Response Delay Injection

The core mechanism involves injecting non-deterministic latency drawn from a statistical distribution rather than a fixed delay. This prevents attackers from normalizing out a constant offset.

• Uniform random delays between 50-500ms mask true computation time
• Jittered responses obscure the relationship between input complexity and processing duration
• Adaptive delay scaling increases latency proportionally to query frequency

Without this variability, attackers can use precise timing measurements to infer model architecture depth, layer count, and even activation functions.

Response Delay Injection specifically targets timing side-channels where attackers measure microsecond-level differences in API response times to reverse-engineer model properties.

• Obscures layer depth inference by masking computational path length
• Disrupts branch prediction analysis used to map decision tree structures
• Prevents cache-hit timing attacks that reveal repeated computations
• Neutralizes early-exit detection in dynamic neural architectures

The defense converts a high-precision timing signal into noise, forcing attackers to require exponentially more queries for statistically significant measurements.

Effective deployment requires careful integration at the API gateway or middleware layer to avoid coupling with model serving logic.

• Pre-computation delay queues buffer requests before processing begins
• Post-computation hold timers add latency after inference completes
• Token-bucket hybrid approaches combine rate limiting with delay injection
• Per-session delay profiles assign unique timing signatures to authenticated clients

Implementation must balance security against Service Level Agreement (SLA) requirements, typically targeting sub-1000ms total latency for user-facing applications.

The primary goal is to increase the cost and time required for successful model extraction beyond the value of the stolen model.

• A 500ms average delay adds ~14 hours to a 100,000-query extraction campaign
• Combined with rate limiting, extraction timelines extend from days to weeks or months
• Variable delays force attackers to collect 3-5x more samples for statistical significance
• Increases cloud compute costs for attacker infrastructure

This economic calculus makes Response Delay Injection a deterrence-based defense rather than an absolute prevention mechanism.

Sophisticated attackers can partially mitigate delay injection through statistical normalization techniques.

• Median filtering across multiple identical queries reduces random jitter
• Clock synchronization attacks use Network Time Protocol (NTP) to isolate server-side delays
• Distributed querying from multiple geographic regions averages out per-session delay profiles
• Hardware-level timing via browser performance APIs can bypass application-layer delays

Response Delay Injection should be deployed as part of a defense-in-depth strategy alongside output perturbation and query pattern analysis.

Response Delay Injection works synergistically with Query Throttling to create a multi-layered timing defense.

• Throttling imposes hard rate caps while delay injection adds per-request noise
• Combined approach creates compound uncertainty in timing measurements
• Progressive delay escalation triggers when throttling thresholds are approached
• Enables graceful degradation rather than hard blocking, avoiding attacker adaptation

This pairing is particularly effective against low-and-slow extraction attacks that attempt to fly under rate limit thresholds by spacing queries over extended periods.