一句话：提出 DeMistify，静态定位并自动插桩移动应用以窃取复用端侧 ML 模型，揭示现有防护不足。
移动应用日益通过端侧机器学习在本地提供 AI 服务，既缓解了远端敏感数据收集问题，也把模型推到了智能手机上，使其同样面临模型窃取攻击。尽管开发者采取了多种保护措施，本文发现这些保护仍不充分，端侧 ML 模型可被任意提取和复用。为证明防护的不足与攻击可行性，作者提出 DeMistify：它静态定位应用内的 ML 模型，切片相关执行组件，并自动生成脚本对移动应用插桩，从而成功窃取并自由复用目标模型。基于 Google Play 安装量，作者在 1511 个使用端侧 ML 服务的头部应用上评估 DeMistify，成功执行了其中 1250 个（82.73%），并对移动应用中的端侧 ML 生态进行了深入研究。
Mobile apps have become popular for providing artificial intelligence (AI) services via on-device machine learning (ML) techniques. Unlike accomplishing these AI services on remote servers traditionally, these on-device techniques process sensitive information required by AI services locally, which can mitigate the severe concerns of the sensitive data collection on the remote side. However, these on-device techniques have to push the core of ML expertise (e.g., models) to smartphones locally, which are still subject to similar vulnerabilities on the remote clouds and servers, especially when facing the model stealing attack. To defend against these attacks, developers have taken various protective measures. Unfortunately, we have found that these protections are still insufficient, and on-device ML models in mobile apps could be extracted and reused without limitation. To better demonstrate its inadequate protection and the feasibility of this attack, this paper presents DeMistify, which statically locates ML models within an app, slices relevant execution components, and finally generates scripts automatically to instrument mobile apps to successfully steal and reuse target ML models freely. To evaluate DeMistify and demonstrate its applicability, we apply it on 1,511 top mobile apps using on-device ML expertise for several ML services based on their install numbers from Google Play and DeMistify can successfully execute 1250 of them (82.73%). In addition, an in-depth study is conducted to understand the on-device ML ecosystem in the mobile application.
DOI 原文 ·
@inproceedings{paperbot11266,
title = {DEMISTIFY: Identifying On-device Machine Learning Models Stealing and Reuse Vulnerabilities in Mobile Apps},
author = {Pengcheng Ren and Chaoshun Zuo and Xiaofeng Liu and Wenrui Diao and Qingchuan Zhao and Shanqing Guo},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3623325}
}