Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Models
Not on the map. Why?
Abstract (arXiv)
Machine learning models are typically made available to potential client users via inference APIs. Model extraction attacks occur when a malicious client uses information gleaned from queries to the inference API of a victim model FV to build a surrogate model FA with comparable functionality. Recent research has shown successful model extraction of image classification, and natural language processing models. In this paper, we show the first model extraction attack against real-world generative adversarial network (GAN) image translation models. We present a framework for conducting such attacks, and show that an adversary can successfully extract functional surrogate models by querying FV using data from the same domain as the training data for FV. The adversary need not know FV's architecture or any other information about it beyond its intended task. We evaluate the effectiveness of our attacks using three different instances of two popular categories of image translation: (1) Selfie-to-Anime and (2) Monet-to-Photo (image style transfer), and (3) Super-Resolution (super resolution). Using standard performance metrics for GANs, we show that our attacks are effective. Furthermore, we conducted a large scale (125 participants) user study on Selfie-to-Anime and Monet-to-Photo to show that human perception of the images produced by FV and FA can be considered equivalent, within an equivalence bound of Cohen's d = 0.3. Finally, we show that existing defenses against model extraction attacks (watermarking, adversarial examples, poisoning) do not extend to image translation models.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 32 of its 54 references that are in the map. First posted on arXiv 26 Apr 2021.
Builds on
32 of 54 references.
References · 32
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
- 2016Image-to-Image Translation with Conditional Adversarial Networkscited by 4,510
- 2014Deep Learning Face Attributes in the Wildcited by 3,679
- 2016Photo-Realistic Single Image Super-Resolution Using a Generative Adversarial Networkcited by 1,898
- 2017StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translationcited by 1,036
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2016Stealing Machine Learning Models via Prediction APIscited by 602
- 2017Deep Laplacian Pyramid Networks for Fast and Accurate Super-Resolutioncited by 452
- 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
- 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
- 2017Are GANs Created Equal? A Large-Scale Studycited by 267
20 more
- 2020DeepFakes and Beyond: A Survey of Face Manipulation and Fake Detectioncited by 231
- 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 208
- 2020Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Datacited by 200
- 2019U-GAT-IT: Unsupervised Generative Attentional Networks with Adaptive Layer-Instance Normalization for Image-to-Image Translationcited by 186
- 2018PRADA: Protecting against DNN Model Stealing Attackscited by 159
- 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
- 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
- 2020Stealing Links from Graph Neural Networkscited by 114
- 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
- 2019Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attackscited by 79
- 2020Imitation Attacks and Defenses for Black-box Machine Translation Systemscited by 78
- 2018Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Datacited by 69
- 2018Cache Telepathy: Leveraging Shared Resource Attacks to Learn DNN Architecturescited by 56
- 2019Defending Against Model Stealing Attacks with Adaptive Misinformationcited by 55
- 2020Model Watermarking for Image Processing Networkscited by 49
- 2018Stealing Neural Networks via Timing Side Channelscited by 42
- 2017Model Extraction Warning in MLaaS Paradigmcited by 39
- 2019Extraction of Complex DNN Models: Real Threat or Boogeyman?cited by 19
- 2021Model Extraction and Defenses on Generative Adversarial Networkscited by 8
- 2020Model Extraction Attacks against Recurrent Neural Networkscited by 7
Built on by
Citing papers per year: 2024: 1; 2025: 2.
3 papers.