DNN Intellectual Property Extraction Using Composite Data.

Area of Science:

• Artificial Intelligence
• Machine Learning
• Deep Learning

Background:

• Deep neural networks (DNNs) are integral to AI products and services.
• Intellectual property theft via knowledge extraction from DNNs is a growing concern.
• Mimicking attacks, using student models to replicate DNN outputs, pose a significant threat.

Purpose of the Study:

• To introduce a novel method for attacking mentor neural networks using a student model.
• To demonstrate the effectiveness of this method even without knowledge of the mentor's dataset, architecture, or weights.
• To assess the vulnerability of DNNs to mimicking attacks and the detectability of student models.

Main Methods:

• A novel method for generating composite images to attack a mentor neural network.
• Training a student network to mimic mentor outputs without assumptions on mentor's data, architecture, or weights.
• Evaluating the student model's accuracy and its imperviousness to watermarking protection.

Main Results:

• The student model achieved 99% relative accuracy to the protected mentor model on the Cifar-10 test set.
• The developed student network successfully mimicked the mentor network, stealing significant knowledge.
• The student model evaded detection by existing watermarking protection methods.

Conclusions:

• All current neural networks are vulnerable to mimicking attacks, even with basic output.
• Student models that mimic mentor networks are difficult to detect using current techniques.
• Existing protection mechanisms against knowledge extraction are insufficient.