MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimation

Model Stealing (MS) attacks allow an adversary with black-box access to a\nMachine Learning model to replicate its functionality, compromising the\nconfidentiality of the model. Such attacks train a clone model by using the\npredictions of the target model for different inputs. The effectiveness of such\nattacks relies heavily on the availability of data necessary to query the\ntarget model. Existing attacks either assume partial access to the dataset of\nthe target model or availability of an alternate dataset with semantic\nsimilarities. This paper proposes MAZE -- a data-free model stealing attack\nusing zeroth-order gradient estimation. In contrast to prior works, MAZE does\nnot require any data and instead creates synthetic data using a generative\nmodel. Inspired by recent works in data-free Knowledge Distillation (KD), we\ntrain the generative model using a disagreement objective to produce inputs\nthat maximize disagreement between the clone and the target model. However,\nunlike the white-box setting of KD, where the gradient information is\navailable, training a generator for model stealing requires performing\nblack-box optimization, as it involves accessing the target model under attack.\nMAZE relies on zeroth-order gradient estimation to perform this optimization\nand enables a highly accurate MS attack. Our evaluation with four datasets\nshows that MAZE provides a normalized clone accuracy in the range of 0.91x to\n0.99x, and outperforms even the recent attacks that rely on partial data (JBDA,\nclone accuracy 0.13x to 0.69x) and surrogate data (KnockoffNets, clone accuracy\n0.52x to 0.97x). We also study an extension of MAZE in the partial-data setting\nand develop MAZE-PD, which generates synthetic data closer to the target\ndistribution. MAZE-PD further improves the clone accuracy (0.97x to 1.0x) and\nreduces the query required for the attack by 2x-24x.\n