δ-STEAL: LLM Stealing Attack with Local Differential Privacy

摘要

Large language models (LLMs) demonstrate remarkable capabilities across various tasks. However, their deployment introduces significant risks related to intellectual property. In this context, we focus on model stealing attacks, where adversaries replicate the behaviors of these models to steal services. These attacks are highly relevant to proprietary LLMs and pose serious threats to revenue and financial stability. To mitigate these risks, the watermarking solution embeds imperceptible patterns in LLM outputs, enabling model traceability and intellectual property verification. In this paper, we study the vulnerability of LLM service providers by introducing delta-Steal, a novel model stealing attack that bypasses the service provider’s watermark detectors while preserving the adversary’s model utility. delta-Steal injects noise into the token embeddings of the adversary’s model during fine-tuning in a way that satisfies local differential privacy (LDP) guarantees. The adversary queries the service provider’s model to collect outputs and form input-output training pairs. By applying LDP-preserving noise to these pairs, delta- Steal obfuscates watermark signals, making it difficult for the service provider to determine whether its outputs were used, thereby preventing claims of model theft. Our experiments show that delta-Steal with lightweight modifications achieves attack success rates of up to 96.95