Stealing Machine Learning Models via Prediction APIs
summary
Demonstrates concrete model extraction that recovers logistic regressions, neural nets and decision trees with near-perfect fidelity (often >=99.9% agreement) by abusing equation-solving attacks on APIs that return confidence scores and by using partial-input queries to reverse-engineer feature encodings. Attacks run against Amazon Machine Learning and BigML, require from thousands up to a few hundred thousand queries depending on model size, and enable cheaper, scalable model inversion once a white-box replica is built.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:21Machine Learning (ML) Systems
- 3:39Model Extraction Attacks (Prior Work)
- 4:40Main Results
- 6:14Model Extraction Example: Logistic Regression
- 8:15Generic Equation Solving Attacks
- 12:10Online Attack AWS Machine Learning
- 13:53Application: Model-Inversion Attacks Infer training data from trained models Fredrikson et al.- 2015
- 16:17Extracting a Decision Tree
- 18:23Countermeasures
- 21:34Brief Announcement
- 21:55Conclusion
- 24:06Generic Model Retraining Attacks
related talks
52mSleeping With One AI Open: An Introduction to Attacks Against...
35mDo AI-models gossip?
39mDuplicating Black Box Machine Learning Models
11mDiscussion with the 2026 USENIX Security Symposium Test of Time
20mMachine Learning Attacks – A New Era of Security Epidemic
28mSecurity of Machine Learning
02h 13mUnderstanding Security Threats Against Machine/Deep Learning Applications
01h 28mPPML: Machine Learning on Data you cannot see