Machine-learning-as-a-service (MLaaS) has attracted millions of users to
their splendid large-scale models. Although published as black-box APIs, the
valuable models behind these services are still vulnerable to imitation
attacks. Recently, a series of works have demonstrated that attackers manage to
steal or extract the victim models. Nonetheless, none of the previous stolen
models can outperform the original black-box APIs. In this work, we conduct
unsupervised domain adaptation and multi-victim ensemble to showing that
attackers could potentially surpass victims, which is beyond previous
understanding of model extraction. Extensive experiments on both benchmark
datasets and real-world APIs validate that the imitators can succeed in
outperforming the original black-box models on transferred domains. We consider
our work as a milestone in the research of imitation attack, especially on NLP
APIs, as the superior performance could influence the defense or even
publishing strategy of API providers.

利用无监督域适应和多受害者集成的方法，攻击者可能会在 NLP API 中超越原始黑盒模型，这是对模型提取以前的理解的超越，验证结果表明模仿者可以在转移领域中成功地胜过原始的黑盒模型，这将影响 API 提供者的防御或发布策略。