  Counterfactual explanations find ways of achieving a favorable model outcome
with minimum input perturbation. However, counterfactual explanations can also
be exploited to steal the model by strategically training a surrogate model to
give similar predictions as the original (target) model. In this work, we
investigate model extraction by specifically leveraging the fact that the
counterfactual explanations also lie quite close to the decision boundary. We
propose a novel strategy for model extraction that we call Counterfactual
Clamping Attack (CCA) which trains a surrogate model using a unique loss
function that treats counterfactuals differently than ordinary instances. Our
approach also alleviates the related problem of decision boundary shift that
arises in existing model extraction attacks which treat counterfactuals as
ordinary instances. We also derive novel mathematical relationships between the
error in model approximation and the number of queries using polytope theory.
Experimental results demonstrate that our strategy provides improved fidelity
between the target and surrogate model predictions on several real world
datasets.
