任务。我们在AWS Sagemaker上部署的模型上进行的实验结果表明，SnatchML能够在劫持任务上实现高精度。有趣的是，虽然所有先前的方法都受限于良性任务中的类别数量，但SnatchML可以劫持模型以执行类别数量多于原始任务的任务。我们探索了不同的方法来缓解这种风险；我们提出了元遗忘（meta-unlearning），其设计目的是帮助模型在训练原始任务的同时遗忘潜在的恶意任务。我们还深入分析了过度参数化作为促成模型劫持的潜在内在因素，并据此提出了一种基于压缩的对策来对抗这种攻击。我们认为这项工作提供了一个此前被忽视的模型劫持攻击视角，提出了更强的威胁模型并在现实场景中具有更高的适用性。
英文摘要：
Model hijacking can cause significant accountability and security risks since the owner of a hijacked model can be framed for having their model offer illegal or unethical services. Prior works consider model hijacking as a training time attack, whereby an adversary requires full access to the ML model training. In this paper, we consider a stronger threat model for an inference-time hijacking attack, where the adversary has no access to the training phase of the victim model. Our intuition is that ML models, which are typically over-parameterized, might have the capacity to (unintentionally) learn more than the intended task they are trained for. We propose SnatchML, a new training-free model hijacking attack, that leverages the extra capacity learnt by the victim model to infer different tasks that can be semantically related or unrelated to the original one. Our results on models deployed on AWS Sagemaker showed that SnatchML can deliver high accuracy on hijacking tasks. Interestingly, while all previous approaches are limited by the number of classes in the benign task, SnatchML can hijack models for tasks that contain more classes than the original. We explore different methods to mitigate this risk; We propose meta-unlearning, which is designed to help the model unlearn a potentially malicious task while training for the original task. We also provide insights on over-parametrization as a possible inherent factor that facilitates model hijacking, and accordingly, we propose a compression-based countermeasure to counteract this attack. We believe this work offers a previously overlooked perspective on model hijacking attacks, presenting a stronger threat model and higher applicability in real-world contexts.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
