Stealing Neural Networks With Model Extraction Attacks, Dr. Nicholas Carlini

Neural networks have recently become sufficiently accurate across a wide range of tasks that they are now deployed in many practical settings. In order to protect their intellectual property and security, these models are often only released through black-box prediction APIs, or when they must be released on-device, are stored encrypted or obfuscated.

In this talk I develop the techniques necessary to steal neural networks by directly extracting their parameters. Unlike attacks that train a copy of a neural network to behave similarly on most inputs, model extraction attacks recover a functionally equivalent model that behaves identically on all inputs. For example, we can extract a hundred thousand parameter model that behaves matches the original with at least 25 bits of precision.

I conclude with a discussion of the theoretical and practical consequences of such attacks, along with the directions for future work necessary to scale these attacks to more realistic environments.