Research map / Adversarial robustness and security / Backdoor and poisoning
HoneypotNet: Backdoor Attacks Against Model Extraction
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes HoneypotNet, an "attack as defense" scheme that replaces a victim model's classifier with a honeypot layer fine-tuned via bi-level optimization so that stolen probability vectors implant a UAP-triggered backdoor in extracted substitute models.
Problem
Model extraction attacks steal black-box classifiers via API queries; existing defenses (perturbation, watermarking, detection) are costly, log user data, or do not stop extraction, so the paper seeks a defense that poisons substitute models.
Approach
Replace the victim's classification layer with a honeypot layer whose outputs are poisonous; train it with bi-level optimization against a shadow model and a UAP-based trigger so that any substitute trained on its outputs inherits a backdoor, enabling ownership verification and reverse disruption without retraining the victim.
Key results
- HoneypotNet achieves ASR between 56.99% and 92.35% on substitute models across four datasets and five extraction attacks at 30k queries.
- On BlackBox Dissector (hard-label) substitutes, HoneypotNet reaches 78.59%-92.35% ASR while keeping substitute clean accuracy close to undefended.
- Verification accuracy Acc_v reaches 52.29%-92.61% with HoneypotNet versus near-zero for undefended models.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace no defense or DVBW with HoneypotNet | ResNet34 victim extracted by KnockoffNets · CIFAR10 | ASR (%): 12.47 -> 59.35; 12.50 -> 59.35 | Helped |
| Replace no defense or DVBW with HoneypotNet | ResNet34 victim extracted by KnockoffNets · CIFAR100 | ASR (%): 0.90 -> 85.71; 0.91 -> 85.71 | Helped |
| Replace no defense or DVBW with HoneypotNet | ResNet34 victim extracted by KnockoffNets · CUBS200 | ASR (%): 0.14 -> 78.31; 0.35 -> 78.31 | Helped |
| Replace no defense or DVBW with HoneypotNet | ResNet34 victim extracted by KnockoffNets · Caltech256 | ASR (%): 0.47 -> 79.13; 0.26 -> 79.13 | Helped |
| Use VGG16 instead of ResNet34 as the substitute architecture (ablation) | HoneypotNet extracted by KnockoffNets · CIFAR10 | ASR (%): 59.35 -> 97.16 | Helped |
| Use VGG16 instead of ResNet34 as the substitute architecture (ablation) | HoneypotNet extracted by KnockoffNets · CIFAR100 | ASR (%): 85.71 -> 87.10 | Helped |
| Use VGG16 instead of ResNet34 as the substitute architecture (ablation) | HoneypotNet extracted by KnockoffNets · CUBS200 | ASR (%): 78.31 -> 89.82 | Helped |
| Use VGG16 instead of ResNet34 as the substitute architecture (ablation) | HoneypotNet extracted by KnockoffNets · Caltech256 | ASR (%): 79.13 -> 62.17 | Hurt |
| Use DenseNet121 instead of ResNet34 as the substitute architecture (ablation) | HoneypotNet extracted by KnockoffNets · CIFAR10 | ASR (%): 59.35 -> 51.68 | Hurt |
| Vary trigger size from 1×1 to 15×15 (ablation) | HoneypotNet on CIFAR10 with KnockoffNets · CIFAR10 | ASR | Helped |
| Vary trigger size from 1×1 to 15×15 (ablation) | HoneypotNet victim model · CIFAR10 | ASR | Mixed |
Surprising findings
- Cognitive Distillation fails to distinguish clean from backdoor samples, with L1 norm distributions similar.
- VGG16 substitutes yield 97.16% ASR on CIFAR10, higher than the same-architecture substitute.
Limitations
- Attack success depends on adversarial transferability and varies with substitute architecture (e.g., DenseNet121 lower ASR).
- Requires a shadow dataset and verification dataset related to the victim's task, collected by the defender.
- Trigger size trades off victim clean accuracy against protection effect.
Experimental setup
Datasets: ImageNet CC3M CIFAR10 CIFAR100 Caltech256 CUBS200
Benchmarks: CIFAR10 CIFAR100 Caltech256 CUBS200
Metrics: clean accuracy (Acc_c) verification accuracy (Acc_v) attack success rate (ASR)
Baselines: No defense DVBW KnockoffNets ActiveThief SPSG BlackBox Dissector
Builds on: universal adversarial perturbation KnockoffNets DVBW
Closest papers by meaning
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.87)
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.86)
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.86)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.86)
- Backdoor Attacks via Machine Unlearning (AAAI 2024 · similarity 0.86)
- Data Free Backdoor Attacks (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.