API Rate Limiting

The simplest rate-limiting strategy, dividing time into discrete, fixed intervals (e.g., 60 seconds). A counter tracks requests per client within the current window, resetting to zero at the next interval boundary.

• Mechanism: If counter > limit, reject the request.
• Vulnerability: Susceptible to traffic bursts at the window edge, where a client can exhaust the limit in the first second and again immediately after the reset, effectively doubling the allowed rate.
• Use Case: Suitable for basic protection where burst tolerance is acceptable and implementation simplicity is paramount.

A precise algorithm that timestamps every request and evaluates the count within a rolling lookback period (e.g., the last 60 seconds). This eliminates the edge-case bursts of the fixed window.

• Mechanism: Upon a new request, discard timestamps older than the window size. If the count of remaining timestamps exceeds the limit, reject the request.
• Trade-off: High memory consumption for high-volume APIs, as it stores a timestamp for every request in the active window.
• Precision: Provides exact rate enforcement, making it ideal for strict model extraction prevention where every query must be accounted for.

A flexible algorithm that simulates a bucket filled with tokens at a constant rate. Each request consumes a token; if the bucket is empty, the request is rate-limited. This allows for controlled burst tolerance.

• Mechanism: A bucket holds a maximum of b tokens, refilling at r tokens per second. A client can burst up to b requests instantaneously but is then constrained to the steady refill rate r.
• Advantage: Smooths out short traffic spikes without penalizing sustained legitimate usage, making it a standard choice for public APIs.
• Extraction Context: An attacker can exhaust the burst capacity quickly, so the bucket depth (b) must be tuned to limit the initial information gain in a model stealing attempt.

Processes requests at a fixed, constant rate using a First-In-First-Out (FIFO) queue. If the queue is full, incoming requests are discarded. This enforces a rigid, smooth output rate with zero tolerance for bursts.

• Mechanism: Requests enter a queue of size q and are processed at a fixed interval. This transforms a bursty arrival pattern into a uniform departure pattern.
• Traffic Shaping: Unlike the Token Bucket, which allows bursts, the Leaky Bucket is a pure traffic shaper, ideal for smoothing load on downstream model inference servers.
• Extraction Defense: By enforcing a perfectly uniform query rate, it eliminates an attacker's ability to rapidly probe the decision boundary in short bursts, imposing a strict temporal cost on extraction.

Moves beyond static thresholds by dynamically adjusting limits based on client behavior, system load, or threat intelligence. This is a critical evolution for preemptive algorithmic cybersecurity.

• Signals: Adjusts limits based on query pattern analysis (e.g., high entropy queries indicating boundary probing), endpoint sensitivity, or current server CPU utilization.
• Response: Instead of a hard block, it can inject response delays, return decoy outputs, or trigger a proof-of-work challenge for suspicious sessions.
• Extraction Defense: An adaptive limiter can detect the systematic, non-random query sequences of a model extraction attack and automatically throttle access before a surrogate model can be trained, effectively acting as an automated intrusion response system.

The practice of hiding or rounding the raw confidence probabilities returned by a model, often returning only the final class label. This directly reduces the information leakage per query that an attacker needs to train a surrogate model.

• Top-1 only: Return only the highest-probability class without scores
• Score rounding: Coarsen probabilities to limited decimal places
• Score quantization: Bucket scores into broad categories (e.g., 'High', 'Medium', 'Low')

Without precise confidence scores, an attacker cannot efficiently map the model's decision boundary, making extraction exponentially more expensive.

A defensive mechanism requiring a client to solve a computationally expensive cryptographic puzzle before serving an inference request. This technique increases the cost of automated extraction without impacting legitimate low-frequency users.

• Adaptive difficulty: Puzzle complexity scales with request rate
• Asymmetric cost: Cheap for the server to verify, expensive for the client to solve
• Stateless operation: No session tracking required

A single PoW challenge can add milliseconds of CPU time, which compounds to hours or days of wasted compute for an attacker attempting millions of extraction queries.

A decoy model deployed specifically to attract and mislead attackers, allowing security teams to study extraction techniques without exposing the production model. Honeypots serve as both an early warning system and an intelligence-gathering tool.

• Behavioral mimicry: Responds plausibly but with subtly degraded accuracy
• Watermark injection: Embeds traceable identifiers into stolen surrogates
• Alert triggering: Notifies security teams when extraction patterns are detected

Attackers who train on honeypot outputs produce demonstrably inferior surrogate models, wasting their resources while defenders gain threat intelligence.

The technique of adding statistical noise directly to a model's predictions or confidence scores to obscure the precise decision boundary from an attacker. This is a direct application of differential privacy principles to the inference endpoint.

• Laplace noise: Calibrated noise drawn from a Laplace distribution
• Gaussian noise: Noise scaled to the sensitivity of the query function
• Privacy budget: A quantifiable limit on total information disclosure over time

Output perturbation provides a mathematical guarantee that an attacker cannot reconstruct the exact model behavior, even with unlimited queries, by bounding the information leaked per response.

Building a unique profile of a client's querying behavior and device characteristics to link anonymous sessions and detect coordinated extraction campaigns. This technique defeats attackers who rotate IP addresses or API keys to evade simple rate limits.

• Browser fingerprinting: Canvas, WebGL, and font enumeration
• Query rhythm analysis: Inter-request timing patterns unique to automated scripts
• Input distribution clustering: Grouping sessions by the statistical properties of their queries

Fingerprinting enables cross-session rate limiting, where the limit applies to the attacker's identity rather than a single API key, closing a critical evasion loophole.