Attack Data is Not Solely Paramount: A Universal Model Extraction Enhancement Method

Model extraction (ME) attacks, aiming to steal the functionality or parameters of the victim model, have become a widespread research topic. Most functional ME attack methodologies follow a uniform framework, which we summarize in three steps: initially choosing appropriate attack data, then querying the victim model with this data, and finally, training an incipient clone model based on the victim model’s outputs. Despite much focus on data selection, the latter two steps have been somewhat neglected. Noticing this, we explore a method for the information of attack data labels to enhance the accuracy of the clone model. Specifically, we utilized the incipient clone model to identify similarities between the leaked private data and the attack data, subsequently appending the labels from the leaked data to those of the attack data. Then, we employed these modified attack data labels to fine-tune the incipient clone model, obtaining an enhanced clone model with higher accuracy. The enhancement was applied to three representative ME attack methodologies that primarily focus on the first step. Results show that the enhanced model reveals a higher accuracy than the three basic attacks. In summary, our approach suggests that future research should extend beyond data selection.