Surrogate Model Detection

A curated collection of adversarial or edge-case inputs known only to the model owner. These triggers are designed to elicit highly specific, often non-obvious outputs from the original model. A surrogate model, trained only on black-box queries, will fail to replicate these exact responses, acting as a digital trapwire.

• Watermarking Keys: Trigger inputs serve as a zero-bit watermark extraction key.
• Non-Transferable: The specific behavior on these triggers does not generalize from standard query data.

The process of constructing a unique behavioral signature for a model by observing its decision boundary across a defined input space. This goes beyond simple accuracy, measuring the exact confidence scores, ranking of incorrect classes, and error patterns. A stolen surrogate will exhibit a statistically distinct fingerprint due to architectural differences and training noise.

• Decision Boundary Mapping: Compares the topology of classification regions.
• Error Consistency: Analyzes if two models make the same mistakes on the same inputs.

A formal mathematical framework to determine if a suspect model is a copy. The null hypothesis states the suspect model is independently created. By comparing outputs on a hold-out trigger set, a statistical test (e.g., t-test, Kolmogorov-Smirnov test) measures the probability that the observed behavioral similarity occurred by chance.

• P-Value Calculation: Quantifies the confidence of the infringement verdict.
• False Positive Control: Rigorous testing is essential to avoid wrongful accusations in legal contexts.

A detection technique that compares the embedding space representations of a suspect model's outputs against a database of known original models. By feeding a standard corpus through both models and projecting the results into a high-dimensional vector space, the cosine similarity between the output vectors can reveal unauthorized distillation.

• Representation Similarity: Measures if two models encode information identically.
• Layer-wise Comparison: Can detect copying even if the final output layer is modified.

A logging and audit trail system that establishes a chain of custody for model access. By recording every API query and response with a cryptographic hash, an owner can later prove that a specific surrogate model was trained using a specific sequence of stolen queries. This transforms detection from a statistical guess into a deterministic proof.

• Immutable Audit Logs: Uses blockchain or append-only ledgers for non-repudiation.
• Training Data Lineage: Directly links a suspect model's weights to the victim's API logs.

A rigorous software testing methodology applied to machine learning models. It asserts that a suspect model is a copy if it is functionally equivalent to the original within a defined epsilon margin across the entire input domain, not just a test set. While computationally intensive, formal verification tools can prove equivalence for certain model architectures.

• Satisfiability Modulo Theories (SMT) Solvers: Used to formally verify neural network properties.
• Input Space Coverage: Aims for a mathematical guarantee, not just empirical sampling.

The foundational mechanism of surrogate model detection. A proprietary set of input-output pairs is embedded into the original model during training or fine-tuning. These trigger inputs are crafted to produce highly specific, often counter-intuitive outputs that act as a digital fingerprint. When a suspected surrogate model is queried with these secret triggers, its responses are compared to the expected outputs. A statistically significant match confirms unauthorized distillation. This technique relies on the surrogate model learning the trigger behavior as part of its approximation of the decision boundary.

A detection method that compares the geometric shape of the original model's decision boundary to that of a suspected copy. By systematically querying both models along paths in the input space, analysts can measure the adversarial direction alignment and curvature similarity. A surrogate model trained via extraction will exhibit a highly correlated, though not identical, decision surface. Key metrics include:

• Adversarial example transferability between the two models
• Gradient alignment on boundary-adjacent points
• Curvature similarity in high-dimensional space Significant overlap in these metrics provides strong evidence of model theft.

A passive detection technique that monitors API traffic to identify the systematic querying patterns characteristic of model extraction attacks. Surrogate model training requires exhaustive exploration of the input space, creating distinct signatures:

• Uniform grid sampling across input dimensions
• High entropy queries targeting decision boundaries
• Temporal regularity indicating automated scripts
• Lack of natural drift in query distribution By fingerprinting these patterns, security systems can flag potential extraction in progress before a surrogate is fully trained, enabling proactive countermeasures like rate limiting or decoy output injection.

A statistical framework for determining whether two models are functionally equivalent within a defined tolerance. The test involves:

• Defining a similarity metric, such as top-1 agreement rate or KL divergence of output distributions
• Sampling a large, diverse set of inputs from the operational distribution
• Computing the metric across both models
• Applying a hypothesis test to determine if the observed similarity exceeds what would be expected from independent models trained on similar tasks This approach distinguishes true copies from models that simply perform the same task, providing a legally defensible statistical basis for intellectual property claims.

A proactive deception strategy where a decoy model is deliberately exposed to potential attackers. This honeypot is instrumented with extensive telemetry and embedded with unique, trackable watermarks. Key characteristics include:

• Realistic but non-critical functionality to appear valuable
• Aggressive logging of all queries and extraction patterns
• Unique watermarks that persist through distillation
• Automated alerting when the watermark is detected in the wild When a stolen model surfaces, the honeypot's watermarks provide irrefutable proof of theft and attribution to the specific extraction campaign, enabling legal action and threat intelligence gathering.