Can't Hide Behind the API: Stealing Black-Box Commercial Embedding Models

• URL: http://arxiv.org/abs/2406.09355v1
• Date: Thu, 13 Jun 2024 17:40:56 GMT
• Title: Can't Hide Behind the API: Stealing Black-Box Commercial Embedding Models
• Authors: Manveer Singh Tamber, Jasper Xian, Jimmy Lin,
• Abstract summary: Companies such as OpenAI and Cohere have developed competing embedding models accessed through APIs that require users to pay for usage. We present, to our knowledge, the first effort to "steal" these models for retrieval by training local models on text-embedding pairs obtained from the commercial APIs.
• Score: 47.13042922690422
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Embedding models that generate representation vectors from natural language text are widely used, reflect substantial investments, and carry significant commercial value. Companies such as OpenAI and Cohere have developed competing embedding models accessed through APIs that require users to pay for usage. In this architecture, the models are "hidden" behind APIs, but this does not mean that they are "well guarded". We present, to our knowledge, the first effort to "steal" these models for retrieval by training local models on text-embedding pairs obtained from the commercial APIs. Our experiments show using standard benchmarks that it is possible to efficiently replicate the retrieval effectiveness of the commercial embedding models using an attack that costs only around $200 to train (presumably) smaller models with fewer dimensions. Our findings raise important considerations for deploying commercial embedding models and suggest measures to mitigate the risk of model theft.

Related papers

• Stealing Image-to-Image Translation Models With a Single Query [24.819964498441635]
  We study the possibility of stealing image-to-image models. We find that many such models can be stolen with as little as a single, small-sized, query image. Remarkably, we find that the vulnerability to stealing attacks is shared by CNNs and by models with attention mechanisms.
  arXiv  Detail & Related papers  (2024-06-02T18:30:41Z)
• Data-efficient Large Vision Models through Sequential Autoregression [58.26179273091461]
  We develop an efficient, autoregression-based vision model on a limited dataset. We demonstrate how this model achieves proficiency in a spectrum of visual tasks spanning both high-level and low-level semantic understanding. Our empirical evaluations underscore the model's agility in adapting to various tasks, heralding a significant reduction in the parameter footprint.
  arXiv  Detail & Related papers  (2024-02-07T13:41:53Z)
• Beyond Labeling Oracles: What does it mean to steal ML models? [52.63413852460003]
  Model extraction attacks are designed to steal trained models with only query access. We investigate factors influencing the success of model extraction attacks. Our findings urge the community to redefine the adversarial goals of ME attacks.
  arXiv  Detail & Related papers  (2023-10-03T11:10:21Z)
• Petals: Collaborative Inference and Fine-tuning of Large Models [78.37798144357977]
  Many NLP tasks benefit from using large language models (LLMs) that often have more than 100 billion parameters. With the release of BLOOM-176B and OPT-175B, everyone can download pretrained models of this scale. We propose Petals $-$ a system for inference and fine-tuning of large models collaboratively by joining the resources of multiple parties.
  arXiv  Detail & Related papers  (2022-09-02T17:38:03Z)
• MOVE: Effective and Harmless Ownership Verification via Embedded External Features [109.19238806106426]
  We propose an effective and harmless model ownership verification (MOVE) to defend against different types of model stealing simultaneously. We conduct the ownership verification by verifying whether a suspicious model contains the knowledge of defender-specified external features. In particular, we develop our MOVE method under both white-box and black-box settings to provide comprehensive model protection.
  arXiv  Detail & Related papers  (2022-08-04T02:22:29Z)
• On the Difficulty of Defending Self-Supervised Learning against Model Extraction [23.497838165711983]
  Self-Supervised Learning (SSL) is an increasingly popular ML paradigm that trains models to transform complex inputs into representations without relying on explicit labels. This paper explores model stealing attacks against SSL. We construct several novel attacks and find that approaches that train directly on a victim's stolen representations are query efficient and enable high accuracy for downstream models.
  arXiv  Detail & Related papers  (2022-05-16T17:20:44Z)
• Increasing the Cost of Model Extraction with Calibrated Proof of Work [25.096196576476885]
  In model extraction attacks, adversaries can steal a machine learning model exposed via a public API. We propose requiring users to complete a proof-of-work before they can read the model's predictions.
  arXiv  Detail & Related papers  (2022-01-23T12:21:28Z)
• Defending against Model Stealing via Verifying Embedded External Features [90.29429679125508]
  adversaries can steal' deployed models even when they have no training samples and can not get access to the model parameters or structures. We explore the defense from another angle by verifying whether a suspicious model contains the knowledge of defender-specified emphexternal features. Our method is effective in detecting different types of model stealing simultaneously, even if the stolen model is obtained via a multi-stage stealing process.
  arXiv  Detail & Related papers  (2021-12-07T03:51:54Z)
• Beyond Model Extraction: Imitation Attack for Black-Box NLP APIs [36.258615610948524]
  We show that attackers could potentially surpass victims via unsupervised domain adaptation and multi-victim ensemble. In this work, we take the first step of showing that attackers could potentially surpass victims via unsupervised domain adaptation and multi-victim ensemble.
  arXiv  Detail & Related papers  (2021-08-29T10:52:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.