机器翻译服务攻击 (AML.CS0005)

一句话通俗理解

UC Berkeley 研究者借公开翻译 API 的输出「克隆」了翻译模型——不用偷模型，问了三百万次就把能力问走了。

案例速览

事件经过

机器翻译服务（Google Translate、Bing Translator、Systran 等）提供公开 UI 与 API。UC Berkeley 研究团队利用这些公开接口发起了模型提取攻击，通过自然查询收集输入-输出对，成功复制出与原服务行为近似的模型，证明商业 NLP 模型面临知识产权窃取风险。

运用的 ATLAS 技术

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0005 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

S00

• 搜索开放技术数据库 (AML.T0000)

  The researchers used published research papers to identify the datasets and model architectures used by the target translation services.

S01

• 数据集 (AML.T0002.000)

  The researchers gathered similar datasets that the target translation services used.

S02

• 模型 (AML.T0002.001)

  The researchers gathered similar model architectures that the target translation services used.

S03

• AI 模型推理 API 访问 (AML.T0040)

  They abused a public facing application to query the model and produced machine translated sentence pairs as training data.

S04

• 复制推理 API 训练代理 (AML.T0005.001)

  Using these translated sentence pairs, the researchers trained a model that replicates the behavior of the target model.

S05

• AI 知识产权窃取 (AML.T0048.004)

  By replicating the model with high fidelity, the researchers demonstrated that an adversary could steal a model and violate the victim’s intellectual property rights.

S06

• 黑盒迁移 (AML.T0043.002)

  The replicated models were used to generate adversarial examples that successfully transferred to the black-box translation services.

S07

• 规避 AI 模型 (AML.T0015)

  The adversarial examples were used to evade the machine translation services by a variety of means. This included targeted word flips, vulgar outputs, and dropped sentences.

S08

• 侵蚀 AI 模型完整性 (AML.T0031)

  Adversarial attacks can cause errors that cause reputational damage to the company of the translation service and decrease user trust in AI-powered services.

关联战术

• 侦察 (AML.TA0002)
• 资源开发 (AML.TA0003)
• AI 模型访问 (AML.TA0000)
• AI 攻击适配 (AML.TA0001)
• 影响 (AML.TA0011)
• 初始访问 (AML.TA0004)

参考资料

以下为 MITRE ATLAS 官方案例收录的参考来源：

• Wallace, Eric, et al. “Imitation Attacks and Defenses for Black-box Machine Translation Systems” EMNLP 2020

• Project Page, “Imitation Attacks and Defenses for Black-box Machine Translation Systems”

• Google under fire for mistranslating Chinese amid Hong Kong protests

• MITRE ATLAS 官方案例页 (AML.CS0005)

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0