Preventing Model Extraction in Contextual Linear Optimization

Summary

This paper studies how an attacker who submits context queries to a predict-then-optimize system can extract its underlying linear prediction model from the returned decisions alone. The authors combine inverse optimization with boundary sampling in an adaptive attack, then propose a defense that perturbs decisions only when the predicted cost vector lies near a decision boundary. Experiments on synthetic and real data show the defense increases extraction error at a measurable cost in performance.

Mitigation

The proposed mitigation is a defense mechanism that perturbs decisions only when the predicted cost vector is near a decision boundary. The source states a regret bound in terms of the perturbation radius and a lower bound on expected extraction error for attackers that fit defended responses.

Topics

• Adversarial machine learning

Related items

• InfoMapSteal: Map-based Autonomous Knowledge Stealing Attack Against Large Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog
• InfoStrengthening our defenses against distillation attacksSimilar attack · Anthropic Research Blog
• InfoPoster: A Preliminary Study of LLM Distillation InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoAnytime-valid detection of LLM weight exfiltrationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)