Explainable Artificial Intelligence (XAI) encompasses a range of techniques and procedures aimed at elucidating the decision-making processes of AI models. While XAI is valuable in understanding the reasoning behind AI models, the data used for such revelations poses potential security and privacy vulnerabilities. Existing literature has identified privacy risks targeting machine learning models, including membership inference, model inversion, and model extraction attacks. Depending on the settings and parties involved, such attacks may target either the model itself or the training data used to create the model. We have identified that tools providing XAI can particularly increase the vulnerability of model extraction attacks, which can be a significant issue when the owner of an AI model prefers to provide only black-box access rather than sharing the model parameters and architecture with other parties. To explore this privacy risk, we propose AUTOLYCUS, a model extraction attack that leverages the explanations provided by popular explainable AI tools. We particularly focus on white-box machine learning (ML) models such as decision trees and logistic regression models. We have evaluated the performance of AUTOLYCUS on 5 machine learning datasets, in terms of the surrogate model's accuracy and its similarity to the target model. We observe that the proposed attack is highly effective; it requires up to 60x fewer queries to the target model compared to the state-of-the-art attack, while providing comparable accuracy and similarity. We first validate the performance of the proposed algorithm on decision trees, and then show its performance on logistic regression models as an indicator that the proposed algorithm performs well on white-box ML models in general. Finally, we show that the existing countermeasures remain ineffective for the proposed attack.

翻译：可解释人工智能涵盖了一系列旨在阐明AI模型决策过程的技术和程序。尽管XAI在理解AI模型推理逻辑方面具有重要价值，但用于揭示信息的数据可能带来潜在的安全与隐私漏洞。现有文献已识别出针对机器学习模型的隐私风险，包括成员推断、模型反转和模型提取攻击。根据攻击设置和参与方不同，此类攻击可能针对模型本身，也可能针对用于创建模型的训练数据。我们发现，提供XAI的工具尤其会加剧模型提取攻击的脆弱性——当AI模型所有者倾向于仅提供黑盒访问权限、而非与其他方共享模型参数和架构时，这一问题尤为突出。为探索这一隐私风险，我们提出AUTOLYCUS——一种利用主流可解释AI工具提供的解释信息发动的模型提取攻击。我们特别关注决策树和逻辑回归等白盒机器学习模型。基于5个机器学习数据集，我们从替代模型准确率及其与目标模型的相似度两个维度评估了AUTOLYCUS的性能。实验表明，该攻击方法具有极高效率：与现有最先进攻击相比，它向目标模型发起的查询次数最多可减少60倍，同时保持相当的准确率和相似度。我们首先验证了该算法在决策树上的性能，随后展示了其在逻辑回归模型上的表现，表明该算法总体上对白盒ML模型具有优秀的适用性。最后，我们证明现有防御措施对本攻击仍然无效。