Feature Space Distortion

The distortion function is parameterized by a secret key known only to the model owner. Without this key, an attacker cannot reverse the transformation or understand the true geometry of the feature space. The key can be rotated periodically to limit the utility of any previously stolen data.

• Uses cryptographic hashing or keyed random projections
• Each API key or session can have a unique distortion key
• Compromised keys can be revoked without retraining the model

The transformation applies a non-linear warping of the input space, ensuring that the Euclidean distances and decision boundaries observed by an attacker bear no resemblance to the original model's geometry. This prevents surrogate models from learning a functionally equivalent mapping.

• Employs kernel functions or neural network-based bijectors
• Preserves relative ordering for legitimate classification
• Destroys the gradient information needed for optimization-based extraction

The distortion is designed to be locally isometric for legitimate inputs—nearby points in the original space remain nearby after transformation—so model accuracy is preserved. However, the global structure is scrambled, making systematic exploration of the boundary useless for an attacker.

• Maintains local neighborhood relationships
• Global manifold structure is intentionally corrupted
• Accuracy drop for legitimate users is negligible (<1%)

Rather than a static transformation, the system can inject query-dependent distortions that vary based on the input itself or session metadata. This makes it impossible for an attacker to average out the noise or learn a consistent inverse mapping.

• Distortion seed can be derived from a hash of the input vector
• Prevents differential analysis across multiple queries
• Adds negligible computational overhead per inference call

Because the attacker trains their surrogate on distorted feature-label pairs, the resulting model learns a fundamentally broken mapping. When the stolen model is deployed on undistorted real-world data, its predictions become random or adversarial, rendering the extraction effort worthless.

• Surrogate accuracy on clean data degrades to near-random
• Attacker cannot detect the distortion without a reference model
• Creates a strong deterrent against future extraction attempts

Feature Space Distortion operates as a lightweight preprocessing layer that wraps the model API. It requires no changes to the underlying model architecture or training pipeline, making it compatible with existing MLOps workflows and serving infrastructure.

• Implemented as a thin middleware or proxy layer
• Compatible with any black-box model type
• Can be combined with rate limiting and query pattern analysis for defense-in-depth