Model extraction from counterfactual explanations [article]

Ulrich Aïvodji, Alexandre Bolot, Sébastien Gambs
<span title="2020-09-03">2020</span> <i > arXiv </i> &nbsp; <span class="release-stage" >pre-print</span>
Post-hoc explanation techniques refer to a posteriori methods that can be used to explain how black-box machine learning models produce their outcomes. Among post-hoc explanation techniques, counterfactual explanations are becoming one of the most popular methods to achieve this objective. In particular, in addition to highlighting the most important features used by the black-box model, they provide users with actionable explanations in the form of data instances that would have received a
more &raquo; ... erent outcome. Nonetheless, by doing so, they also leak non-trivial information about the model itself, which raises privacy issues. In this work, we demonstrate how an adversary can leverage the information provided by counterfactual explanations to build high-fidelity and high-accuracy model extraction attacks. More precisely, our attack enables the adversary to build a faithful copy of a target model by accessing its counterfactual explanations. The empirical evaluation of the proposed attack on black-box models trained on real-world datasets demonstrates that they can achieve high-fidelity and high-accuracy extraction even under low query budgets.
<span class="external-identifiers"> <a target="_blank" rel="external noopener" href="https://arxiv.org/abs/2009.01884v1">arXiv:2009.01884v1</a> <a target="_blank" rel="external noopener" href="https://fatcat.wiki/release/ye6iigbigfhm3k6mw66lzwfiwq">fatcat:ye6iigbigfhm3k6mw66lzwfiwq</a> </span>
<a target="_blank" rel="noopener" href="https://web.archive.org/web/20200917005254/https://arxiv.org/pdf/2009.01884v1.pdf" title="fulltext PDF download" data-goatcounter-click="serp-fulltext" data-goatcounter-title="serp-fulltext"> <button class="ui simple right pointing dropdown compact black labeled icon button serp-button"> <i class="icon ia-icon"></i> Web Archive [PDF] </button> </a> <a target="_blank" rel="external noopener" href="https://arxiv.org/abs/2009.01884v1" title="arxiv.org access"> <button class="ui compact blue labeled icon button serp-button"> <i class="file alternate outline icon"></i> arxiv.org </button> </a>