Counterfactual explanations find ways of achieving a favorable model outcome
with minimum input perturbation. However, counterfactual explanations can also
be exploited to steal the model by strategically training a surrogate model to
give similar predictions as the original (target) model. In this work, we
investigate model extraction by specifically leveraging the fact that the
counterfactual explanations also lie quite close to the decision boundary. We
propose a novel strategy for model extraction that we call Counterfactual
Clamping Attack (CCA) which trains a surrogate model using a unique loss
function that treats counterfactuals differently than ordinary instances. Our
approach also alleviates the related problem of decision boundary shift that
arises in existing model extraction attacks which treat counterfactuals as
ordinary instances. We also derive novel mathematical relationships between the
error in model approximation and the number of queries using polytope theory.
Experimental results demonstrate that our strategy provides improved fidelity
between the target and surrogate model predictions on several real world
datasets.

通过利用虚拟的解释接近决策边界的特点，我们提出了一种称为 Counterfactual Clamping Attack (CCA) 的新型模型提取策略，该策略训练一个使用独特损失函数的代理模型，该损失函数将虚拟解释与普通实例区分对待。我们还通过多胞体理论推导出了模型逼近误差与查询数量之间的新的数学关系。实验证明，我们的策略在几个真实世界数据集上提供了改进的目标和代理模型预测一致性。