Cost-Based Querying

The core principle is to attach a monetary or credit cost to each inference request. This converts the attack from a purely technical problem into an economic one. An attacker attempting to build a surrogate model with millions of queries faces a direct, linear financial barrier. Key mechanisms include:

• Per-call billing: Charging fractions of a cent per API call, making high-volume extraction unprofitable.
• Credit depletion: Pre-paid credit systems that halt access when the balance reaches zero, automatically terminating extraction attempts.
• Tiered pricing: Escalating costs for higher-fidelity or higher-volume access tiers that are most valuable for extraction.

Cost-based querying is most effective when combined with rate limiting and query throttling. While cost creates a financial barrier, rate limiting imposes a temporal one. Together, they force an attacker to spend more money over a longer period, increasing the window for detection. Combined strategies:

• Cost escalation: Increasing the per-query price as the request rate exceeds defined thresholds.
• Burst pricing: Applying premium costs to sudden, high-volume query bursts characteristic of automated extraction scripts.
• Concurrency pricing: Charging more for parallel query streams, directly targeting distributed extraction campaigns.

A metered API requires robust identity and attribution to function. Every query must be tied to an authenticated account for billing, which simultaneously creates an audit trail for security forensics. Essential components:

• API tokenization: Rotating, per-client tokens that link every query to a specific billing entity.
• Session fingerprinting: Correlating billing accounts with device and behavioral fingerprints to detect account sharing or token theft.
• Immutable audit logs: Recording every paid query with its timestamp, input hash, and account ID for post-incident analysis and legal evidence.

Static pricing can be gamed. Advanced implementations use dynamic cost calibration that adjusts the price per query based on the information value it leaks. Queries that probe the model's decision boundary are priced higher. Calibration signals:

• Entropy-based pricing: Charging more for queries where the model's prediction confidence is low, as these boundary-probing queries are most valuable for extraction.
• Novelty pricing: Increasing cost for inputs that are significantly different from previously seen queries, indicating systematic input space exploration.
• Gradient-value pricing: Estimating the mutual information a query provides about the model's parameters and pricing accordingly.

Beyond monetary cost, computational cost can be imposed via proof-of-work challenges. The client must solve a cryptographic puzzle before the inference request is processed. This is a non-monetary variant of cost-based querying that is particularly effective against botnets. Implementation approaches:

• Client-side puzzle: Requiring a hashcash-style challenge to be solved, with difficulty scaling based on client reputation.
• Resource-bound access: Making the cost of querying proportional to the computational resources an attacker must expend, independent of financial systems.
• Hybrid models: Combining microtransactions with proof-of-work for a dual economic and computational barrier.

Cost-based querying aligns the security posture with the business model. The API is a product, not a free resource. This shifts the organizational mindset from purely reactive security to proactive monetization of access. Strategic benefits:

• Revenue generation: Turning a vulnerability vector into a revenue stream.
• Customer qualification: Filtering out non-serious users who are more likely to be attackers or competitors.
• Usage analytics: Gaining deep visibility into query patterns through the billing system, which doubles as an intrusion detection system.

A foundational defense that restricts the number of requests a client can make within a defined time window. Unlike cost-based querying which creates an economic disincentive, rate limiting enforces a hard cap on query volume.

• Token bucket algorithms allow short bursts while maintaining long-term averages
• Sliding window counters provide precise control over rolling time periods
• Effective against brute-force extraction but can be circumvented by distributing queries across multiple accounts
• Often combined with cost-based models for defense-in-depth

The intentional slowing of response times for suspicious or high-frequency clients. This increases the wall-clock time required for extraction without outright blocking requests.

• Progressive delay increases latency as query frequency rises
• Makes large-scale extraction temporally expensive rather than just financially costly
• Particularly effective against real-time surrogate model training
• Can be combined with cost-based querying to impose both time and monetary penalties

The practice of hiding or rounding raw confidence probabilities returned by a model. When combined with cost-based querying, each paid query yields minimal information.

• Returning only the top-1 class label eliminates decision boundary detail
• Score rounding to coarse intervals obscures precise gradients
• Forces attackers to purchase more queries to approximate the model surface
• Directly increases the information cost per dollar spent

Requiring clients to solve a computationally expensive cryptographic puzzle before serving an inference request. This adds a computational cost layer on top of any monetary pricing.

• Hashcash-style challenges require significant CPU cycles per query
• Makes automated extraction energy-inefficient at scale
• Particularly effective against GPU-accelerated extraction pipelines
• Creates a dual cost: monetary payment plus compute expenditure

Monitoring API query sequences to detect the systematic, non-random access patterns indicative of extraction attempts. Cost-based querying provides the economic framework, while pattern analysis identifies attackers for enforcement.

• Entropy measurement of query sequences reveals structured probing
• Spatial correlation between consecutive inputs indicates boundary mapping
• Enables dynamic pricing: legitimate users get standard rates while suspected extractors face surge pricing
• Triggers automated escalation to stricter defenses

Introducing controlled randomness into model outputs so identical queries do not return identical results. This degrades the signal-to-noise ratio of purchased queries.

• Stochastic perturbation within a bounded range preserves utility while obscuring precision
• Forces attackers to oversample each input region, multiplying extraction costs
• Combined with per-query pricing, creates a multiplier effect on attacker expenditure
• Legitimate users experience negligible accuracy impact