Exploiting explanations for model extraction via knowledge distillation and mitigation with private counterfactuals.

Area of Science:

• Artificial Intelligence
• Machine Learning Security
• Explainable AI (XAI)

Background:

• Machine learning models as a service (MLaaS) are increasingly deployed.
• Explainable AI (XAI) provides insights into ML model decisions, raising privacy concerns.
• Model explanations can be exploited for privacy leakage attacks like model extraction attacks (MEA).

Purpose of the Study:

• Investigate the exploitation of counterfactual explanations (CFs) for MEA in MLaaS platforms.
• Assess the effectiveness of differential privacy (DP) as a mitigation strategy against MEA.
• Propose a novel MEA approach leveraging CFs and Knowledge Distillation (KD).

Main Methods:

• Developed a novel MEA approach using Knowledge Distillation (KD) and counterfactual explanations (CFs).
• Proposed a method for training CF generators with integrated DP to produce private CFs.
• Conducted experiments on real-world datasets to evaluate the proposed MEA and DP mitigation.

Main Results:

• The proposed KD-based MEA successfully extracts high-fidelity substitute models with fewer queries than baselines.
• Integrating a privacy layer using DP effectively mitigates MEA.
• Balancing CF quality impacts explanation performance and MEA effectiveness.

Conclusions:

• Counterfactual explanations in MLaaS pose significant privacy risks exploitable via MEA.
• Differential privacy offers a viable mitigation strategy against explanation-based MEA.
• Further research is needed to balance privacy guarantees with the utility of explanations.