MEGEX: Data-Free Model Extraction Attack Against Gradient-Based Explainable AI

Abstract

Explainable AI encourages machine learning applications in the real world, whereas data-free model extraction attacks (DFME), in which an adversary steals a trained machine learning model by creating input queries with generative models instead of collecting training data, have attracted attention as a serious threat. In this paper, we propose MEGEX, a data-free model extraction attack against explainable AI that provides gradient-based explanations for inference results, and investigate whether the gradient-based explanations increase the vulnerability to the data-free model extraction attacks. In MEGEX, an adversary leverages explanations by Vanilla Gradient as derivative values for training a generative model. We prove that MEGEX is identical to white-box data-free knowledge distillation, whereby the adversary can train the generative model with the exact gradients. Our experiments show that the adversary in MEGEX can steal highly accurate models - 0.98×, 0.91×, and 0.96× the victim model accuracy on SVHN, Fashion-MNIST, and CIFAR-10 datasets given 1.5M, 5M, 20M queries, respectively. In addition, we also apply sophisticated gradient-based explanations, i.e., SmoothGrad and Integrated Gradients, to MEGEX. The experimental results indicate that these explanations are potential countermeasures to MEGEX. We also found that the accuracy of the model stolen by the adversary depends on the diversity of query inputs by the generative model.

Topics & Concepts