How much does inferring a paid endpoint's architecture family help an attacker copying it?

## The wrong answer this question exists to correct Asked what an attacker gains by fingerprinting a hosted model from timing, reply shape and error text, a competent engineer often answers: *they could recover our architecture and hyperparameters, and then rebuild the model.* Both halves fail. ## Half one: the observation is coarse Incidental behaviour around replies is not a specification. An exact output dimension and numeric type; an input ceiling; a rough compute scale from how latency grows with input length; a partly constrained preprocessing story. From that, a small set of plausible architecture families at a plausible scale survives, and the rest are eliminated. Nothing in that list is a layer count, a hidden width, an attention configuration, a training objective, a corpus, a learning-rate schedule, or a weight. Reports that leap from *narrowed to a family* to *recovered the architecture* have crossed a line the evidence does not support, and an interviewer is listening for whether the candidate notices. ## Half two: even an exact blueprint would not be the prize This is the part that surprises people. A copy assembled from purchased replies is a **functional** artefact: the attacker sends inputs, records the endpoint's outputs, and fits their own model to that mapping. What the fitted model must do is agree with the target on inputs that matter to them. Nothing in that objective requires the copy's internals to resemble the target's. A different family, a different depth, a different parameter count can all reach useful agreement, and in practice the copy frequently is a different shape entirely — sometimes smaller, because it only has to cover the region the attacker actually cares about. So an architecture prior is worth exactly what a prior is worth: it trims a search. Concretely, it tells the attacker roughly what capacity to give their own model so it is not hopelessly under-sized or wastefully over-sized; it tells them the output width to target so the copy is a drop-in for whatever consumed the original; it tells them the input ceiling so paid calls are not spent on text that will be silently truncated. Each of those saves effort and money. None of them is the thing that determines whether the copy is any good — that is decided by which inputs get bought and how faithfully the replies are fitted, which is a separate subject. ## Why the distinction changes what a defender does If you believe the architecture is the crown jewel, you spend effort obscuring it: strip error detail, add jitter, hide the model card, refuse to state the dimension. Most of that either does not work (the output width is the product), degrades legitimate integrators, or buys a constant factor of attacker effort. If you believe the replies are the asset — which is the correct reading — you look instead at what volume of replies a customer can accumulate, what those replies are worth in aggregate, and what your terms and your detection do about bulk acquisition. Diagnosing the exposure correctly is what makes the control selection sensible. ## The honest asymmetry There is one setting where architecture knowledge matters more than described here: when an attacker is trying to solve for parameters rather than fit a stand-in, structural assumptions become load-bearing. That is a different vantage with much stronger requirements, and it is not what incidental observation of a paid endpoint delivers. Keeping those two apart — fitting a behavioural copy versus solving for the actual parameters — is the cleanest way to talk about this in an interview. ## How to answer it out loud Say: the side channel yields a family and a scale, not a specification. Then say: a functional copy does not need to match the architecture anyway, so this is a prior that speeds the copy rather than a prize in itself. Then name what it *does* buy — sizing, output width, input ceiling, a few eliminated preprocessing hypotheses — so the answer is not dismissive. That sequence shows you can rate a finding rather than merely recognise it.