  Machine learning models are vulnerable to adversarial attacks. In this paper,
we consider the scenario where a model is distributed to multiple buyers, among
which a malicious buyer attempts to attack another buyer. The malicious buyer
probes its copy of the model to search for adversarial samples and then
presents the found samples to the victim's copy of the model in order to
replicate the attack. We point out that by distributing different copies of the
model to different buyers, we can mitigate the attack such that adversarial
samples found on one copy would not work on another copy. We observed that
training a model with different randomness indeed mitigates such replication to
a certain degree. However, there is no guarantee and retraining is
computationally expensive. A number of works extended the retraining method to
enhance the differences among models. However, a very limited number of models
can be produced using such methods and the computational cost becomes even
higher. Therefore, we propose a flexible parameter rewriting method that
directly modifies the model's parameters. This method does not require
additional training and is able to generate a large number of copies in a more
controllable manner, where each copy induces different adversarial regions.
Experimentation studies show that rewriting can significantly mitigate the
attacks while retaining high classification accuracy. For instance, on GTSRB
dataset with respect to Hop Skip Jump attack, using attractor-based rewriter
can reduce the success rate of replicating the attack to 0.5% while
independently training copies with different randomness can reduce the success
rate to 6.5%. From this study, we believe that there are many further
directions worth exploring.
