Over the past few years, Machine Learning-as-a-Service (MLaaS) has received a
surging demand for supporting Machine Learning-driven services to offer
revolutionized user experience across diverse application areas. MLaaS provides
inference service with low inference latency to application users based on an
ML model trained using a dataset collected from numerous individual data
owners. Recently, for the sake of data owners' privacy and to comply with the
"right to be forgotten (RTBF)" as enacted by data protection legislation, many
machine unlearning methods have been proposed to remove data owners' data from
trained models upon their unlearning requests. However, despite their promising
efficiency, almost all existing machine unlearning methods handle unlearning
requests in a manner that is independent of inference requests, which
unfortunately introduces new security and privacy vulnerabilities for machine
unlearning in MLaaS. In this paper, we propose the ERASER framework for machinE
unleaRning in MLaAS via an inferencE seRving-aware approach. ERASER proposes a
novel certified inference consistency mechanism that reduces inference latency
by selectively postponing unlearning execution incurred by unlearning requests
from data owners, while strictly adhering to the RTBF principle. ERASER offers
three groups of design choices to allow for tailor-made variants that best suit
the specific environments and preferences of different MLaaS systems. Extensive
empirical evaluations across various settings confirm ERASER's effectiveness,
e.g., it can effectively save up to 99% of inference latency and 31% of
computation overhead over the inference-oblivion baseline.

提出了 ERASER 框架，通过一个推理服务意识的方法来实现 MLaaS 中的机器解学习。ERASER 提供了一种新颖的认证推理一致性机制，通过有选择性地延迟来自数据所有者的解学习请求，从而降低推理延迟，并严格遵守 RTBF 原则。在各种设置下进行了大量实证评估，确认了 ERASER 的效果，例如，它可以有效节省高达 99% 的推理延迟和 31% 的计算开销。

ERASER：MLaaS 中基于推理服务感知的机器消除

ERASER: Machine Unlearning in MLaaS via an Inference Serving-Aware  Approach

Machine Learning-as-a-Service (MLaaS) has become a widespread paradigm,
making even the most complex machine learning models available for clients via
e.g. a pay-per-query principle. This allows users to avoid time-consuming
processes of data collection, hyperparameter tuning, and model training.
However, by giving their customers access to the (predictions of their) models,
MLaaS providers endanger their intellectual property, such as sensitive
training data, optimised hyperparameters, or learned model parameters.
Adversaries can create a copy of the model with (almost) identical behavior
using the the prediction labels only. While many variants of this attack have
been described, only scattered defence strategies have been proposed,
addressing isolated threats. This raises the necessity for a thorough
systematisation of the field of model stealing, to arrive at a comprehensive
understanding why these attacks are successful, and how they could be
holistically defended against. We address this by categorising and comparing
model stealing attacks, assessing their performance, and exploring
corresponding defence techniques in different settings. We propose a taxonomy
for attack and defence approaches, and provide guidelines on how to select the
right attack or defence strategy based on the goal and available resources.
Finally, we analyse which defences are rendered less effective by current
attack strategies.

MLaaS 服务的 “模型窃取” 攻击威胁了提供商的知识产权，本文通过对该领域进行全面系统化的分类和比较，探索了相应的防御技术，并提出了攻击和防御策略的分类法和指南并分析哪些防御策略被当前攻击策略削弱

关于机器学习模型盗窃及其防御的综述：我知道去年你训练过什么

I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences

Machine learning is being increasingly used by individuals, research
institutions, and corporations. This has resulted in the surge of Machine
Learning-as-a-Service (MLaaS) - cloud services that provide (a) tools and
resources to learn the model, and (b) a user-friendly query interface to access
the model. However, such MLaaS systems raise privacy concerns such as model
extraction. In model extraction attacks, adversaries maliciously exploit the
query interface to steal the model. More precisely, in a model extraction
attack, a good approximation of a sensitive or proprietary model held by the
server is extracted (i.e. learned) by a dishonest user who interacts with the
server only via the query interface. This attack was introduced by Tramer et
al. at the 2016 USENIX Security Symposium, where practical attacks for various
models were shown. We believe that better understanding the efficacy of model
extraction attacks is paramount to designing secure MLaaS systems. To that end,
we take the first step by (a) formalizing model extraction and discussing
possible defense strategies, and (b) drawing parallels between model extraction
and established area of active learning. In particular, we show that recent
advancements in the active learning domain can be used to implement powerful
model extraction attacks, and investigate possible defense strategies.

本文介绍了机器学习作为服务（MLaaS）的流行，及其可能带来的隐私问题。作者对模型提取和相关的攻防策略进行了探讨，并探究了主动学习和模型提取之间的联系。