Attack on Machine Translation Services

Summary

Machine translation services (such as Google Translate, Bing Translator, and Systran Translate) provide public-facing UIs and APIs. A research group at UC Berkeley utilized these public endpoints to create a replicated model with near-production state-of-the-art translation quality. Beyond demonstrating that IP can be functionally stolen from a black-box system, they used the replicated model to successfully transfer adversarial examples to the real production services. These adversarial inputs successfully cause targeted word flips, vulgar outputs, and dropped sentences on Google Translate and Systran Translate websites. Target: Google Translate, Bing Translator, Systran Translate Actor: Berkeley Artificial Intelligence Research Procedure: 1. The researchers used published research papers to identify the datasets and model architectures used by the target translation services. 2. The researchers gathered similar datasets that the target translation services used. 3. The researchers gathered similar model architectures that the target translation services used. 4. They abused a public facing application to query the model and produced machine translated sentence pairs as training data. 5. Using these translated sentence pairs, the researchers trained a model that replicates the behavior of the target model. 6. By replicating the model with high fidelity, the researchers demonstrated that an adversary could steal a model and violate the victim's intellectual property rights. 7. The replicated models were used to generate adversarial examples that successfully transferred to the black-box translation services. 8. The adversarial examples were used to evade the machine translation services by a variety of means. This included targeted word flips, vulgar outputs, and dropped sentences.

Deployers

• Google Translate, Bing Translator, Systran Translate

Tags

• MITRE ATLAS
• AML.CS0005