Model Extraction & Stealing

Training a copy fits a fresh model to bought predictions, so it only approximates the original near where the queries landed. Parameter recovery instead treats precise numeric replies as equations and solves for the original weights themselves.

Labels, not data. Executable files are free and plentiful; what costs money is the service's verdict on each one. The budget is a fixed count of labels, so which files receive them decides how good the copy gets.

Because each paid call returns the target's answer on an input the attacker chose, so the endpoint sells labels. Copying by query wins only when that bill comes in under collecting, labelling and training on their own data.

The cap is attached to a key, and keys are cheap. Someone who can open self-serve accounts buys any total volume they want; the cap only fixes how many identities they need. The binding price is identity, not the per-key count.

It hands the caller the model's local sensitivity: for that record, which input fields move the score, in which direction, and roughly how much. That is information about the model, not only about one decision.

Because the caller supplies the text and the endpoint supplies the annotation. Every paid call returns a scored row they can keep, so ordinary integration quietly accumulates the labelled corpus your annotators were paid to produce.

Not much. Incidental observation gives an architecture family and a scale, not a specification, and a copy fitted on purchased replies need not match the target's architecture. It is a prior that trims the search, not the prize.

The test's false-positive rate on detectors known to be trained independently. Models built from overlapping public data agree on a great deal, so a test reading agreement as ownership also fires on models nobody stole.

Nobody fitting a copy wants the parameters. A returned score vector is already shaped like a training target, so the endpoint acts as a teacher and a competitor buys a functional stand-in at query prices.

A reply's fixed vector length and dtype, latency that grows with input length, and error text for oversized input reveal an output space, a rough scale and an input ceiling — a family and a shape, never parameters.

Watermarking plants a behaviour during your training run that a copy inherits, so a hit evidences derivation. Fingerprinting plants nothing: it picks inputs where your trained matcher already behaves distinctively and asks whether the suspect agrees.

A planted watermark is only extra behaviour held in the weights. Fitting the stolen detector to a camera reshapes those weights using footage that never exercises the mark, so it fades as a side effect nobody aimed at.

Fitting constrains the copy only where it has evidence. On prompts like those the attacker paid for it reproduces the endpoint; elsewhere nothing pins it down, so it answers from its own priors.

The evidence a solve reads is a faint change of slope where one unit switches on. It lives in the low-order digits of a returned number, so a coarsely rounded reply erases it.

Random byte-strings sit far off the distribution the classifier was fitted on, so nearly all of them come back with the same verdict. A label you could have predicted before paying for it teaches the copy nothing.

Two numbers multiplied: the price per call and the number of calls the wanted fidelity needs. Matching a target across its whole input range costs far more than reaching sellable accuracy on the narrow slice the adversary intends to serve.

Coarsening the reply costs a party building a functional copy a multiplier on their query bill and nothing more. It costs the honest bidder the identical lost resolution in the number their bid is computed from.

Three things, all before any theft: clean accuracy spent on behaviour the task never needed; a commitment bound to that training run; and a probe set that must stay secret, since verifying hands it to the suspect.

Re-distillation keeps none of the original weights. A fresh network learns only behaviour the holder's transfer inputs expose, so a mark keyed to secret inputs is never queried and never taught. A fine-tune at least starts from the marked weights.

The price is charged per call, but the value taken is per number returned. An explained reply carries a whole row of local sensitivity instead of one score, so a call limit sized against score-only traffic is loose by roughly the number of features disclosed.

One call returns one score per policy category, so a single payment annotates that text against every category at once. The response schema, not the call count, fixes how much supervision a dollar of API spend buys an attacker.

Parity was never the goal. A copy that agrees with yours on the traffic the attacker cares about, and that they now run locally with no per-call bill, no rate limit and no log entry, already repays their queries.

The query pattern separates them: a solve probes tight groups of near-identical inputs and needs the full numeric reply, while a harvest is large, broad and tolerant of rounding. Logs bound material, not conclusions.

A one-in-five reproduction against a shared endpoint is unproven until the measurement rules out the platform: were conditions interleaved, was a null control run, does the effect exceed per-call spread? Then rate severity against what replies already disclose.

It confuses free inputs with paid labels. In-domain executables cost nothing and the service itself supplies the labels - and labels are only needed where the boundary is, not everywhere the data is.

Because the adversary's alternative is data plus training, and data usually dominates. A model trained in a day on years of purchased labels is expensive to reproduce. The sum also settles only resale, not the other motives.

Product traffic is demand-weighted and repetitive; a campaign fitting a copy needs coverage, including inputs no customer asks about. Volume can be spread across cheap identities until every count is ordinary; that shape cannot, unless the adversary pays to imitate it.

The planted mark. It is behaviour the task never needed, so a holder loses it without giving up anything they stole. A fingerprint sits on ordinary close-call decisions, so moving off it degrades the matcher worth copying.

They hold claims paired with scores and per-field sensitivity rows — enough to fit a close functional stand-in over the segment their own book covers, and to read off which fields drive referrals. Not the parameters, not behaviour outside that segment, and not yet a changed decision.