Model functionality stealing attacks based on real data awareness
Bibliographic record
Abstract
目的模型功能窃取攻击是人工智能安全领域的核心问题之一，目的是利用有限的与目标模型有关的信息训练出性能接近的克隆模型，从而实现模型的功能窃取。针对此类问题，一类经典的工作是基于生成模型的方法，这类方法利用生成器生成的图像作为查询数据，在同一查询数据下对两个模型预测结果的一致性进行约束，从而进行模型学习。然而此类方法生成器生成的数据常常是人眼不可辨识的图像，不含有任何语义信息，导致目标模型的输出缺乏有效指导性。针对上述问题，提出一种新的模型窃取攻击方法，实现对图像分类器的有效功能窃取。方法借助真实的图像数据，利用生成对抗网络(generative adversarial net，GAN)使生成器生成的数据接近真实图像，加强目标模型输出的物理意义。同时，为了提高克隆模型的性能，基于对比学习的思想，提出一种新的损失函数进行网络优化学习。结果在两个公开数据集CIFAR-10(Canadian Institute for Advanced Research-10)和SVHN(street view house numbers)的实验结果表明，本文方法能够取得良好的功能窃取效果。在CIFAR-10数据集上，相比目前较先进的方法，本文方法的窃取精度提高了5%。同时，在相同的查询代价下，本文方法能够取得更好的窃取效果，有效降低了查询目标模型的成本。结论本文提出的模型窃取攻击方法，从数据真实性的角度出发，有效提高了针对图像分类器的模型功能窃取攻击效果，在一定程度上降低了查询目标模型代价。
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.003 | 0.013 |
| Meta-epidemiology (narrow) | 0.001 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.001 |
| Bibliometrics | 0.001 | 0.001 |
| Science and technology studies | 0.001 | 0.004 |
| Scholarly communication | 0.003 | 0.009 |
| Open science | 0.001 | 0.003 |
| Research integrity | 0.001 | 0.003 |
| Insufficient payload (model declined to judge) | 0.007 | 0.001 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".