Output Perturbation

The foundational mechanism of output perturbation involves adding noise drawn from a Laplace distribution to the model's raw output. This is the core of epsilon-differential privacy, where the scale of the noise is calibrated to the sensitivity of the query function. A larger epsilon value adds less noise, preserving utility, while a smaller epsilon adds more noise, providing a stronger mathematical privacy guarantee against extraction.

Instead of returning raw softmax probabilities, the system perturbs and rounds confidence scores. A model might return [0.87, 0.10, 0.03] for a prediction, but after perturbation, it returns [0.9, 0.1, 0.0]. This masks the gradient of the decision boundary, making it exponentially harder for an attacker to train a high-fidelity surrogate model through black-box querying, as the precise distance to the boundary is hidden.

A technique borrowed from statistical disclosure control where the model, with a certain probability, returns a randomly selected class label instead of the true top prediction. This introduces a deliberate, quantifiable error rate that protects the true decision function. The probability of randomization is a tunable parameter that directly controls the utility-privacy trade-off.

For tasks requiring continuous scores or embeddings, Gaussian noise is added directly to the logits before the softmax function. This is distinct from Laplacian noise and is often used to satisfy (ε, δ)-differential privacy guarantees. The standard deviation of the Gaussian distribution is scaled proportionally to the L2-sensitivity of the query, ensuring that the perturbed output distribution is statistically indistinguishable from the true one.

A fixed noise level is suboptimal. Advanced systems implement a privacy budget that tracks cumulative information leakage per API session. As a client makes more queries, the perturbation magnitude increases dynamically. This directly counters sequential query attacks where an attacker systematically probes the input space, ensuring that the total privacy loss over N queries remains bounded by a predefined epsilon value.

The central challenge is maintaining model accuracy for legitimate users while thwarting extraction. Techniques like consistency-constrained perturbation ensure that the noisy output does not change the final argmax class label. Noise is injected only into the non-maximum logits or applied in a way that preserves the relative ranking of the top-k predictions, ensuring that the user-facing classification remains correct and useful.

The practice of hiding or rounding raw confidence probabilities returned by a model. Instead of returning [0.92, 0.07, 0.01], the API returns only the final class label or a heavily quantized score.

• Hard Label Only: Return just "Cat" instead of probabilities
• Top-K Truncation: Return only the top 1 or 2 classes
• Precision Reduction: Round scores to one decimal place

This directly reduces the information leakage per query, making it harder for an attacker to reconstruct the precise decision boundary.

A mathematical framework that injects calibrated noise into query responses to provide a provable guarantee that individual training records cannot be inferred. Governed by the privacy parameter epsilon (ε), which quantifies the privacy loss.

• Laplace Mechanism: Adds noise drawn from a Laplace distribution to continuous outputs
• Gaussian Mechanism: Uses Gaussian noise for tighter composition under multiple queries
• Privacy Budget: Tracks cumulative ε expenditure across all queries to a model

Lower epsilon values mean stronger privacy but reduced utility.

Monitoring API query sequences to detect the systematic, non-random access patterns indicative of an ongoing model extraction attack. Legitimate users query sporadically; attackers probe the input space methodically.

• Sequential Query Detection: Identifies temporally correlated queries that map input boundaries
• Entropy Thresholding: Flags queries where prediction entropy is high, as boundary-probing queries are most valuable for extraction
• Session Fingerprinting: Links anonymous sessions by device characteristics and querying behavior

This enables real-time throttling or blocking before a surrogate model converges.

Using a diverse ensemble of models to serve predictions, making the aggregate decision function inconsistent and harder to steal than a single model. Each query may be routed to a different model in the ensemble.

• Randomized Routing: Select a model at random for each inference request
• Voting Aggregation: Combine outputs from multiple models with non-deterministic tie-breaking
• Model Heterogeneity: Use models with different architectures trained on different data subsets

The attacker observes a moving target rather than a fixed decision boundary.

A defensive mechanism that restricts the number of API requests a client can make within a specific time window to prevent automated model extraction. Rate limits increase the time and cost required to build a surrogate model.

• Token Bucket Algorithm: Allows bursts up to a capacity, refilling at a steady rate
• Sliding Window Log: Tracks timestamps of recent requests per client
• Tiered Limits: Apply stricter limits to unauthenticated or free-tier users

Combined with proof-of-work challenges, this creates a significant economic barrier to large-scale extraction.

Embedding a unique, verifiable identifier into a model's weights or behavior to prove ownership if the model is stolen and deployed elsewhere. Watermarks survive extraction attempts and provide forensic evidence.

• Weight-Based Watermarking: Embeds a secret pattern directly into model parameters during training
• Backdoor Watermarking: Trains the model to produce a specific output for a secret trigger input
• Zero-Bit Watermarking: Detects the presence of a watermark without extracting a payload

When a suspected surrogate model responds to the trigger input, ownership is cryptographically provable.