Model Extraction Defense

Injects calibrated noise into model predictions to degrade the fidelity of stolen replicas while preserving utility for legitimate users.

• Differential Privacy: Adds mathematical noise to outputs, bounding the information leakage from any single query
• Confidence Reduction: Returns only hard labels instead of full probability vectors to limit information extraction
• Rounding and Discretization: Truncates floating-point outputs to reduce precision available for equation solving

Restricts the frequency and volume of API calls to prevent adversaries from amassing the large query-response datasets required for distillation attacks.

• Token Bucket Algorithms: Enforces burst limits while allowing sustained legitimate traffic
• Per-User Throttling: Caps daily queries per authenticated account to block systematic scraping
• Progressive Delays: Introduces escalating latency for anomalous query patterns to frustrate extraction attempts

Monitors API traffic in real-time to identify extraction attempts by detecting statistical deviations from normal usage patterns.

• Entropy Analysis: Flags queries that systematically probe the entire input space rather than targeting specific tasks
• Distributional Similarity Checks: Compares incoming query distributions against known extraction attack signatures
• Adversarial Sequence Detection: Identifies query chains designed to iteratively refine a stolen model's decision boundary

Embeds persistent, verifiable identifiers into model behavior that survive extraction, enabling forensic proof of intellectual property theft.

• Backdoor Watermarks: Trains the model to produce specific outputs on rare trigger inputs, creating a detectable signature in stolen copies
• Adversarial Marking: Inserts subtle statistical patterns into outputs that can be recovered from extracted models
• API-Level Fingerprinting: Injects unique, imperceptible perturbations per user to trace leaked models back to the source

Limits the granularity and type of information returned by the API to minimize the signal available for model reconstruction.

• Top-K Only Responses: Returns only the top predicted classes without full distributional information
• Decision-Based Access: Provides only the final classification without any confidence scores or logits
• Gradient Masking: Prevents access to model gradients, blocking optimization-based extraction techniques like Jacobian-based dataset augmentation

Trains a student model on softened probability outputs from an ensemble of teacher models, creating a smoother decision surface that resists extraction.

• Ensemble Diversity: Combines models with different architectures to prevent a single extraction strategy from succeeding
• Temperature Scaling: Uses high-temperature softmax during training to produce smoother output distributions that are harder to reverse-engineer
• Rotating Model Pools: Periodically swaps which model in the ensemble serves queries, degrading the consistency of extracted replicas

A standardized test suite designed to measure a model's resilience against evasion, poisoning, and extraction attacks. These benchmarks quantify how many queries an attacker needs to successfully clone a model's decision boundary.

• Includes decision boundary approximation tests
• Measures query efficiency of simulated extraction attacks
• Provides a comparative score for vendor model hardening

A quantifiable limit on the total privacy loss allowed during iterative queries to a model. By adding calibrated noise to outputs, differential privacy mathematically bounds what an attacker can learn from repeated API calls, directly limiting model extraction fidelity.

• Parameter ε (epsilon) controls the privacy-utility tradeoff
• Lower epsilon = stronger extraction resistance
• Composable across multiple queries to prevent temporal inference

A privacy attack that determines whether a specific data record was used in a model's training set. This is often a precursor to extraction—attackers first probe membership, then reconstruct the decision boundary. Defenses against both attacks overlap significantly.

• Exploits overfitting to distinguish training from test data
• Shadow model training simulates target model behavior
• Co-training defenses reduce both MIA and extraction risk

The potential for an attacker to reconstruct sensitive training data features by querying a deployed model. While extraction steals the model itself, inversion steals the data behind it. Both exploit overly confident prediction scores.

• Gradient-based inversion reconstructs input prototypes
• Confidence score clipping mitigates both risks
• Federated learning environments are particularly vulnerable

A foundational operational control that restricts the number and frequency of queries a single client can make. While not cryptographically robust, rate limiting raises the cost of extraction attacks by forcing adversaries to distribute queries across many accounts and IP addresses.

• Token bucket and sliding window algorithms
• Combined with CAPTCHA challenges for suspicious patterns
• First line of defense before statistical countermeasures