HODA: Hardness-Oriented Detection of Model Extraction Attacks
  Model Extraction attacks exploit the target model's prediction API to create
a surrogate model in order to steal or reconnoiter the functionality of the
target model in the black-box setting. Several recent studies have shown that a
data-limited adversary who has no or limited access to the samples from the
target model's training data distribution can use synthesis or semantically
similar samples to conduct model extraction attacks. In this paper, we define
the hardness degree of a sample using the concept of learning difficulty. The
hardness degree of a sample depends on the epoch number that the predicted
label of that sample converges. We investigate the hardness degree of samples
and demonstrate that the hardness degree histogram of a data-limited
adversary's sample sequences is distinguishable from the hardness degree
histogram of benign users' samples sequences. We propose Hardness-Oriented
Detection Approach (HODA) to detect the sample sequences of model extraction
attacks. The results demonstrate that HODA can detect the sample sequences of
model extraction attacks with a high success rate by only monitoring 100
samples of them, and it outperforms all previous model extraction detection
methods.
