Model Extraction & Stealing

A set of parameters that computes exactly the same function as yours, but need not match yours entry by entry: hidden units can be permuted and a unit's incoming and outgoing weights rescaled against each other without changing any reply.

A single call's latency is dominated by network jitter, queueing and co-tenant batching, which swamp any model-shape effect. Only a difference that survives averaging many interleaved calls carries information, and confounds that move with load never average away at all.

Ask what agreement was measured against, on which prompt distribution, how a text match was defined, and what the un-queried base model scored. One agreement rate describes an evaluation set, not the copy — and it establishes nothing about weights.

Ask which pool agreement was measured on and the target's base rate there. On a pool where the service answers benign 97% of the time, a copy that always says benign also scores 97%.

It divides one side of a copier's build-or-steal ledger by five while leaving their honest alternative untouched, so an endpoint nobody would copy at the old price can start paying for itself.

None is a boundary; you are picking prices. Per-key caps are amortised away by cheap identities, coarsening taxes your own bidders, and a distribution signal fades once imitated. Only identity friction raises an unspreadable cost.

Usually no. A planted mark costs accuracy on the licensee benchmark, commits the release, and leaves an unrotatable secret. Recognising behaviour the model already has is free and decidable later — buy the mark only if you would act on it.

Less than the team hopes, and say so plainly: a decayed mark read by a test with an unmeasured error rate is a lead, not evidence. The call is whether to fund the control run or drop the claim.

Not whether to explain, but the shape of the disclosure: how many fields it names, at what numeric precision, to which recipient, at what rate, and at what price. The obligation usually runs to the decision subject, one record at a time, not to a machine integrator pulling thousands a day.

Report what the field buys an adversary in money and time: the annotation budget a competitor no longer funds, and how fast a stand-in reaches usable quality. Leave the keep-or-cut call to the product owner.