Monitoring-based Differential Privacy Mechanism Against Query-Flooding
  Parameter Duplication Attack
  Public intelligent services enabled by machine learning algorithms are
vulnerable to model extraction attacks that can steal confidential information
of the learning models through public queries. Though there are some protection
options such as differential privacy (DP) and monitoring, which are considered
promising techniques to mitigate this attack, we still find that the
vulnerability persists. In this paper, we propose an adaptive query-flooding
parameter duplication (QPD) attack. The adversary can infer the model
information with black-box access and no prior knowledge of any model
parameters or training data via QPD. We also develop a defense strategy using
DP called monitoring-based DP (MDP) against this new attack. In MDP, we first
propose a novel real-time model extraction status assessment scheme called
Monitor to evaluate the situation of the model. Then, we design a method to
guide the differential privacy budget allocation called APBA adaptively.
Finally, all DP-based defenses with MDP could dynamically adjust the amount of
noise added in the model response according to the result from Monitor and
effectively defends the QPD attack. Furthermore, we thoroughly evaluate and
compare the QPD attack and MDP defense performance on real-world models with DP
and monitoring protection.
