Quantifying (Hyper) Parameter Leakage in Machine Learning

Machine Learning models are extensively used for various multimedia applications and are offered to users as a blackbox service on the Cloud on a pay-per-query basis. Such blackbox models are commercially valuable to adversaries, making them vulnerable to extraction attacks that reverse engineer the proprietary model thereby violating the model privacy and Intellectual Property. Extraction attacks proposed in the literature are empirically evaluated and lack a theoretical framework to measure the information leaked under such attacks. In this work, we propose a novel model-agnostic probabilistic framework, AIRAVATA, to quantify information leakage using partial knowledge and limited evidences from model extraction attacks. This framework captures the fact that extracting the exact target model is difficult due to experimental uncertainty while inferring model hyperparameters and stochastic nature of training for stealing the target model functionality. We use Bayesian Networks to capture uncertainty in estimating the target model under various extraction attacks based on the subjective notion of probability. We validate the proposed framework under different adversary assumptions commonly adopted in the literature to reason about the attack efficacy. This provides a practical tool to identify the best attack combination which maximises the knowledge extracted (or information leaked) from the target model and estimate the relative threats from different attacks.