Model Stealing Through the Lens of Model Multiplicity

2026-06-13

AI Summary

This study reexamines the prevailing assumption in model stealing attacks that high-fidelity surrogate models are functionally equivalent to their targets, through the lens of model multiplicity. By constructing the Rashomon set of a target model and integrating multiplicity-aware metrics—such as ambiguity, disparity, and Rashomon capacity—alongside group fairness measures, the authors systematically evaluate deployment-relevant properties of surrogate models across tabular data, medical imaging, and NLP tasks. Their findings reveal that, despite achieving near-identical prediction fidelity, surrogate models often exhibit substantial discrepancies in critical performance and fairness dimensions, thereby challenging conventional notions of equivalence. This work pioneers the incorporation of model multiplicity into the model stealing literature, uncovering previously overlooked risks associated with deploying high-fidelity surrogates in real-world applications.

Abstract

Model stealing attacks, where adversaries create high-fidelity surrogate models, are a significant threat to the intellectual property of machine learning services. Conventional wisdom suggests these surrogates could provide adversaries with economic leverage comparable to the original service providers. This paper challenges this assumption by evaluating model stealing attacks beyond mere fidelity to the target model. Because query-based extraction provides only partial supervision of the target's input-output behavior, the surrogate is not uniquely identified: many near-optimal surrogates can achieve comparable fidelity while differing in deployment-relevant properties. Instead of performing a classic learning-based model stealing attack, we compute the Rashomon Set (i.e., the set of almost-equally-accurate models) of surrogate models, and evaluate its diversity using multiplicity metrics (ambiguity, discrepancy, and Rashomon Capacity) and group fairness metrics. Across tabular, medical imaging, and NLP tasks, our experiments on real-world datasets reveal that despite exhibiting similar fidelity to the target model, surrogate models can display significant variances in other critical performance metrics. These findings cast doubt on the presumed equivalence between high-fidelity surrogates and the target model in practical deployment scenarios.

Problem

• model stealing
• model multiplicity
• surrogate models
• Rashomon Set
• fairness

Innovation

• model stealing
• model multiplicity
• Rashomon set
• surrogate models
• fairness