Too Clever by Half: Detecting Sampling-based Model Stealing Attacks by Their Own Cleverness

Machine learning as a service (MLaaS) has gained significant popularity and market traction in recent years, driven by advancements in Artificial Intelligence particularly Generative AI (GAI). However, MLaaS faces severe challenges from sampling-based model stealing attacks (MSAs), where attackers strategically query the targeted ML models provided by MLaaS providers to minimize the query burden while closely replicating the model’s functionality. Such MSAs pose severe consequences, including intellectual property (IP) theft and potential leakage of private training data. Unfortunately, existing defenses either sacrifice model utility or fail to generalize across diverse MSAs.In this paper, we propose DIARY, an innovative detection method specifically tailored to sampling-based MSAs by exploiting their inherent sophistication. Our key insight is that ‘clever’ malicious queries tend to extract more information from the targeted (victim) model than typical benign queries, as these attacks iteratively refine their queries by examining and analyzing prior queries and the corresponding responses. Hence we design DIARY to extract timing dependence within a query sequence and incorporate contrastive learning for properly characterizing such dependency that holds for different sampling-based MSAs. Comprehensive evaluations using five different sampling-based MSAs and two state-of-the-art defense baselines across four popular datasets consistently validate DIARY’s superior performance.