PrivacyRaven: Privacy Testing for Deep Learning

PrivacyRaven allows you to perform model extraction attacks by providing a query function that wraps your target model. The ModelExtractionAttack class orchestrates the attack using a query function, query limits, input shapes, and seed data.

Key components required:

• Query Function: A function that takes input data and returns the target model's output. You can use privacyraven.utils.query.get_target to wrap a model.
• Seed Data: Public or known data used during the extraction process.
• Substitute Model: An architecture used to synthesize the extracted knowledge.

import privacyraven as pr
from privacyraven.utils.data import get_emnist_data
from privacyraven.extraction.core import ModelExtractionAttack
from privacyraven.utils.query import get_target
from privacyraven.models.victim import train_four_layer_mnist_victim
from privacyraven.models.four_layer import FourLayerClassifier

# 1. Setup the target model
model = train_four_layer_mnist_victim()

# 2. Define the query function
def query_mnist(input_data):
    return get_target(model, input_data, (1, 28, 28, 1))

# 3. Obtain seed data
emnist_train, emnist_test = get_emnist_data()

# 4. Configure and run the attack
attack = ModelExtractionAttack(
    query_mnist,             # query function
    200,                     # query limit
    (1, 28, 28, 1),          # victim input shape
    10,                      # number of targets
    (3, 1, 28, 28),          # substitute input shape
    "copycat",              # synthesizer name
    FourLayerClassifier,    # substitute model architecture
    784,                     # substitute input size
    emnist_train,            # seed train data
    emnist_test,             # seed test data
)

The ModelExtractionAttack class is the base for black-box, label-only model extraction attacks. It uses a synthesizer to create synthetic data from seed data, which is then used to train a substitute model.

When initializing a subclass of ModelExtractionAttack, you can provide several configuration parameters to control the attack parameters, the substitute model architecture, and the training process. Note that certain attributes (like synth_train, substitute_model, etc.) are managed internally during the post-initialization phase and cannot be passed as arguments.

from privacyraven.extraction.core import ModelExtractionAttack

# Example of how one might configure a subclass of ModelExtractionAttack
class MyAttack(ModelExtractionAttack):
    pass

attack = MyAttack(
    query=my_query_function,             # Function that queries the victim model
    query_limit=500,                     # Max number of queries allowed
    victim_input_shape=(3, 224, 224),    # Shape of victim inputs
    victim_output_targets=1000,         # Number of labels in victim model
    substitute_model_arch=MyArch,        # PyTorch module for substitute architecture
    seed_data_train=my_train_tensors,    # Seed data for synthesis
    seed_data_test=my_test_tensors,     # Seed data for synthesis
    batch_size=32,
    learning_rate=1e-4,
    trainer_args=[("deterministic", True)] # List of tuples for PyTorch Lightning Trainer
)

The InversionModel is a PyTorch Lightning module used to perform model inversion attacks. It consists of a decoder that attempts to reconstruct data from the classifier's outputs.

To initialize the model, you must provide:

• hparams: Hyperparameters for the Lightning module.
• inversion_params: A dictionary containing the following keys:
  • nz: The size of the latent space (input channels for the decoder).
  • ngf: The number of generator filters.
  • affine_shift: The value c used for affine transformation of top-k values.
  • truncate: The value t representing the number of top-k entries to use.
• classifier: The target PyTorch Lightning model (the classifier) that you are attacking. The InversionModel will automatically set the classifier to .eval() mode.

from privacyraven.models.inversion_model import InversionModel

inversion_params = {
    "nz": 10, 
    "ngf": 64, 
    "affine_shift": 0.5, 
    "truncate": 3
}

inversion_model = InversionModel(
    hparams=None, 
    inversion_params=inversion_params, 
    classifier=target_classifier
)

Use train_mnist_victim() to train a 3-layer fully connected neural network on MNIST data.

Note: This function is deprecated. It is recommended to use train_four_layer_mnist_victim() instead, as the ThreeLayerClassifier will be deprecated.

Parameters:

• transform: A Torchvision.transforms object. Defaults to ToTensor and Normalize((0.1307,), (0.3081,)).
• batch_size: Integer size of training/testing batches. Defaults to 100.
• num_workers: Integer number of workers for data loading. Defaults to 4.
• rand_split_val: An array describing how the val and train data are split. Defaults to [55000, 5000].
• gpus: Integer number of GPUs. If None, it uses all available GPUs.
• max_epochs: Maximum number of training epochs. Defaults to 8.
• learning_rate: Float learning rate for the optimizer. Defaults to 1e-3.

Returns: A trained ThreeLayerClassifier model ready for inference.

# Deprecated: Use train_four_layer_mnist_victim instead
victim_model = train_mnist_victim(batch_size=100)