Ownership and Confidentiality in Machine Learning
Loading...
Journal Title
Journal ISSN
Volume Title
School of Science |
Doctoral thesis (article-based)
| Defence date: 2023-08-18
Unless otherwise stated, all rights belong to the author. You may download, display and print this publication for Your own personal use. Commercial use is prohibited.
Author
Date
2023
Major/Subject
Mcode
Degree programme
Language
en
Pages
72 + app. 96
Series
Aalto University publication series DOCTORAL THESES, 110/2023
Abstract
Statistical and machine learning (ML) models have been the primary tools for data-driven analysis for decades. Recent theoretical progress in deep neural networks (DNNs) coupled with computational advances put DNNs at the forefront of ML in the domains of vision, audio and language understanding. Alas, this has made DNNs targets for a wide array of attacks. Their complexity revealed a wider range of vulnerabilities compared to the much simpler models of the past. As of now, attacks have been proposed against every single step of the ML pipeline: gathering and preparation of data, model training, model serving and inference. In order to effectively build and deploy ML models, model builders invest vast resources into gathering, sanitising and labelling the data, designing and training the models, as well as serving them effectively to their customers. ML models embody valuable intellectual property (IP), and thus business advantage that needs to be protected. Model extraction attacks aim to mimic the functionality of ML models, or even compromise their confidentiality. An adversary who extracts the model can leverage it for other attacks, continuously use the model without paying, or even undercut the original owner by providing a competing service at a lower cost. All research questions investigated in this dissertation share the common theme of the theft of ML models or their functionality. The dissertation is divided into four parts. In the first part, I explore the feasibility of model extraction attacks. In the publications discussed in this part, my coauthors and I design novel black- box extraction attacks against classification and image-translation deep neural networks. Our attacks result in surrogate models that rival the victim models at their tasks. In the second part, we investigate ways of addressing the threat of model extraction; I propose two detection mechanisms able to identify ongoing extraction attacks in certain settings with the following caveat: detection and prevention cannot stop a well-equipped adversary from extracting the model. Hence, in the third part, I focus on reliable ownership verification. By identifying extracted models and tracing them back to the victim, ownership verification can deter model extraction. In the publications discussed in this part, I demonstrate it by introducing the first watermarking scheme designed specifically against extraction attacks. Crucially, I critically evaluate the reliability of my approach w.r.t. the capabilities of an adaptive adversary. Further, I empirically evaluate a promising model fingerprinting scheme, and show that well-equipped adaptive adversaries remain a threat to model confidentiality. In the fourth part, I identify the problem of conflicting interactions among protection mechanisms. ML models are vulnerable to various attacks, and thus, may need to be deployed with multiple protection mechanisms at once. I show that combining ownership verification with protection mechanisms against other security/privacy concerns can result in conflicts. The dissertation concludes, with my observations about model confidentiality, the feasibility of ownership verification, and potential directions for future work.Description
Supervising professor
Asokan, N., Adj. Prof., Aalto University, Department of Computer Science, FinlandThesis advisor
Marchal, Samuel, Dr., WithSecure, FinlandKeywords
adversarial machine learning, model extraction, ownership verification
Other note
Parts
-
[Publication 1]: Mika Juuti, Sebastian Szyller, Samuel Marchal, N. Asokan. PRADA: Protecting Against DNN Model Stealing Attacks. In IEEE European Symposium on Security and Privacy, Stockholm, Sweden, June 2019.
Full text in Acris/Aaltodoc: http://urn.fi/URN:NBN:fi:aalto-201909205383DOI: 10.1109/EuroSP.2019.00044 View at publisher
-
[Publication 2]: Buse Gül Atli Tekgül, Sebastian Szyller, Mika Juuti, Samuel Marchal, N. Asokan. Extraction of Complex DNN Models: Real Threat or Boogeyman?. In International Workshop on Engineering Dependable and Secure Machine Learning Systems, New York, USA, February 2020.
DOI: 10.1007/978-3-030-62144-5_4 View at publisher
- [Publication 3]: Sebastian Szyller, Vasisht Duddu, Tommi Buder-Gröndahl, N. Asokan. Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Models. In submission, October 2022
-
[Publication 4]: Sebastian Szyller, Buse Gül Atli Tekgül, Samuel Marchal, N. Asokan. DAWN: Dynamic Adversarial Watermarking of Neural Networks. In ACM International Conference on Multimedia, China, Virtual, October 2021.
DOI: 10.1145/3474085.3475591 View at publisher
- [Publication 5]: Sebastian Szyller, Rui Zhang, Jian Liu, N. Asokan. On the Robustness of Dataset Inference. Accepted for publication in Transactions on Machine Learning Research, June 2023
- [Publication 6]: Sebastian Szyller, N. Asokan. Conflicting Interactions Among Protection Mechanisms for Machine Learning Models. Accepted for publication in AAAI Conference on Artificial Intelligence, Washington, USA, February 2023
