Knowledge Distillation-Based Model Extraction Attack using Private
  Counterfactual Explanations
Fatima Ezzeddine Omran Ayoub Silvia Giordano
In recent years, there has been a notable increase in the deployment of
machine learning (ML) models as services (MLaaS) across diverse production
software applications. In parallel, explainable AI (XAI) continues to evolve,
addressing the necessity for transparency and trustworthiness in ML models. XAI
techniques aim to enhance the transparency of ML models by providing insights,
in terms of the model's explanations, into their decision-making process.
Simultaneously, some MLaaS platforms now offer explanations alongside the ML
prediction outputs. This setup has elevated concerns regarding vulnerabilities
in MLaaS, particularly in relation to privacy leakage attacks such as model
extraction attacks (MEA). This is due to the fact that explanations can unveil
insights about the inner workings of the model which could be exploited by
malicious users. In this work, we focus on investigating how model
explanations, particularly Generative adversarial networks (GANs)-based
counterfactual explanations (CFs), can be exploited for performing MEA within
the MLaaS platform. We also delve into assessing the effectiveness of
incorporating differential privacy (DP) as a mitigation strategy. To this end,
we first propose a novel MEA methodology based on Knowledge Distillation (KD)
to enhance the efficiency of extracting a substitute model of a target model
exploiting CFs. Then, we advise an approach for training CF generators
incorporating DP to generate private CFs. We conduct thorough experimental
evaluations on real-world datasets and demonstrate that our proposed KD-based
MEA can yield a high-fidelity substitute model with reduced queries with
respect to baseline approaches. Furthermore, our findings reveal that the
inclusion of a privacy layer impacts the performance of the explainer, the
quality of CFs, and results in a reduction in the MEA performance.