Gradient Masking

The practice of hiding or rounding the raw confidence probabilities returned by a model, often returning only the final class label. By suppressing the continuous probability vector, the defense removes the precise numerical signal that gradient-based extraction algorithms require to approximate the decision boundary.

• Hard Label Only: Return just the predicted class (e.g., 'cat') without any probability score
• Top-K Truncation: Return only the top 1 or 2 classes, suppressing the full distribution
• Precision Reduction: Round probabilities to one or two decimal places to introduce quantization noise
• Synonym: Prediction Truncation

The technique of adding statistical noise directly to a model's predictions or confidence scores to obscure the precise decision boundary. Unlike differential privacy, which provides formal guarantees, output perturbation is a pragmatic defense that degrades the signal-to-noise ratio for an attacker's surrogate model training.

• Gaussian Noise Injection: Add zero-mean Gaussian noise calibrated to the sensitivity of the output layer
• Laplace Mechanism: Apply Laplace-distributed noise for stronger privacy properties
• Temperature Scaling: Artificially increase the softmax temperature to flatten the probability distribution
• Trade-off: Higher noise levels degrade legitimate user experience while improving defense

Introducing controlled randomness into the model's output logic so that identical queries do not always return the exact same result. This breaks the deterministic mapping that extraction attacks rely on, forcing the attacker to average over many noisy samples and dramatically increasing query complexity.

• Stochastic Forward Pass: Enable dropout or other stochastic layers during inference
• Ensemble Sampling: Randomly select a sub-model from an ensemble for each query
• Boundary Jitter: Add small random offsets to the decision threshold
• Key Benefit: Prevents attackers from building a consistent surrogate model through repeated identical queries

Using a diverse ensemble of models to serve predictions, making the aggregate decision function inconsistent and harder to steal. Each query may be routed to a different model with slightly different decision boundaries, preventing the attacker from learning a single coherent function.

• Model Diversity: Train multiple architectures (CNN, Transformer, MLP) on the same task
• Round-Robin Serving: Rotate which model handles each incoming query
• Voting with Noise: Aggregate predictions with randomized weighting
• Synergy: Combines effectively with response randomization for layered defense

Applying a non-linear, secret transformation to input features before processing, so that stolen queries cannot train a useful surrogate model. The attacker observes outputs corresponding to a distorted input space, making the learned surrogate functionally useless on the original data distribution.

• Secret Key Transformation: Apply a parameterized, keyed non-linear function to inputs
• Dimensionality Expansion: Project inputs into a higher-dimensional space with a secret projection matrix
• Random Feature Mapping: Use random Fourier features or similar randomized projections
• Critical Requirement: The transformation must be kept strictly secret and rotated periodically

A defensive technique that injects slight, imperceptible variations into the input received by the model to degrade the quality of a stolen surrogate. Unlike input validation, fuzzing actively modifies the query before inference, poisoning the attacker's training data without significantly affecting legitimate accuracy.

• Adversarial Preprocessing: Apply small, model-specific perturbations to incoming queries
• Quantization Noise: Reduce input precision to introduce discretization artifacts
• Defensive JPEG Compression: Apply lossy compression to image inputs to remove high-frequency signals
• Implementation: Deploy as a transparent proxy layer before the model inference pipeline

Gradient masking deliberately hides or distorts the true gradient of the loss function. It works by making the model's decision surface appear shattered, vanishing, or stochastic to an attacker. Instead of a smooth slope to follow, the attacker encounters a deceptive, flat, or noisy terrain, preventing gradient-based optimization algorithms from converging on a functionally equivalent surrogate model.

This approach intentionally makes the gradient non-smooth or random. Techniques include:

• Thermometer Encoding: Discretizing inputs to create a step-function-like decision boundary.
• Input Transformations: Applying non-differentiable pre-processing.
• Randomized Networks: Introducing noise or dropout at inference time. The result is a gradient signal that points in a useless or misleading direction, thwarting surrogate model detection and extraction.

Gradient masking is not a panacea. Determined attackers can bypass it using:

• Black-Box Transfer Attacks: Crafting adversarial examples on a surrogate model and hoping they transfer.
• Finite Difference Estimation: Approximating the gradient by making tiny, individual changes to each input feature.
• Decision-Based Attacks: Walking the boundary by only observing the final class label. This has led to a shift toward certified defenses like differential privacy.

While gradient masking hides the slope, output perturbation hides the peak. This technique adds calibrated statistical noise directly to the model's predictions or confidence scores. By doing so, it obscures the precise decision boundary from an attacker performing query pattern analysis, making it a powerful companion to gradient masking for a defense-in-depth strategy against model stealing.

A non-algorithmic defense that directly attacks the attacker's process. Query throttling intentionally slows down API response times for suspicious clients. This increases the time and computational cost required to execute the thousands of queries needed for a successful extraction or gradient estimation attack, making the economic incentive for model extraction unsustainable.