Record STMT-M203Unknown

Stealing Machine Learning Models via Prediction APIs

Report UnknownGlobalin force

This research paper explores model extraction attacks against machine learning models deployed with publicly accessible query interfaces. The authors demonstrate that adversaries with black-box access can duplicate the functionality of popular models such as logistic regression, neural networks, and decision trees using efficient equation-solving or path-finding techniques. Furthermore, the paper shows that these attacks can exploit confidence values returned by APIs to reduce query costs and potentially leak sensitive training data.

Summary and content fields are drawn from the document text and are pending editorial review.

Who issued it

arXivAcademic

Publisher

Legal forceUnknown

Under whose authorityUnknown

Judged fromfull text

Who it governs

Researchers and academicsRegulatorsCompaniesAI developers and providers

AI developers, cloud service providers, and security researchers should read this to understand how black-box ML APIs can be compromised and how to design better countermeasures.

Sectors

Research and science · machine learning researchTelecommunications and digital services · cloud-based machine learning services

What the document contains

What's covered

The document investigates model extraction attacks on machine learning models accessed through black-box prediction APIs, detailing specific algorithmic attacks using confidence values or class labels, and evaluates potential countermeasures.

What's missing

Legal or binding regulatory mandates governing machine learning deployment security.

Key takeaways

Machine learning models exposed via prediction APIs can be stolen using efficient model extraction attacks.
APIs that return high-precision confidence values and accept partial feature vectors enable simple equation-solving and path-finding attacks.
Model extraction attacks can achieve near-perfect fidelity for popular model classes including logistic regression, neural networks, and decision trees.
Extracting a model can serve as a stepping stone to violate training-data privacy or facilitate evasion attacks.
Omission of confidence values or rounding predictions can mitigate some attacks, but efficient retraining attacks remain possible using class labels only.

Outline

· Introduction
· Background
· Model Extraction Attacks
· Extraction with Confidence Values
· Online Model Extraction Attacks
· Extraction Given Class Labels Only
· Extraction Countermeasures
· Related Work
· Conclusion

Issued3 October 2016

Length16,979 words · 19 pages

FormatNot recorded

2/5

Protection of personal data and private life

Prior attacks such as model inversion [4, 23, 24] have shown that access to a model can be abused to infer information about training set points.

1 Introduction

screening score · 2026-10-24

Enforcement

0/5

Consequences and compliance mechanisms with real force

Abstract

screening score · 2026-10-24

Impact Assessment

0/5

Required assessment of an AI system's risks/impacts before or during use

Abstract

screening score · 2026-10-24

Topics

model_extraction security_vulnerability machine_learning api_security data_privacy