Query Fuzzing

The core mechanism involves adding carefully calibrated noise to incoming queries before they reach the model. This noise is designed to be imperceptible to the legitimate user but devastating to an attacker's ability to learn a consistent decision boundary. The perturbation is a secret, non-linear function known only to the defender, making it impossible for the attacker to reverse-engineer the original, clean input-output mapping.

The primary goal is to poison the attacker's surrogate model during its training phase. As the attacker queries the API to build a labeled dataset, the fuzzed inputs create a systematic mismatch between the input and the true model's output. This results in a stolen model with significantly degraded accuracy, high variance, and poor generalization, rendering it commercially worthless and protecting the intellectual property of the original model.

Query fuzzing effectively hardens the decision boundary from an attacker's perspective. By subtly shifting inputs, the defense makes the boundary appear noisy, complex, and inconsistent. This prevents the attacker from using query-efficient strategies like active learning or gradient estimation to precisely map the boundary. The surrogate model learns a distorted, low-fidelity approximation of the true function.

A critical design constraint is that the fuzzing must be transparent to legitimate users. The perturbation magnitude is bounded by a strict fidelity budget to ensure the model's prediction for the fuzzed input is identical to the prediction for the original input. This maintains 100% utility for genuine API consumers while maximizing the degradation for extraction attempts, creating an asymmetric defense.

Unlike output perturbation, which adds noise to predictions, query fuzzing operates on the input space. Output perturbation only obscures confidence scores, while query fuzzing corrupts the fundamental relationship between an input and its label. This makes it a more robust defense against attacks that only use hard labels, as the label itself is derived from a deliberately shifted input point.

Query fuzzing is often deployed as part of a layered defense strategy. A monitoring system performs query pattern analysis to detect automated, systematic querying indicative of extraction. Once a session is flagged as high-risk, the fuzzing intensity can be dynamically increased. This adaptive approach conserves the fidelity budget for trusted users while aggressively poisoning the datasets of identified attackers.