Decoy Output

The primary mechanism involves returning high-confidence incorrect predictions to the attacker. Instead of simply denying service, the system provides a plausible but wrong answer with 99% confidence. This exploits the surrogate model's reliance on hard labels and confidence scores for distillation. The attacker's model learns an incorrect decision boundary, rendering the stolen copy functionally useless or dangerously unreliable in production.

Decoy outputs are not served randomly. They are activated by a rule engine that evaluates risk signals:

• Sequential Query Detection: Identifying systematic grid-scanning of the input space.
• Entropy Thresholding: Flagging queries that probe high-uncertainty boundary regions.
• Session Fingerprinting: Linking anonymous sessions exhibiting coordinated extraction patterns. Only when a composite risk score exceeds a threshold does the system switch to serving poisoned predictions.

A critical design constraint is that decoy outputs must be statistically indistinguishable from genuine predictions to avoid detection. If an attacker can easily identify which responses are decoys, they can filter them out. This requires the decoy generation function to match the output distribution of the real model, including realistic logit vectors and calibrated confidence scores, while still steering the surrogate toward a false objective function.

The goal is not just to cause a single error, but to strategically poison the surrogate's learning process:

• Decision Boundary Warping: Shifting the learned boundary away from the true model's logic.
• Inducing Catastrophic Forgetting: Causing the surrogate to unlearn previously extracted features.
• Backdoor Injection: Embedding a hidden trigger that causes the stolen model to misbehave on a specific input pattern, enabling later detection of unauthorized deployments.

Decoy output is distinct from Output Perturbation and Differential Privacy. Perturbation adds small random noise to genuine predictions to obscure the precise boundary. Decoy output, in contrast, serves a semantically incorrect but confident answer. It is an active deception, not a passive obfuscation. The former hides the truth; the latter replaces it with a lie specifically designed to mislead a learning algorithm.

Decoy outputs are often a feature of a broader Honeypot Model strategy. A lightweight, intentionally vulnerable decoy API is deployed as a trap. All queries to this endpoint return decoy outputs. This allows security teams to study attacker methodologies, extraction tooling, and query patterns in a controlled environment without exposing the production model. The intelligence gathered feeds back into hardening the primary defense.

The technique of adding calibrated statistical noise directly to model predictions or confidence scores. This obscures the precise decision boundary from an attacker attempting to train a surrogate model. Key approaches include:

• Laplacian noise for differential privacy guarantees
• Gaussian noise for continuous output spaces
• Randomized rounding of confidence scores Unlike Decoy Output, perturbation affects all users but with minimal accuracy impact for legitimate queries.

The practice of hiding or rounding raw confidence probabilities returned by a model. By returning only the final class label or a truncated top-k prediction, the API leaks significantly less information about the decision boundary per query. This directly increases the query complexity required for successful extraction. Common implementations return only the top-1 label or bin confidence scores into coarse categories (e.g., 'High', 'Medium', 'Low').

Monitoring API query sequences to detect the systematic, non-random access patterns indicative of extraction attacks. Key detection signals include:

• Grid-like sampling of the input space
• High query volume from a single session
• Low entropy in query distribution
• Sequential boundary probing When combined with Decoy Output, suspicious patterns can trigger the serving of poisoned predictions automatically.

The process of identifying unauthorized copies of a model by comparing their behavior on a set of proprietary trigger inputs to the original model's behavior. These trigger inputs are carefully crafted to produce distinctive outputs that serve as a behavioral watermark. If a suspected surrogate model produces identical responses to these triggers, it provides strong evidence of extraction. Decoy Output amplifies this by creating poisoned surrogates with detectable failure modes.

Introducing controlled randomness into the model's output logic so that identical queries do not always return the exact same result. This degrades the consistency of any surrogate model trained on the responses. Techniques include:

• Stochastic inference with dropout enabled at serving time
• Ensemble sampling where different ensemble members handle different queries
• Temperature scaling to vary output sharpness Unlike Decoy Output, randomization is applied uniformly rather than targeting suspicious clients.