블랙 박스 모델의 출력값을 이용한 AI 모델 종류 추론 공격
Model Type Inference Attack Using Output of Black-Box AI Model
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
AI 기술이 여러 분야에 성공적으로 도입되는 추세이며, 서비스로 환경에 배포된 모델들은 지적 재산권과 데이터를 보호하기 위해 모델의 정보를 노출시키지 않는 블랙 박스 상태로 배포된다. 블랙 박스 환경에서 공격자들은 모델 출력을 이용해 학습에 쓰인 데이터나 파라미터를 훔치려고 한다. 본 논문은 딥러닝 모델을 대상으로 모델 종류에 대한 정보를 추론하는 공격이 없다는 점에서 착안하여, 모델의 구성 레이어 정보를 직접 알아내기 위해 모델의 종류를 추론하는 공격 방법을 제안한다. MNIST 데이터셋으로 학습된 ResNet, VGGNet, AlexNet과 간단한 컨볼루션 신경망 모델까지 네 가지 모델의 그레이 박스 및 블랙 박스 환경에서의 출력값을 이용해 모델의 종류가 추론될 수 있다는 것을 보였다. 또한 본 논문이 제안하는 방식인 대소 관계 피쳐를 딥러닝 모델에 함께 학습시킨 경우 블랙 박스 환경에서 약 83%의 정확도로 모델의 종류를 추론했으며, 그 결과를 통해 공격자에게 확률 벡터가 아닌 제한된 정보만 제공되는 상황에서도 모델 종류가 추론될 수 있음을 보였다.
Abstract
AI technology is being successfully introduced in many fields, and models deployed as a service are deployed with black box environment that does not expose the model's information to protect intellectual property rights and data. In a black box environment, attackers try to steal data or parameters used during training by using model output. This paper proposes a method of inferring the type of model to directly find out the composition of layer of the target model, based on the fact that there is no attack to infer the information about the type of model from the deep learning model. With ResNet, VGGNet, AlexNet, and simple convolutional neural network models trained with MNIST datasets, we show that the types of models can be inferred using the output values in the gray box and black box environments of the each model. In addition, we inferred the type of model with approximately 83% accuracy in the black box environment if we train the big and small relationship feature that proposed in this paper together, the results show that the model type can be infrerred even in situations where only partial information is given to attackers, not raw probability vectors.
참고문헌 (26)
- M. Ribeiro, "MLaaS: Machine Learni ng as a Service", 2015 IEEE 14th Inte rnational Conference on Machine Lear ning and Applications (ICMLA), pp.896~902 (2015)
- A. Ilyas, "Black-box Adversarial Attacks with Limited Queries and Informatio n", Proceedings of the 35th Internatio nal Conference on Machine Learning, 80, pp.2137~2146 (2018), PMLR
- K. Ren, "Adversarial Attacks and Defenses in Deep Learning", Engineering, 6(3), pp.346~360 (2020)
- M. Barreno, "The security of machin e learning", Machine Learning, 81, pp.121~148 (2010)
- A. Oseni, "Secur ity and Privacy for Artificial Intellige nce: Opportunities and Challenges", a rXiv, ~ (2021)
- O. Bastani, "Interpreting Blackbox Models via Mo del Extraction", arXiv, ~ (2017)
- M. kesarwani, "Model Extraction Warning in MLaaS Paradigm", arXiv, ~ (2017)
- M. Fredrikson, "Model Inversion Attacks that Ex ploit Confidence Information and Basic Countermeasures", Proceedings of th e 22nd ACM SIGSAC Conference on Co mputer and Communications Security (CCS '15), pp.1322~1333 (2015)
- W. Brendel, "Decision-Based Adversarial Attacks:Reliable Attacks Against Black-Box M achine Learning Models", Internationa l Conference on Learning Representati ons (2018)
- R. Shokri, "Membership Inference Attacks Against Machine Learning Mo dels", 2017 IEEE Symposium on Secur ity and Privacy (SP), pp.3~18 (2017)
- J. Hayes, "LOGAN: Membership i nference attacks against generative m odels", arXiv, ~ (2018)
- S. Alfeld, "Dat a Poisoning Attacks against Autoregre ssive Models", Proceedings of the AAA I Conference on Artificial Intelligence, 30(1) (2016)
- M. Jagielski, "Manipulating Mac hine Learning: Poisoning Attacks and Countermeasures for Regression Lear ning", 2018 IEEE Symposium on Secur ity and Privacy (SP), pp.19~35 (2018)
- B. Biggio, "Evasion Attacks agai nst Machine Learning at Test Time, In Machine Learning and Knowledge Discovery in Databases. ECML PKDD 2013", Lecture Notes in Computer Scie nce, 8190, pp.387~402 (2013)
- T. S. Sethi, "Data driven exploratory attacks on black b ox classifiers in adversarial domains", Neurocomputing, 289, pp.129~143 (2018)
- A. Krizhevsky, "ImageNet classification wi th deep convolutional neural network s", Association for Computing Machine ry, 60(6), pp.84~90 (2017)
- O. Russakovsky, "ImageNet Large Scale Visual Reco gnition Challenge", International Jour nal of Computer Vision, 115, pp.211~252 (2015)
- N. Zhang, "Ima ge parallel processing based on GPU", 2010 2nd International Conference on Advanced Computer Control, pp.367~370 (2010)
- A. F. Agarap, "Deep Learning using R ectified Linear Units(ReLU)", arXiv, ~ (2019)
- K. Simonyan, "Ver y Deep Convolutional Networks for La rge-Scale Image Recognition", arXiv, ~ (2015)
- S. Hochreiter, "The vanishing gradient problem during learning recurrent ne ural nets and problem solutions", Inte rnational Journal of Uncertainty, Fuz ziness Knowledge-Based Systems, 6(2), pp.107~116 (1998)
- R. Pascanu, "On the difficulty of training recurren t neural networks", Proceedings of the 30th International Conference on Mac hine Learning, 28(3), pp.1310~1318 (2013), PMLR
- K. He, "Deep Residual Learning for Image Rec ognition", 2016 IEEE Conference on Computer Vision and Pattern Recogniti on (CVPR), pp.770~778 (2016)
- T. Fawcett, "An introduction to ROC a nalysis", Pattern Recognition Letter s, 27(8), pp.861~874 (2005)
- "IEEE Signal Processing Magazine", 2012, 141~142
- "Keras code example(Computer Visio n), Simple MNIIST convnet"[URL]