<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE article PUBLIC "-//NLM//DTD JATS (Z39.96) Journal Publishing DTD v1.3 20210610//EN" "https://jats.nlm.nih.gov/publishing/1.3/JATS-journalpublishing1-3.dtd">
<article article-type="research-article" dtd-version="1.3" xml:lang="ru">
  <front xmlns:xlink="http://www.w3.org/1999/xlink">
    <journal-meta>
      <journal-id journal-id-type="elibrary">9004</journal-id>
      <journal-title-group>
        <journal-title>Problems of information security. Computer systems</journal-title>
        <trans-title-group xml:lang="ru">
          <trans-title>Проблемы информационной безопасности. Компьютерные системы</trans-title>
        </trans-title-group>
      </journal-title-group>
      <issn pub-type="epub">2071-8217</issn>
    </journal-meta>
    <article-meta xmlns:xlink="http://www.w3.org/1999/xlink">
      <article-id pub-id-type="publisher-id">9</article-id>
      <title-group>
        <article-title>Protection against the threat of the machine learning models extraction</article-title>
        <trans-title-group xml:lang="ru">
          <trans-title>Защита от угрозы извлечения вычислительных моделей машинного обучения</trans-title>
        </trans-title-group>
      </title-group>
      <contrib-group>
        <contrib contrib-type="author">
          <name>
            <surname>Soshnev</surname>
            <given-names>Maxim</given-names>
          </name>
          <xref ref-type="aff" rid="aff1"/>
        </contrib>
        <contrib contrib-type="author">
          <contrib-id contrib-id-type="orcid">0000-0002-9732-0099</contrib-id>
          <name>
            <surname>Kalinin</surname>
            <given-names>Maxim</given-names>
          </name>
          <xref ref-type="aff" rid="aff1"/>
          <email>max@ibks.spbstu.ru</email>
        </contrib>
      </contrib-group>
      <aff id="aff1">Peter the Great St. Petersburg Polytechnic University</aff>
      <pub-date publication-format="electronic" date-type="pub" iso-8601-date="2023-08-31">
        <day>31</day>
        <month>08</month>
        <year>2023</year>
      </pub-date>
      <issue>Спецвыпуск</issue>
      <fpage>95</fpage>
      <lpage>107</lpage>
      <self-uri xmlns:xlink="http://www.w3.org/1999/xlink" content-type="pdf" xlink:href="https://jisp.spbstu.ru/userfiles/files/soderzhaniya/2023_spetsvipusk_ru_.pdf"/>
      <abstract xml:lang="en">
        <p>The threat of extraction of the machine learning models is considered. Most of the modern approaches to the prevention of machine learning models extraction are based on the use of the protective noising mechanism. The main disadvantage of this protective method is the decrease in the accuracy of the outputs generated by the protected model. The paper states the requirements for methods for protecting machine learning models against extraction and presents a new method, which supplements noise with a distillation stage. It has been experimentally shown that the developed method ensures the resistance of machine learning models to extraction while maintaining the quality of their results by transforming the protected models to other, the simplified, but equivalent, models.</p>
      </abstract>
      <kwd-group xml:lang="en">
        <kwd>machine learning security</kwd>
        <kwd>model distillation</kwd>
        <kwd>noising</kwd>
        <kwd>soft label</kwd>
        <kwd>degree of security</kwd>
        <kwd>accuracy of results</kwd>
        <kwd>model extraction threat</kwd>
      </kwd-group>
    </article-meta>
  </front>
</article>
