论文标题
寻求：针对混合安全推理方案的模型提取攻击
SEEK: model extraction attack against hybrid secure inference protocols
论文作者
论文摘要
对预测中使用的机器学习模型的安全性问题包括模型的隐私，查询和结果。已经开发了基于同态加密（HE）和/或多方计算（MPC）的安全推理解决方案，以保护所有敏感信息。最有效的解决方案之一是将HE用于线性层，而MPC用于非线性层。但是，对于具有半honest安全性的此类混合协议，对手可以在推理过程中的中间特征进行介绍，并且比针对明文中的推理服务更有效地提取模型信息。在本文中，我们建议Seek，这是一种仅输出类标签的混合安全推理服务的一般提取方法。该方法可以独立提取目标模型的每个层，并且不受模型深度的影响。对于RESNET-18，Seek可以平均提取少于50个查询的参数，平均错误小于$ 0.03 \％$。
Security concerns about a machine learning model used in a prediction-as-a-service include the privacy of the model, the query and the result. Secure inference solutions based on homomorphic encryption (HE) and/or multiparty computation (MPC) have been developed to protect all the sensitive information. One of the most efficient type of solution utilizes HE for linear layers, and MPC for non-linear layers. However, for such hybrid protocols with semi-honest security, an adversary can malleate the intermediate features in the inference process, and extract model information more effectively than methods against inference service in plaintext. In this paper, we propose SEEK, a general extraction method for hybrid secure inference services outputing only class labels. This method can extract each layer of the target model independently, and is not affected by the depth of the model. For ResNet-18, SEEK can extract a parameter with less than 50 queries on average, with average error less than $0.03\%$.
