Project description

Deep learning models, especially deep neural networks (DNNs), have become the standard models for solving many complex real-world problems, such as image recognition, speech recognition, natural language processing, and autonomous driving. However, training large-scale DNN models is by no means trivial, which requires not only large-scale datasets but also significant computational resources. The training cost can grow rapidly with task complexity and model capacity. For instance, it can cost $1.6 million to train a BERT model on Wikipedia and Book corpora (15 GB). It is thus of utmost importance to protect DNNs from unauthorized duplication or reproduction.

Model extraction (also known as model stealing) is considered to be a challenging security threat to DNNs. The goal of model extraction is to accurately steal the functionality of the victim model through its prediction API. To achieve this, an adversary queries the victim DNN model for predictions (i.e., the probability vector). The adversary first obtains an annotated dataset by querying the victim model for a set of auxiliary samples, then trains a copy of the victim model on the annotated dataset. A number of defence techniques have been also proposed to protect the DNN from model stealing.

So far, existing model extraction attack/defence methods are mostly heuristics driven. Their performances lack the formal guarantee or understanding. Different from such heuristics, a formal verification technique needs to provide provable guarantees for its results. The verification of DNNs has been widely studied in adversarial machine learning. In this project, you are going to investigate formal methods for mathematically rigorous reasoning of the theory and practice for DNN model extraction.