Machine learning models are typically made available to potential client users via inference APIs. Model extraction attacks occur when a malicious client uses information gleaned from queries to the inference API of a victim model $F_V$ to build a surrogate model $F_A$ with comparable functionality. Recent research has shown successful model extraction of image classification, and natural language processing models. In this paper, we show the first model extraction attack against real-world generative adversarial network (GAN) image translation models. We present a framework for conducting such attacks, and show that an adversary can successfully extract functional surrogate models by querying $F_V$ using data from the same domain as the training data for $F_V$. The adversary need not know $F_V$'s architecture or any other information about it beyond its intended task. We evaluate the effectiveness of our attacks using three different instances of two popular categories of image translation: (1) Selfie-to-Anime and (2) Monet-to-Photo (image style transfer), and (3) Super-Resolution (super resolution). Using standard performance metrics for GANs, we show that our attacks are effective. Furthermore, we conducted a large scale (125 participants) user study on Selfie-to-Anime and Monet-to-Photo to show that human perception of the images produced by $F_V$ and $F_A$ can be considered equivalent, within an equivalence bound of Cohen's d = 0.3. Finally, we show that existing defenses against model extraction attacks (watermarking, adversarial examples, poisoning) do not extend to image translation models.

翻译：机器学习模型通常通过推理API向潜在客户用户提供服务。模型窃取攻击是指恶意客户端利用从受害者模型$F_V$推理API查询中获取的信息，构建功能相当的替代模型$F_A$。近期研究已成功实现了对图像分类和自然语言处理模型的提取攻击。本文首次展示了针对真实世界生成对抗网络（GAN）图像翻译模型的模型窃取攻击。我们提出了一种执行此类攻击的框架，并证明攻击者通过使用与$F_V$训练数据同域的数据查询$F_V$，即可成功提取功能性替代模型。攻击者无需了解$F_V$的架构或其任务之外的任何信息。我们采用两类流行图像翻译任务的三个不同实例评估攻击效果：（1）自拍转动漫（Selfie-to-Anime）与（2）莫奈转照片（Monet-to-Photo）的图像风格迁移，以及（3）超分辨率重建（Super-Resolution）。通过GAN的标准性能指标，我们验证了攻击的有效性。此外，我们针对自拍转动漫和莫奈转照片任务开展了一项大规模用户研究（125名参与者），结果表明在Cohen's d = 0.3的等效边界内，人类对$F_V$与$F_A$生成图像的感知可视为等同。最后，我们指出现有针对模型窃取攻击的防御手段（水印、对抗样本、投毒）无法直接扩展至图像翻译模型。