CaBaGe：基于类别平衡生成器集成的无数据模型提取
CaBaGe: Data-Free Model Extraction using ClAss BAlanced Generator Ensemble
AI总结：
针对MLaaS黑盒模型的无数据提取难题，提出CaBaGe方法，通过新型经验回放、生成器集成和选择性过滤实现少查询高准确率提取，并首次解决未知类别数的现实场景问题，性能显著优于现有技术。
摘要：
机器学习即服务（MLaaS）通常以按查询付费的黑盒系统形式提供给客户。这种黑盒模式不仅阻碍了模型结果的公开复现、验证与解释，也让白帽研究者更难发现MLaaS系统中的漏洞。模型提取是通过逆向工程黑盒模型来应对这些挑战的一种有前景的技术。由于MLaaS模型的训练数据通常无法获取，本文聚焦于更具现实性的场景：无数据模型提取。我们提出了一种无数据模型提取方法CaBaGe，以少量查询实现更高的模型提取准确率。我们的创新点包括：（1）一种聚焦难训练样本的新型经验回放机制；（2）用于稳定生成多样化合成数据的生成器集成；（3）用于向受害模型查询更难、更均衡样本的选择性过滤流程。此外，我们首次构建了更现实的攻击场景——攻击者不了解受害模型训练数据的类别数量，并提出了一种可实时学习类别数量的解决方案。我们的评估显示，CaBaGe在MNIST、FMNIST、SVHN、CIFAR-10、CIFAR-100、ImageNet-subset和Tiny ImageNet共7个数据集上优于现有技术，提取模型的准确率提升最高达43.13%。此外，要获得与现有工作最终准确率相当的克隆模型，CaBaGe所需的查询数量最多减少了75.7%。
英文摘要：
Machine Learning as a Service (MLaaS) is often provided as a pay-per-query, black-box system to clients. Such a black-box approach not only hinders open replication, validation, and interpretation of model results, but also makes it harder for white-hat researchers to identify vulnerabilities in the MLaaS systems. Model extraction is a promising technique to address these challenges by reverse-engineering black-box models. Since training data is typically unavailable for MLaaS models, this paper focuses on the realistic version of it: data-free model extraction. We propose a data-free model extraction approach, CaBaGe, to achieve higher model extraction accuracy with a small number of queries. Our innovations include (1) a novel experience replay for focusing on difficult training samples; (2) an ensemble of generators for steadily producing diverse synthetic data; and (3) a selective filtering process for querying the victim model with harder, more balanced samples. In addition, we create a more realistic setting, for the first time, where the attacker has no knowledge of the number of classes in the victim training data, and create a solution to learn the number of classes on the fly. Our evaluation shows that CaBaGe outperforms existing techniques on seven datasets -- MNIST, FMNIST, SVHN, CIFAR-10, CIFAR-100, ImageNet-subset, and Tiny ImageNet -- with an accuracy improvement of the extracted models by up to 43.13%. Furthermore, the number of queries required to extract a clone model matching the final accuracy of prior work is reduced by up to 75.7%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
