Model extraction

How does model extraction work?

Model extraction starts with access to a model through an API. The attacker sends carefully chosen inputs and records what comes back. With enough outputs, they can reproduce part of the model’s behaviour or build a stand-in, often called a shadow model.

The OWASP GenAI project covers this in its entry on Unbounded Consumption. It lists two routes. One uses direct queries to extract behaviour. The other, functional replication, uses the target model to produce training data and fine-tunes another model on it. The second route is what the glossary calls a distillation attack.

Why does model extraction matter for a small business?

If your business sells an AI feature, the model behind it is part of what customers pay for. Extraction lets a competitor copy that value through your own public API, at your expense.

OWASP suggests rate limits, per-user quotas, usage monitoring and limiting detailed outputs such as logprobs. The practical steps are in what is a distillation attack and how to spot and limit distillation on your own AI API.