What this project is about
ModelExtract MiniLab asks how easily a prediction service can be copied using only its answers. A locally trained target model receives numerical inputs and returns one of two class labels. A separate copy model, called a surrogate, learns from those answers without access to the target's training data or rules. Predictive fidelity measures agreement with the target; it is different from accuracy against the correct labels.
The entire experiment uses synthetic data with six numerical input features and two possible classes. No third-party service is queried. The project increases the number of queries available to the copy model and tests a defence that randomly changes some answers. This makes the trade-off explicit: frustrating imitation can also make the service less reliable for legitimate users.
How it works
- Local target model
- Query / response pairs
- Surrogate fidelity evaluation
Separate training and testing
The generator creates 6,000 examples: 2,500 train the target, 2,500 form the attacker's available query pool, and 1,000 are reserved for evaluation. These groups do not overlap. The copy model therefore cannot directly train on the examples later used to judge its performance.
Increase the query budget
Both models are decision trees: branching rules whose depth is limited to control complexity. The runner samples 25, 50, 100, 200 or 400 inputs and trains a copy from the returned answers. Each budget is repeated eight times with reproducible sampling, retaining individual measurements and summaries.
Measure the defence's cost
The defended service independently changes each returned class label with probability 0.15. Evaluation measures the copy's agreement with the target, its agreement with correct labels, and the defended service's own consistency with the original target. Keeping all three separate prevents weaker copying from appearing to be a cost-free improvement.
The important design choices
Keep the models inspectable
Choose decision trees and synthetic data generated under controlled conditions.
The trade-offThe experiment is inexpensive and reproducible, but both models use the same type of learner and data from the same generator. These conditions favour copying compared with many real services.
Change answers, not access
Study randomly altered responses as one defence in isolation.
The trade-offThe experiment does not model request-rate limits, per-user quotas or monitoring. An attacker can partly compensate for unreliable answers by collecting more observations.
Compare copying at equal budgets
A copy model receives a fixed number of synthetic inputs and either ordinary or randomly altered target answers.
- Send the same sampled numerical inputs to both local configurations.
- Train separate copy models from the returned answers.
- Measure agreement on reserved test examples and check the defended service's own consistency.
What this showsReduced copying accuracy is assessed together with the reliability lost by legitimate users, rather than treated as an isolated win.
Illustrative example, not an additional measured result.
How it was tested—and what it shows
The checks
The repository includes raw CSV measurements, a summary and the reproducible runner. The target agrees with the correct synthetic labels 90.2% of the time. Copying fidelity is instead measured against the target's predictions on reserved test examples; it does not mean the internal tree rules were recovered exactly. Eight repetitions describe this experiment, not performance across unrelated real-world settings.
What to take from the results
Standard-interface fidelity rises from 70.0% at 25 queries to 92.0% at 400. With randomized responses it rises from 63.3% to 83.9%. At the largest budget this is an 8.1-percentage-point reduction, while the defended API itself agrees with the unmodified target on only 86.2% of evaluation calls. Noise delays imitation here; it does not prevent it.
What to keep in mind
- No third-party service is attacked or queried.
- Synthetic data and a local target do not represent every model or service.
Technical notes & source
Built with
Python · scikit-learn · decision trees · pytest
Terms used in this project
- Surrogate model
- A second model trained to imitate another model’s answers.
- Fidelity
- How often the imitation agrees with the original.