SOOM: A Schedule-Search-Based Operator Obfuscation Method Against Model Extraction Attacks

Summary

SOOM is a schedule-search-based operator obfuscation method that defends compiled DNN models against model extraction attacks on standard CPU and GPU backends. Built on TVM, it uses a security-aware learned cost model based on XGBoost gradient boosted trees to balance security and performance. Tests over 105 operator configurations and more than 30,000 tensor computation test cases raised the operator inference failure rate against state-of-the-art extraction attacks to as high as 89%, with performance gains of up to approximately 25.4% in selected cases.

Mitigation

SOOM: a schedule-search-based operator obfuscation method built on TVM, using a security-aware learned cost model based on XGBoost gradient boosted trees to generate obfuscated executable code for deep learning operators.

Topics

• Adversarial machine learning

Related items

• InfoModel Extraction of Convolutional Neural Networks with Max-PoolingSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoTrustworthy Distributed Machine Learning in Cloud-Edge-IoT Systems: A Heterogeneity-Aware Survey of Security, Privacy, and RobustnessSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPreventing Model Extraction in Contextual Linear OptimizationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoMapSteal: Map-based Autonomous Knowledge Stealing Attack Against Large Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHow to Secure AI Models in Production Environments | Endor LabsSimilar attack · Endor Labs Blog