Model extraction (ME) attacks represent one major threat to
Machine-Learning-as-a-Service (MLaaS) platforms by ``stealing'' the
functionality of confidential machine-learning models through querying
black-box APIs. Over seven years have passed since ME attacks were first
conceptualized in the seminal work. During this period, substantial advances
have been made in both ME attacks and MLaaS platforms, raising the intriguing
question: How has the vulnerability of MLaaS platforms to ME attacks been
evolving? In this work, we conduct an in-depth study to answer this critical
question. Specifically, we characterize the vulnerability of current,
mainstream MLaaS platforms to ME attacks from multiple perspectives including
attack strategies, learning techniques, surrogate-model design, and benchmark
tasks. Many of our findings challenge previously reported results, suggesting
emerging patterns of ME vulnerability. Further, by analyzing the vulnerability
of the same MLaaS platforms using historical datasets from the past four years,
we retrospectively characterize the evolution of ME vulnerability over time,
leading to a set of interesting findings. Finally, we make suggestions about
improving the current practice of MLaaS in terms of attack robustness. Our
study sheds light on the current state of ME vulnerability in the wild and
points to several promising directions for future research.

模型提取攻击是对机器学习即服务（MLaaS）平台的机器学习模型功能性进行 “窃取” 的主要威胁，本文通过综合多个角度对当前 MLaaS 平台的模型提取漏洞进行了深入研究，揭示了漏洞的演化规律，并提出了一些提高 MLaaS 的安全性的建议。

模型提取攻击再审视

Model Extraction Attacks Revisited

Reducing the latency variance in machine learning inference is a key
requirement in many applications. Variance is harder to control in a cloud
deployment in the presence of stragglers. In spite of this challenge, inference
is increasingly being done in the cloud, due to the advent of affordable
machine learning as a service (MLaaS) platforms. Existing approaches to reduce
variance rely on replication which is expensive and partially negates the
affordability of MLaaS. In this work, we argue that MLaaS platforms also
provide unique opportunities to cut the cost of redundancy. In MLaaS platforms,
multiple inference requests are concurrently received by a load balancer which
can then create a more cost-efficient redundancy coding across a larger
collection of images. We propose a novel convolutional neural network model,
Collage-CNN, to provide a low-cost redundancy framework. A Collage-CNN model
takes a collage formed by combining multiple images and performs multi-image
classification in one shot, albeit at slightly lower accuracy. We then augment
a collection of traditional single image classifiers with a single Collage-CNN
classifier which acts as a low-cost redundant backup. Collage-CNN then provides
backup classification results if a single image classification straggles.
Deploying the Collage-CNN models in the cloud, we demonstrate that the 99th
percentile tail latency of inference can be reduced by 1.47X compared to
replication based approaches while providing high accuracy. Also, variation in
inference latency can be reduced by 9X with a slight increase in average
inference latency.

提出了一种使用 Collage-CNN 模型结合 MLaaS 平台的低成本冗余框架来降低 Inference 的尾延迟，并降低推理延迟的变异性的方法。实验表明，相对于以复制为基础的方法，可以将推理的 99-percentile 尾延迟降低 1.47 倍，同时保持高准确性。