Sequential Query Detection

Examines the inter-query timing and cadence of API requests. Extraction attacks often exhibit machine-like regularity—consistent millisecond-level delays or burst patterns—unlike the stochastic pauses of human interaction.

• Detects periodic query intervals characteristic of automated scripts
• Flags burst-and-pause patterns used to evade simple rate limiters
• Compares timing distributions against human behavioral baselines
• Example: A client issuing queries every 50ms ± 2ms variance is statistically non-human

Identifies how consecutive queries navigate the input space. Extraction attacks systematically grid-scan or boundary-walk the feature space to map decision regions, creating geometrically correlated sequences.

• Detects linear sweeps across input dimensions
• Flags spiral or grid patterns designed to sample the entire manifold
• Measures input vector distance between consecutive queries
• Legitimate users exhibit random jumps; attackers show small, deliberate steps

Tracks the sequence of prediction entropy values across a session. Extraction algorithms deliberately seek high-entropy boundary regions where the model is uncertain, creating a distinctive entropy signature.

• Boundary-probing queries produce high prediction entropy
• A sustained sequence of high-entropy queries indicates decision surface mapping
• Contrasts with legitimate traffic that clusters in low-entropy confident regions
• Triggers when entropy trajectory matches surrogate training patterns

Builds a behavioral profile of each client session by combining timing, input patterns, and query semantics. This enables linking anonymous sessions and detecting coordinated extraction campaigns across multiple accounts or IP addresses.

• Correlates device fingerprints with query behavior
• Identifies distributed extraction where attackers rotate credentials
• Maintains stateful session context beyond simple token tracking
• Example: Five different API keys exhibiting identical grid-scan patterns are linked to a single extraction campaign

Employs dynamic anomaly detection that adjusts sensitivity based on evolving traffic patterns and attack sophistication. Static rules are easily reverse-engineered; adaptive systems learn the current normal and flag deviations.

• Uses streaming anomaly detection on query sequences
• Adjusts baselines for time-of-day and application-specific usage patterns
• Incorporates feedback loops from confirmed incidents
• Prevents attackers from calibrating their extraction rate to fixed thresholds

Quantifies the cumulative information leakage of a query sequence using mutual information metrics. Each query reveals a certain amount about the decision boundary; when the total exceeds a threshold, the session is terminated.

• Calculates information gain per query relative to prior queries
• Enforces a per-session information budget
• Models the diminishing returns of repeated queries in the same region
• Directly addresses the fundamental goal of extraction: maximizing boundary information

The foundational sibling to sequential detection, this technique monitors API query sequences to identify the systematic, non-random access patterns indicative of an ongoing model extraction attack. While sequential detection focuses on temporal correlation, pattern analysis evaluates the spatial structure of queries to detect grid searches, boundary tracing, or random-walk exploration strategies used to map the input space.

A defensive mechanism that blocks or flags queries where the model's prediction entropy is high. Attackers performing extraction deliberately probe the decision boundary where the model is most uncertain, as these queries reveal the most information about the model's internal logic. By monitoring the Shannon entropy of output probability distributions, systems can identify and reject these high-value boundary-probing queries before they contribute to a surrogate model.

Building a unique profile of a client's querying behavior and device characteristics to link anonymous sessions and detect coordinated extraction campaigns. This technique goes beyond simple IP tracking to analyze browser fingerprints, TLS handshake parameters, and query timing signatures. When combined with sequential detection, it enables the correlation of slow, distributed extraction attempts that span multiple sessions or IP addresses.

Artificially adding a variable time delay to API responses disrupts the timing-based analysis used in some side-channel extraction attacks. By randomizing response latency, defenders can obscure the computational cost of different query types, preventing attackers from inferring model architecture or decision boundary complexity through precise timing measurements. This technique is particularly effective when combined with sequential detection to identify timing-sensitive query bursts.

A decoy model deployed specifically to attract and study attackers. When sequential query detection identifies a high-confidence extraction attempt, traffic can be silently redirected to the honeypot, which returns deliberately distorted predictions. This allows security teams to:

• Study extraction tooling and methodologies
• Poison the attacker's surrogate model with misleading data
• Trigger alerts without exposing the production model's true decision boundary

The process of identifying unauthorized copies of a model by comparing their behavior on a set of proprietary trigger inputs to the original model's behavior. This post-breach detection technique uses carefully crafted canary queries that produce unique, verifiable outputs. If a suspected stolen model responds identically to these triggers, it provides forensic evidence of extraction, complementing the real-time prevention focus of sequential query detection.