Query Throttling

Unlike static rate limiting which blocks requests, throttling progressively increases latency based on behavioral analysis. A client making 10 requests per second might experience 100ms latency, while one making 100 requests per second sees latency climb to 5 seconds. This graceful degradation frustrates automated extraction scripts without impacting legitimate users. The system monitors query frequency, input diversity, and temporal patterns to dynamically adjust the delay curve.

Model extraction requires hundreds of thousands of queries to train a viable surrogate model. Throttling transforms this from a time-bound operation into a cost-prohibitive one. If each query is delayed by 2 seconds, extracting a model with 1 million queries takes over 23 days of continuous wall-clock time. This asymmetric cost structure forces attackers to either abandon the attempt or invest in distributed infrastructure that increases their operational complexity and risk of detection.

Effective throttling relies on session fingerprinting to link requests across IP addresses and API keys. By building a behavioral profile of each client—including TLS handshake characteristics, HTTP header ordering, and query sequence entropy—the system can apply throttling policies even when attackers rotate credentials. This prevents attackers from bypassing throttling by simply creating new accounts or cycling through proxy pools.

Not all queries are equally valuable for extraction. Throttling systems can prioritize delaying high-entropy queries—those where the model is uncertain and the response reveals decision boundary information. By applying entropy thresholding, the system imposes longer delays on boundary-probing queries while serving confident predictions quickly. This targets the most information-rich queries that attackers depend on for efficient surrogate model training.

Beyond simple rate-based slowing, response delay injection introduces variable, unpredictable latency that disrupts timing-based side-channel analysis. Attackers often measure response times to infer model architecture or input processing complexity. By adding randomized jitter to response times—varying between 50ms and 500ms—the system masks the true computational profile of the model, degrading the quality of timing-based extraction techniques.

An advanced throttling variant requires clients to solve a cryptographic proof-of-work puzzle before receiving inference results. The puzzle difficulty scales with the client's risk score. A legitimate user with normal query patterns faces a trivial challenge solved in milliseconds, while a suspected extractor must expend significant CPU cycles. This client-side computational cost makes large-scale extraction economically unfeasible without specialized hardware acceleration.

A foundational defense that restricts the number of requests a client can make within a specific time window. Unlike throttling, which slows responses, rate limiting blocks requests outright after a threshold is reached. Common implementations include token bucket and leaky bucket algorithms. Effective against naive extraction scripts but can be circumvented by distributed botnets that rotate IP addresses.

The practice of hiding or rounding raw confidence probabilities returned by a model. Instead of exposing precise logits, the API returns only the final class label or truncated top-k predictions. This denies attackers the gradient-like information needed to efficiently train a surrogate model. Key techniques include:

• Returning only the top-1 prediction
• Rounding scores to coarse intervals
• Applying a temperature parameter to flatten distributions

A defense that requires a client to solve a computationally expensive cryptographic puzzle before serving an inference request. This increases the cost and time required for automated extraction without significantly impacting legitimate users making occasional queries. The difficulty can be dynamically adjusted based on session risk scores. Originates from cryptocurrency mining and anti-spam systems like Hashcash.

Monitoring API query sequences to detect the systematic, non-random access patterns indicative of model extraction. Unlike simple volumetric detection, this analyzes the semantic structure of queries. Attackers typically probe the input space methodically, generating queries that are spatially correlated to map decision boundaries. Machine learning classifiers trained on benign vs. malicious query sequences can trigger automated countermeasures.

The technique of adding statistical noise directly to model predictions to obscure the precise decision boundary. This is closely related to differential privacy but applied at inference time. The noise can be drawn from a Laplace or Gaussian distribution calibrated to the sensitivity of the model output. The trade-off: higher noise provides stronger protection but degrades utility for legitimate users.

A decoy model deployed alongside production systems to attract and study attackers. The honeypot returns deliberately plausible but incorrect predictions, wasting attacker resources and poisoning surrogate training data. Security teams analyze query patterns against the honeypot to understand extraction techniques and improve defenses. Alerts trigger when the honeypot is queried, providing early warning of an active attack campaign.