Scholarlink

Classic Machine Learning as a Service (MLaaS) solutions suffer from privacy-related risks since the user inputs are sent in the clear to the server hosting the ML model. To alleviate this problem, a thriving line of research has emerged, called Privacy-Preserving Machine Learning (PPML) or secure MLaaS, that uses cryptographic techniques such as Fully Homomorphic Encryption (FHE) to preserve the privacy of both the client’s input and the server’s output. FHE-based secure MLaaS solutions bear a resemblance to classic MLaaS solutions. This similarity arises from the fact that the client interacts with the server hosting the ML model only twice. The first interaction occurs when the client sends its encrypted input, while the second interaction takes place when the client receives the still-encrypted inference result. The entire inference runs on the server, albeit on encrypted data. However, this similarity also begs the question of whether these FHE-based secure MLaaS solutions are vulnerable to model-stealing attacks from the classic MLaaS setting. In this paper, we, for the first time in literature, investigate the transferability of the well-known model-stealing attacks from the classic to the secure MLaaS domain. We demonstrate two attacks from the classic MLaaS setting, namely Jacobian-based Dataset Augmentation (JBDA) and KnockoffNets, on FHE-based image classification tasks to highlight the practicality of the attacks. We then argue that while the existing attacks are portable to the PPML setting, the same does not hold for the existing defenses. To support our argument, we present a detailed study of popular defenses against model-stealing attacks. We highlight the gap between their implementation in the classic MLaaS and the incompatibility of their underlying operations with that of the FHE operations. Finally, we demonstrate a countermeasure against these attacks that lowers the accuracy of the stolen model while minimally affecting the accuracy of the victim model on benign queries, without compromising the privacy of the client’s data.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

On the Security of Privacy-Preserving Machine Learning Against Model Stealing Attacks

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Bhuvnesh Chaturvedi,
  • Anirban Chakraborty,
  • Ayantika Chatterjee,
  • Debdeep Mukhopadhyay

摘要

Classic Machine Learning as a Service (MLaaS) solutions suffer from privacy-related risks since the user inputs are sent in the clear to the server hosting the ML model. To alleviate this problem, a thriving line of research has emerged, called Privacy-Preserving Machine Learning (PPML) or secure MLaaS, that uses cryptographic techniques such as Fully Homomorphic Encryption (FHE) to preserve the privacy of both the client’s input and the server’s output. FHE-based secure MLaaS solutions bear a resemblance to classic MLaaS solutions. This similarity arises from the fact that the client interacts with the server hosting the ML model only twice. The first interaction occurs when the client sends its encrypted input, while the second interaction takes place when the client receives the still-encrypted inference result. The entire inference runs on the server, albeit on encrypted data. However, this similarity also begs the question of whether these FHE-based secure MLaaS solutions are vulnerable to model-stealing attacks from the classic MLaaS setting. In this paper, we, for the first time in literature, investigate the transferability of the well-known model-stealing attacks from the classic to the secure MLaaS domain. We demonstrate two attacks from the classic MLaaS setting, namely Jacobian-based Dataset Augmentation (JBDA) and KnockoffNets, on FHE-based image classification tasks to highlight the practicality of the attacks. We then argue that while the existing attacks are portable to the PPML setting, the same does not hold for the existing defenses. To support our argument, we present a detailed study of popular defenses against model-stealing attacks. We highlight the gap between their implementation in the classic MLaaS and the incompatibility of their underlying operations with that of the FHE operations. Finally, we demonstrate a countermeasure against these attacks that lowers the accuracy of the stolen model while minimally affecting the accuracy of the victim model on benign queries, without compromising the privacy of the client’s data.