New Antidistillation Method Protects AI Classifiers from Replication Attacks

A new research paper introduces ADS-C, a novel defense mechanism designed to protect proprietary AI classifiers from knowledge distillation attacks. These attacks involve adversaries querying a model's prediction interface to train a surrogate model that mimics its behavior. ADS-C works by applying an input-dependent perturbation to the served probability distribution, making it harder for an attacker's student model to learn effectively. Crucially, ADS-C is engineered to maintain the defended teacher model's original top-1 prediction accuracy, ensuring its utility remains unimpaired. Despite this, the method demonstrates substantial degradation in the performance of distilled student models, with reported drops of up to 29.7 percentage points on various datasets. This approach not only removes the incentive to distill soft probabilities but actively reverses it, making the attack counterproductive.