  Model extraction attacks (MEAs) enable an attacker to replicate the
functionality of a victim deep neural network (DNN) model by only querying its
API service remotely, posing a severe threat to the security and integrity of
pay-per-query DNN-based services. Although the majority of current research on
MEAs has primarily concentrated on neural classifiers, there is a growing
prevalence of image-to-image translation (I2IT) tasks in our everyday
activities. However, techniques developed for MEA of DNN classifiers cannot be
directly transferred to the case of I2IT, rendering the vulnerability of I2IT
models to MEA attacks often underestimated. This paper unveils the threat of
MEA in I2IT tasks from a new perspective. Diverging from the traditional
approach of bridging the distribution gap between attacker queries and victim
training samples, we opt to mitigate the effect caused by the different
distributions, known as the domain shift. This is achieved by introducing a new
regularization term that penalizes high-frequency noise, and seeking a flatter
minimum to avoid overfitting to the shifted distribution. Extensive experiments
on different image translation tasks, including image super-resolution and
style transfer, are performed on different backbone victim models, and the new
design consistently outperforms the baseline by a large margin across all
metrics. A few real-life I2IT APIs are also verified to be extremely vulnerable
to our attack, emphasizing the need for enhanced defenses and potentially
revised API publishing policies.
