English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Model extraction attacks are designed to steal trained models with only queryaccess, as is often provided through APIs that ML-as-a-Service providers offer.ML models are expensive to train, in part because data is hard to obtain, and aprimary incentive for model extraction is to acquire a model while incurringless cost than training from scratch. Literature on model extraction commonlyclaims or presumes that the attacker is able to save on both data acquisitionand labeling costs. We show that the attacker often does not. This is becausecurrent attacks implicitly rely on the adversary being able to sample from thevictim model's data distribution. We thoroughly evaluate factors influencingthe success of model extraction. We discover that prior knowledge of theattacker, i.e. access to in-distribution data, dominates other factors like theattack policy the adversary follows to choose which queries to make to thevictim model API. Thus, an adversary looking to develop an equally capablemodel with a fixed budget has little practical incentive to perform modelextraction, since for the attack to work they need to collect in-distributiondata, saving only on the cost of labeling. With low labeling costs in thecurrent market, the usefulness of such attacks is questionable. Ultimately, wedemonstrate that the effect of prior knowledge needs to be explicitly decoupledfrom the attack policy. To this end, we propose a benchmark to evaluate attackpolicy directly.

Beyond Labeling Oracles: What does it mean to steal ML models?