The Thieves on Sesame Street are Polyglots - Extracting Multilingual Models from Monolingual APIs

Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing, pages 6203–6207, November 16–20, 2020. c⃝2020 Association for Computational Linguistics 6203 The Thieves on Sesame Street are Polyglots — Extracting Multilingual Models from Monolingual APIs Nitish Shirish Keskar, Bryan McCann, Caiming Xiong & Richard Socher Salesforce Research {nkeskar,bmccann,cxiong,rsocher}@salesforce.com Abstract Pre-training in natural language processing makes it easier for an adversary with only query access to a victim model to reconstruct a local copy of the victim by training with gib- berish input data paired with the victim’s la- bels for that data. We discover that this ex- traction process extends to local copies initial- ized from a pre-trained, multilingual model while the victim remains monolingual. The ex- tracted model learns the task from the monolin- gual victim, but it generalizes far better than the victim to several other languages. This is done without ever showing the multilin- gual, extracted model a well-formed input in any of the languages for the target task. We also demonstrate that a few real examples can greatly improve performance, and we analyze how these results shed light on how such ex- traction methods succeed. 1 Introduction Deploying machine learning models typically in- volves significant cost, including the expense of data acquisition, data cleaning, and model training and tuning. Recent work by Krishna et al. (2020) has demonstrated that deployed NLP models can be stolen by adversaries by querying victim models with gibberish input data that consists of random sequences of words. In particular, they showed that the following approach is sufficient for stealing text classification and question answering models. First, unlabeled data is created by randomly sam- pling words from a vocabulary. Second, a deployed API is queried with each random input sequence to obtain a label for each. Third, a pre-trained lan- guage model such as BERT (Devlin et al., 2019) is fine-tuned on the victim-labeled gibberish data. The resulting model retains a significant fraction of the victim model’s performance without ever seeing a single well-formed input sentence. This Victim Monolingual NLI Model Pre-trained Multilingual Language Model (English) Hypothesis Input data Labels Extraction Phase static iconic changing building, 1933, (for policy mistake writes successor contradiction entailment Grand Jesse often visit device change… televisions, initial Due leave towers Justin… (English) Premise (Multilingual) Premise Inference Phase ��������� �� ��������� ����� contradiction मुझे तैयारी शुरू करनी पड़ी contradiction Extracted Multilingual NLI Model मुझे पाठ्यक्रम में प्र श ि क्षण शुरू करना पड़ा। । (Multilingual) Hypothesis Figure 1: Extraction of multilingual models from monolingual APIs. (Extraction phase:) A pre-trained multilingual model is fine-tuned on gibberish data whose labels are queried from a monolingual API. (In- ference phase): This model is then used for zero-shot cross-lingual transfer on different languages. process of “stealing” from an API, or “extracting” a local copy of a victim model, is not specific to NLP tasks but rather is a more general phenomenon (Tram`er et al., 2016; Orekondy et al., 2019; Juuti et al., 2019; Milli et al., 2019). Notably, it does …

Content truncated to 500 words