MExMI: Pool-based Active Model Extraction Crossover Membership Inference

Yaxin Xiao, Qingqing Ye, Haibo Hu, Huadi Zheng, Chengfang Fang, Jie Shi

Research output: Chapter in book / Conference proceedingConference article published in proceeding or bookAcademic researchpeer-review


With increasing popularity of Machine Learning as a Service (MLaaS), ML models
trained from public and proprietary data are deployed in the cloud and deliver
prediction services to users. However, as the prediction API becomes a new
attack surface, growing concerns have arisen on the confidentiality of ML models.
Existing literatures show their vulnerability under model extraction (ME) attacks,
while their private training data is vulnerable to another type of attacks, namely,
membership inference (MI). In this paper, we show that ME and MI can reinforce
each other through a chained and iterative reaction, which can significantly boost ME attack accuracy and improve MI by saving the query cost. As such, we build a framework MExMI for pool-based active model extraction (PAME) to exploit MI through three modules: “MI Pre-Filter”, “MI Post-Filter”, and “semi-supervised boosting”. Experimental results show that MExMI can improve up to 11.14% from the best known PAME attack and reach 94.07% fidelity with only 16k queries. Furthermore, the accuracy, precision and recall of the MI attack in MExMI are on par with state-of-the-art MI attack which needs 150k queries.
Original languageEnglish
Title of host publication36th Conference on Neural Information Processing Systems (NeurIPS 2022)
Publication statusPublished - Nov 2022


Dive into the research topics of 'MExMI: Pool-based Active Model Extraction Crossover Membership Inference'. Together they form a unique fingerprint.

Cite this