Privacy-preserving inference resistant to model extraction attacks

Abstract

Privacy-Preserving Deep Learning (PPDL) has been successfully applied in the inference phase to preserve the privacy of input data. However, PPDL models are vulnerable to model extraction attacks, in which an adversary attempts to steal the trained model itself. In this paper, we propose a new defense method against model extraction attacks that is specifically designed for PPDL based on secure multi-party computations and homomorphic encryption. The proposed method confounds inference queries for out-of-distribution data by using a fake network with the target network while optimizing computational efficiency for PPDL environments. Furthermore, we introduce Wasserstein regularization to ensure that the fake network’s output distribution is indistinguishable from the target network, thwarting adversaries’ attempts to discern any discrepancies within the PPDL framework. The experimental results demonstrate that our defense method attains a good accuracy-security trade-off and is effective against a wide range of attacks, including adaptive attacks and transfer attacks. Our work contributes to the field of PPDL by providing an extended perspective to improve the algorithm’s security and reliability beyond privacy.