MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AI

Explainable AI systems may be more vulnerable to theft: The paper demonstrates that when AI models provide explanations for their predictions (a key feature of responsible AI), attackers can exploit those explanations to steal the model more efficiently. The MEGEX attack reconstructed models at 97-98% accuracy of the original, showing that transparency features can inadvertently create security risks.

Model extraction attacks are a real threat to AI services: The research confirms that adversaries can steal trained neural networks deployed in cloud-based Machine Learning as a Service (MLaaS) platforms using only prediction outputs and explanations—without needing access to the original training data. This threatens the intellectual property and privacy protections that organizations rely on.

There's a fundamental trade-off between interpretability and security: The paper explicitly identifies a tension between two important goals in responsible AI: making models interpretable (so users understand decisions) and protecting them from theft. Organizations deploying explainable AI systems must now consider this security vulnerability when deciding how much explanation to provide.

Fewer queries are needed when explanations are available: By leveraging gradient-based explanations, attackers needed only 2-20 million queries to reconstruct high-accuracy models, suggesting that the additional information from explanations significantly reduces the effort required for model extraction compared to attacks without this information.