Machine Learning as a Service (MLaaS) APIs provide ready-to-use and high-utility encoders that generate vector representations for given inputs. Since these encoders are very costly to train, they become lucrative targets for model stealing attacks during which an adversary leverages query access to the API to replicate the encoder locally at a fraction of the original training costs. We propose Bucks for Buckets (B4B), the first active defense that prevents stealing while the attack is happening without degrading representation quality for legitimate API users. Our defense relies on the observation that the representations returned to adversaries who try to steal the encoder's functionality cover a significantly larger fraction of the embedding space than representations of legitimate users who utilize the encoder to solve a particular downstream task.vB4B leverages this to adaptively adjust the utility of the returned representations according to a user's coverage of the embedding space. To prevent adaptive adversaries from eluding our defense by simply creating multiple user accounts (sybils), B4B also individually transforms each user's representations. This prevents the adversary from directly aggregating representations over multiple accounts to create their stolen encoder copy. Our active defense opens a new path towards securely sharing and democratizing encoders over public APIs.

翻译：机器学习即服务（MLaaS）API 提供即用型、高实用性的编码器，可为给定输入生成向量表示。由于此类编码器训练成本高昂，它们成为模型窃取攻击的有利可图目标——攻击者利用对 API 的查询访问权限，以原始训练成本的一小部分在本地复制编码器。我们提出 Bucks for Buckets（B4B），这是首个在不降低合法 API 用户表示质量的前提下，在攻击发生时主动阻止窃取的防御方法。该防御基于如下观察：试图窃取编码器功能的攻击者所获表示的嵌入空间覆盖范围，显著大于利用编码器解决特定下游任务的合法用户。B4B 据此自适应调整返回表示的效用，依据用户对嵌入空间的覆盖程度。为防止自适应攻击者通过创建多个用户账户（女巫攻击）规避防御，B4B 还对每个用户的表示进行独立变换，从而阻止攻击者直接跨账户聚合表示以构建窃取的编码器副本。我们的主动防御为通过公共 API 安全共享和普及编码器开辟了新路径。