In a model extraction attack, an adversary steals a copy of a remotely
deployed machine learning model, given oracle prediction access. We taxonomize
model extraction attacks around two objectives: *accuracy*, i.e., performing
well on the underlying learning task, and *fidelity*, i.e., matching the
predictions of the remote victim classifier on any input.
To extract a high-accuracy model, we develop a learning-based attack
exploiting the victim to supervise the training of an extracted model. Through
analytical and empirical arguments, we then explain the inherent limitations
that prevent any learning-based strategy from extracting a truly high-fidelity
model---i.e., extracting a functionally-equivalent model whose predictions are
identical to those of the victim model on all possible inputs. Addressing these
limitations, we expand on prior work to develop the first practical
functionally-equivalent extraction attack for direct extraction (i.e., without
training) of a model's weights.
We perform experiments both on academic datasets and a state-of-the-art image
classifier trained with 1 billion proprietary images. In addition to broadening
the scope of model extraction research, our work demonstrates the practicality
of model extraction attacks against production-grade systems.

本文介绍了模型提取攻击的两种不同目标 —— 准确度和等效性，并介绍了对于直接提取模型权重的功能性提取攻击的扩展，以及在学术数据集和一种使用 10 亿专有图像训练的最先进图像分类器上进行的实验。