### The Limits of Provable Security Against Model Extraction

##### Abstract

Can we hope to provide provable security against model extraction attacks? As a step towards a theoretical study of this question, we unify and abstract a wide range of "observational" model extraction defense mechanisms -- roughly, those that attempt to detect model extraction using a statistical analysis conducted on the distribution over the adversary's queries. To accompany the abstract observational model extraction defense, which we call OMED for short, we define the notion of complete defenses -- the notion that benign clients can freely interact with the model -- and sound defenses -- the notion that adversarial clients are caught and prevented from reverse engineering the model. We then propose a system for obtaining provable security against model extraction by complete and sound OMEDs, using (average-case) hardness assumptions for PAC-learning. Our main result nullifies our proposal for provable security, by establishing a computational incompleteness theorem for the OMED: any efficient OMED for a machine learning model computable by a polynomial size decision tree that satisfies a basic form of completeness cannot satisfy soundness, unless the subexponential Learning Parity with Noise (LPN) assumption does not hold. To prove the incompleteness theorem, we introduce a class of model extraction attacks called natural Covert Learning attacks based on a connection to the Covert Learning model of Canetti and Karchmer (TCC '21), and show that such attacks circumvent any defense within our abstract mechanism in a black-box, nonadaptive way. Finally, we further expose the tension between Covert Learning and OMEDs by proving that Covert Learning algorithms require the nonexistence of provable security via efficient OMEDs. Therefore, we observe a "win-win" result by obtaining a characterization of the existence of provable security via efficient OMEDs by the nonexistence of natural Covert Learning algorithms.

Available format(s)
Category
Attacks and cryptanalysis
Publication info
Preprint.
Keywords
Covert Learning Model Extraction Provable Security
Contact author(s)
arika @ bu edu
History
2022-08-11: approved
See all versions
Short URL
https://ia.cr/2022/1039

CC BY

BibTeX

@misc{cryptoeprint:2022/1039,
author = {Ari Karchmer},
title = {The Limits of Provable Security Against Model Extraction},
howpublished = {Cryptology ePrint Archive, Paper 2022/1039},
year = {2022},
note = {\url{https://eprint.iacr.org/2022/1039}},
url = {https://eprint.iacr.org/2022/1039}
}

Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.