FDINet: Protecting against DNN Model Extraction via Feature Distortion Index
Not on the map. Why?
Abstract (arXiv)
Machine Learning as a Service (MLaaS) platforms have gained popularity due to their accessibility, cost-efficiency, scalability, and rapid development capabilities. However, recent research has highlighted the vulnerability of cloud-based models in MLaaS to model extraction attacks. In this paper, we introduce FDINET, a novel defense mechanism that leverages the feature distribution of deep neural network (DNN) models. Concretely, by analyzing the feature distribution from the adversary's queries, we reveal that the feature distribution of these queries deviates from that of the model's training set. Based on this key observation, we propose Feature Distortion Index (FDI), a metric designed to quantitatively measure the feature distribution deviation of received queries. The proposed FDINET utilizes FDI to train a binary detector and exploits FDI similarity to identify colluding adversaries from distributed extraction attacks. We conduct extensive experiments to evaluate FDINET against six state-of-the-art extraction attacks on four benchmark datasets and four popular model architectures. Empirical results demonstrate the following findings FDINET proves to be highly effective in detecting model extraction, achieving a 100% detection accuracy on DFME and DaST. FDINET is highly efficient, using just 50 queries to raise an extraction alarm with an average confidence of 96.08% for GTSRB. FDINET exhibits the capability to identify colluding adversaries with an accuracy exceeding 91%. Additionally, it demonstrates the ability to detect two types of adaptive attacks.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 39 of its 67 references that are in the map. First posted on arXiv 20 Jun 2023.
Builds on
39 of 67 references.
References · 39
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
- 2016Practical Black-Box Attacks against Machine Learningcited by 903
- 2019Skin Lesion Analysis Toward Melanoma Detection 2018: A Challenge Hosted by the International Skin Imaging Collaboration (ISIC)cited by 669
- 2016Stealing Machine Learning Models via Prediction APIscited by 619
- 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
- 2019BCN20000: Dermoscopic Lesions in the Wildcited by 225
- 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
- 2018PRADA: Protecting against DNN Model Stealing Attackscited by 165
- 2020Entangled Watermarks as a Defense against Model Extractioncited by 149
- 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 139
- 2020Data-Free Model Extractioncited by 124
- 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 116
27 more
- 2020Stealing Links from Graph Neural Networkscited by 115
- 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 100
- 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
- 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 93
- 2018Exploring Connections Between Active Learning and Model Extractioncited by 85
- 2019Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attackscited by 81
- 2018Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Datacited by 70
- 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
- 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 58
- 2019Defending Against Model Stealing Attacks with Adaptive Misinformationcited by 57
- 2021Model Stealing Attacks Against Inductive Graph Neural Networkscited by 50
- 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 46
- 2017Interpreting Blackbox Models via Model Extractioncited by 44
- 2017Model Extraction Warning in MLaaS Paradigmcited by 40
- 2022Dataset Inference for Self-Supervised Modelscited by 36
- 2021MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AIcited by 35
- 2022DualCF: Efficient Model Extraction Attack from Counterfactual Explanationscited by 32
- 2022Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoderscited by 31
- 2021Delving into Data: Effectively Substitute Training for Black-box Attackcited by 27
- 2020Black-Box Ripper: Copying black-box models using generative evolutionary algorithmscited by 26
- 2022Increasing the Cost of Model Extraction with Calibrated Proof of Workcited by 21
- 2022How to Steer Your Adversary: Targeted and Efficient Model Stealing Defenses with Gradient Redirectioncited by 21
- 2020MLModelCI: An Automatic Cloud Platform for Efficient MLaaScited by 16
- 2021Teacher Model Fingerprinting Attacks Against Transfer Learningcited by 16
- 2022MetaV: A Meta-Verifier Approach to Task-Agnostic Model Fingerprintingcited by 16
- 2021Stateful Detection of Model Extraction Attackscited by 8
- 2020MEME: Generating RNN Model Explanations via Model Extractioncited by 7
Built on by
Citing papers per year: 2023: 2; 2024: 0; 2025: 1.
3 papers.