A blockchain assisted hybrid detection and auditing framework for model stealing defense
TL;DR
Experimental results show that HD consistently outperforms standalone HODA under mixed malicious-benign query scenarios, and results demonstrate that BHDAF strengthens model-stealing detection and tamper-evident auditing under the evaluated MLaaS scenarios.
Abstract
Model stealing has emerged as a serious threat to Machine Learning as a Service (MLaaS), where adversaries can reconstruct model functionality and infer sensitive information through malicious query sequences. To address this challenge, we propose a blockchain-assisted defense and auditing framework that combines hybrid-metric detection with verifiable query-record auditing. Specifically, the framework integrates HODA (Hardness-Oriented Detection Approach) hardness features with MSP (Maximum Softmax Probability) distribution entropy to form a hybrid detection metric (HD), enabling accurate identification of abnormal query behavior and quantification of user-level maliciousness. In parallel, we design a two-layer blockchain tree architecture: the Hash Chain-integrated Detection Information Merkle Tree (HCDIMT) provides tamper-evident storage and verification of query sequences, while the Sorted Account Merkle Tree (SAMT) supports efficient batch auditing of suspicious users through malicious-score-aware ordering. Experimental results show that HD consistently outperforms standalone HODA under mixed malicious-benign query scenarios. In addition, HCDIMT effectively detects record tampering, and in the evaluated 20,000-user setting, SAMT reduces proof size from 60,000 hashes (BMT) and 8,004 hashes (QMT) to 13 hashes at the 20% audit point, while the audit-ratio scaling test remains stable as \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\alpha$$\end{document} increases up to 90%. A local Ethereum-compatible gas benchmark further shows that SAMT remains executable for large dispute-audit batches where BMT or QMT can exceed the block gas limit. Together, these results demonstrate that BHDAF strengthens model-stealing detection and tamper-evident auditing under the evaluated MLaaS scenarios.