Student Surpasses Teacher: Imitation Attack for Black-Box NLP APIs

Proceedings of the 29th International Conference on Computational Linguistics, pages 2849–2860 October 12–17, 2022. 2849 Student Surpasses Teacher: Imitation Attack for Black-Box NLP APIs Qiongkai Xu∗,1 Xuanli He,2 Lingjuan Lyu,3 Lizhen Qu,2 Gholamreza Haffari2 1The University of Melbourne, 2Monash University, 3Sony AI Qiongkai.Xu@unimelb.edu.au, Lingjuan.Lv@sony.com {xuanli.he1,Lizhen.Qu,Gholamreza.Haffari}@monash.edu Abstract Machine-learning-as-a-service (MLaaS) has at- tracted millions of users to their splendid large- scale models. Although published as black-box APIs, the valuable models behind these ser- vices are still vulnerable to imitation attacks. Recently, a series of works have demonstrated that attackers manage to steal or extract the victim models. Nonetheless, none of the previ- ous stolen models can outperform the original black-box APIs. In this work, we conduct un- supervised domain adaptation and multi-victim ensemble to showing that attackers could poten- tially surpass victims, which is beyond previous understanding of model extraction. Extensive experiments on both benchmark datasets and real-world APIs validate that the imitators can succeed in outperforming the original black- box models on transferred domains. We con- sider our work as a milestone in the research of imitation attack, especially on NLP APIs, as the superior performance could influence the defense or even publishing strategy of API providers. 1 Introduction Task-oriented NLP APIs have received tremen- dous success, partly due to commercial cloud ser- vices (Krishna et al., 2019; Wallace et al., 2020). The enormous commercial benefit allures other companies or individual users to extract the back- end decision models of these successful APIs. Some recent works have demonstrated that many existing NLP APIs can be locally imitated or ex- tracted (Krishna et al., 2019; Wallace et al., 2020; Guo et al., 2022), violating the intellectual prop- erty (IP) of NLP APIs. Equipped with recent ad- vanced models pre-trained on large-scale corpus, it is getting easier to train a decent attack model with limited training samples retrieved from victims (He et al., 2021a). ∗Most of the work was finished when the first author was at ANU and Data61 CSIRO. Despite their success, there are still a series of restrictions on current attack paradigm. The first restriction is that attackers and victims are trained and evaluated under the same domain. Although such setting simplifies the comparison of utility and fidelity between victim and attack models, it is less likely to be the case in real world. Generally, attack- ers and victims do not, at least not willing to, share their in-house datasets to the public. Moreover, the competition between attackers and victims lies in their performance on the application scenarios (transferred domains), which vary by customers not API providers. The second restriction is that tradi- tional model extraction only refers a single victim model, and none of the previous works manage to build the extracted models that can surpass the orig- inal black-box APIs (Tramèr et al., 2016; Krishna et al., 2019; Wallace et al., 2020). Aggregating the strength from diverse victims, however, can poten- tially benefit the performance of attackers. This may further enable the attack model to acquire a superior performance, …

Content truncated to 500 words