Can't Hide Behind the API: Stealing Black-Box Commercial Embedding Models

• URL: http://arxiv.org/abs/2406.09355v1
• Date: Thu, 13 Jun 2024 17:40:56 GMT
• Title: Can't Hide Behind the API: Stealing Black-Box Commercial Embedding Models
• Authors: Manveer Singh Tamber, Jasper Xian, Jimmy Lin,
• Abstract summary: Companies such as OpenAI and Cohere have developed competing embedding models accessed through APIs that require users to pay for usage. We present, to our knowledge, the first effort to "steal" these models for retrieval by training local models on text-embedding pairs obtained from the commercial APIs.
• Score: 47.13042922690422
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Embedding models that generate representation vectors from natural language text are widely used, reflect substantial investments, and carry significant commercial value. Companies such as OpenAI and Cohere have developed competing embedding models accessed through APIs that require users to pay for usage. In this architecture, the models are "hidden" behind APIs, but this does not mean that they are "well guarded". We present, to our knowledge, the first effort to "steal" these models for retrieval by training local models on text-embedding pairs obtained from the commercial APIs. Our experiments show using standard benchmarks that it is possible to efficiently replicate the retrieval effectiveness of the commercial embedding models using an attack that costs only around $200 to train (presumably) smaller models with fewer dimensions. Our findings raise important considerations for deploying commercial embedding models and suggest measures to mitigate the risk of model theft.

Related papers

• Stealing Image-to-Image Translation Models With a Single Query [24.819964498441635]
  We study the possibility of stealing image-to-image models. We find that many such models can be stolen with as little as a single, small-sized, query image. Remarkably, we find that the vulnerability to stealing attacks is shared by CNNs and by models with attention mechanisms.
  arXiv  Detail & Related papers  (2024-06-02T18:30:41Z)
• Data-efficient Large Vision Models through Sequential Autoregression [58.26179273091461]
  We develop an efficient, autoregression-based vision model on a limited dataset. We demonstrate how this model achieves proficiency in a spectrum of visual tasks spanning both high-level and low-level semantic understanding. Our empirical evaluations underscore the model's agility in adapting to various tasks, heralding a significant reduction in the parameter footprint.
  arXiv  Detail & Related papers  (2024-02-07T13:41:53Z)
• Beyond Labeling Oracles: What does it mean to steal ML models? [52.63413852460003]
  Model extraction attacks are designed to steal trained models with only query access. We investigate factors influencing the success of model extraction attacks. Our findings urge the community to redefine the adversarial goals of ME attacks.
  arXiv  Detail & Related papers  (2023-10-03T11:10:21Z)
• Towards Few-Call Model Stealing via Active Self-Paced Knowledge Distillation and Diffusion-Based Image Generation [28.447627065654906]
  We propose to copy black-box classification models without having access to the original training data, the architecture, and the weights of the model.<n>We employ a novel active self-paced learning framework to make the most of the proxy data during distillation.<n>Our empirical results on three data sets confirm the superiority of our framework over four state-of-the-art methods in the few-call model extraction scenario.
  arXiv  Detail & Related papers  (2023-09-29T19:09:27Z)
• Isolation and Induction: Training Robust Deep Neural Networks against Model Stealing Attacks [51.51023951695014]
  Existing model stealing defenses add deceptive perturbations to the victim's posterior probabilities to mislead the attackers. This paper proposes Isolation and Induction (InI), a novel and effective training framework for model stealing defenses. In contrast to adding perturbations over model predictions that harm the benign accuracy, we train models to produce uninformative outputs against stealing queries.
  arXiv  Detail & Related papers  (2023-08-02T05:54:01Z)
• Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networks [86.55317144826179]
  Previous methods always leverage the transferable adversarial examples as the model fingerprint. We propose a novel yet simple model stealing detection method based on SAmple Correlation (SAC) SAC successfully defends against various model stealing attacks, even including adversarial training or transfer learning.
  arXiv  Detail & Related papers  (2022-10-21T02:07:50Z)
• Dataset Inference for Self-Supervised Models [21.119579812529395]
  Self-supervised models are increasingly prevalent in machine learning (ML) They are vulnerable to model stealing attacks due to the high dimensionality of vector representations they output. We introduce a new dataset inference defense, which uses the private training set of the victim encoder model to attribute its ownership in the event of stealing.
  arXiv  Detail & Related papers  (2022-09-16T15:39:06Z)
• Petals: Collaborative Inference and Fine-tuning of Large Models [78.37798144357977]
  Many NLP tasks benefit from using large language models (LLMs) that often have more than 100 billion parameters. With the release of BLOOM-176B and OPT-175B, everyone can download pretrained models of this scale. We propose Petals $-$ a system for inference and fine-tuning of large models collaboratively by joining the resources of multiple parties.
  arXiv  Detail & Related papers  (2022-09-02T17:38:03Z)
• MOVE: Effective and Harmless Ownership Verification via Embedded External Features [109.19238806106426]
  We propose an effective and harmless model ownership verification (MOVE) to defend against different types of model stealing simultaneously. We conduct the ownership verification by verifying whether a suspicious model contains the knowledge of defender-specified external features. In particular, we develop our MOVE method under both white-box and black-box settings to provide comprehensive model protection.
  arXiv  Detail & Related papers  (2022-08-04T02:22:29Z)
• On the Difficulty of Defending Self-Supervised Learning against Model Extraction [23.497838165711983]
  Self-Supervised Learning (SSL) is an increasingly popular ML paradigm that trains models to transform complex inputs into representations without relying on explicit labels. This paper explores model stealing attacks against SSL. We construct several novel attacks and find that approaches that train directly on a victim's stolen representations are query efficient and enable high accuracy for downstream models.
  arXiv  Detail & Related papers  (2022-05-16T17:20:44Z)
• Increasing the Cost of Model Extraction with Calibrated Proof of Work [25.096196576476885]
  In model extraction attacks, adversaries can steal a machine learning model exposed via a public API. We propose requiring users to complete a proof-of-work before they can read the model's predictions.
  arXiv  Detail & Related papers  (2022-01-23T12:21:28Z)
• Defending against Model Stealing via Verifying Embedded External Features [90.29429679125508]
  adversaries can steal' deployed models even when they have no training samples and can not get access to the model parameters or structures. We explore the defense from another angle by verifying whether a suspicious model contains the knowledge of defender-specified emphexternal features. Our method is effective in detecting different types of model stealing simultaneously, even if the stolen model is obtained via a multi-stage stealing process.
  arXiv  Detail & Related papers  (2021-12-07T03:51:54Z)
• Beyond Model Extraction: Imitation Attack for Black-Box NLP APIs [36.258615610948524]
  We show that attackers could potentially surpass victims via unsupervised domain adaptation and multi-victim ensemble. In this work, we take the first step of showing that attackers could potentially surpass victims via unsupervised domain adaptation and multi-victim ensemble.
  arXiv  Detail & Related papers  (2021-08-29T10:52:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.