Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!

Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 2006–2012 June 6–11, 2021. ©2021 Association for Computational Linguistics 2006 Model Extraction and Adversarial Transferability, Your BERT is Vulnerable! Xuanli He†, Lingjuan Lyu‡, Qiongkai Xu∗, Lichao Sun§ † Monash University, xuanli.he1@monash.edu ‡ Ant Group, lyulingjuan.llj@antgroup.com (Corresponding author) ∗ The Australian National University and Data61 CSIRO, Qiongkai.Xu@anu.edu.au § Lehigh University, lis221@lehigh.edu Abstract Natural language processing (NLP) tasks, ranging from text classification to text gen- eration, have been revolutionised by the pre- trained language models, such as BERT. This allows corporations to easily build powerful APIs by encapsulating fine-tuned BERT mod- els for downstream tasks. However, when a fine-tuned BERT model is deployed as a service, it may suffer from different attacks launched by the malicious users. In this work, we first present how an adversary can steal a BERT-based API service (the victim/target model) on multiple benchmark datasets with limited prior knowledge and queries. We fur- ther show that the extracted model can lead to highly transferable adversarial attacks against the victim model. Our studies indicate that the potential vulnerabilities of BERT-based API services still hold, even when there is an archi- tectural mismatch between the victim model and the attack model. Finally, we investigate two defence strategies to protect the victim model, and find that unless the performance of the victim model is sacrificed, both model ex- traction and adversarial transferability can ef- fectively compromise the target models. 1 Introduction Recently, owing to the success of pretrained BERT- based models (Devlin et al., 2018; Liu et al., 2019), the downstream NLP tasks have been revolu- tionised in the form of the limited task-specific su- pervision via fine-tuning on BERT models. Mean- while, commercial task-oriented NLP models, built on top of BERT models, are often deployed as pay-per-query prediction APIs for the sake of the protection of data privacy, system integrity and in- tellectual property. As publicly accessible services, commercial APIs have become victims of different explicit at- tacks, such as privacy attack (Lyu et al., 2020a,b; Shokri et al., 2017), adversarial attack (Shi et al., 2018), etc. Recently, prior works have also found that with the aid of carefully-designed queries and outputs of the NLP APIs, many existing APIs can be locally imitated via model extraction (Krishna et al., 2019; Wallace et al., 2020), which raises concerns of the vulnerability of NLP APIs. For in- stance, competing companies can imitate the victim model with a negligible cost. Since the consider- able investment of data annotation and algorithm design are sidestepped, the competing companies would be able to launch an identical service with a more competitive price than the victim compa- nies. Such security issue can be exacerbated, when the back-end pertained models, such as BERT, are publicly available (Krishna et al., 2019). Beyond model extraction, we further demon- strate the adversarial examples crafted by the ex- tracted model could be transferred to the black-box victim model. From the perspective of …

Content truncated to 500 words