AugSteal: Advancing Model Steal With Data Augmentation in Active Learning Frameworks
Lijun Gao, Wenjun Liu, Kai Liu, Jiehong Wu · IEEE Transactions on Information Forensics and Security · 2024
With the proliferation of machine learning models in diverse applications, the issue of model security has increasingly become a focal point. Model steal attacks can cause significant financial losses to model owners and potentially threaten the security of their application scenarios. Traditional model steal attacks are primarily directed at soft-label black boxes, but their effectiveness significantly diminishes or even fails in hard-label scenarios. To address this, for hard-label black boxes, this study proposes an active learning-based Fusion Augmentation Model Stealing Framework (AugSteal). This framework initially utilizes large-scale irrelevant public datasets for deep filtering and feature extraction to generate reliable, diverse, and representative high-quality data subsets as the stealing dataset. Subsequently, we developed an adaptive active learning selection strategy that selects data samples with significant information gain for different black-box models, enhancing the attack’s specificity and effectiveness. Finally, to further address the trade-off between query budget and steal precision, this paper designed a Fusion Augmentation training method constituted of two different loss functions, enabling the substitute model to closely approximate the decision distribution of the target black box.The comprehensive experimental results indicate that, compared to the current state-of-the-art attack methods, our approach achieved a maximum performance gain of 8.21% in functional similarity for the substitute models in simulated black-box scenarios CIFAR10, SVHN, CALTECH256, and the real-world application Tencent Cloud API.