How to spot and limit distillation on your own AI API

What does distillation look like in your API logs?

Distillation looks like unusually large, broad and repetitive traffic, often spread across several accounts. The OWASP GenAI project describes the method: an attacker sends crafted inputs, collects the outputs, and uses them to replicate part of the model or train a shadow model.

When Anthropic described the campaigns it found, it listed these signals:

• Synchronised traffic across multiple accounts.
• Shared payment methods between accounts.
• Coordinated timing of requests.
• Distillation traffic mixed in with normal requests, which makes any single account look ordinary.

Anthropic also reports using behavioural fingerprinting and classifiers, including detection of prompts that try to draw out a model’s step-by-step reasoning. These details come from its report on distillation attacks. A smaller business will not have the same tooling, but the same signals show up in ordinary logs if you record them.

Which limits slow distillation down?

Rate limits, per-key quotas and size limits raise the cost and time of copying your model. OWASP recommends caps on how many requests one source can make in a set period, per-user quotas, timeouts for heavy operations and sensible input size limits.

Control	What it does	Where it comes from
Rate limit per key	Caps requests or tokens per minute, so bulk collection takes longer	OWASP: rate limiting
Monthly quota per customer	Stops any single customer consuming a disproportionate share	OWASP: per-user quotas
Input size limits	Blocks oversized or bulk-style requests	OWASP: input validation
Hide fine-grained outputs	Removing logprobs and logit_bias leaves extractors less to work with	OWASP: model extraction via API
Usage logging and anomaly alerts	Surfaces unusual consumption early	OWASP: monitoring and logging
Output watermarking	Helps show later that outputs were used without permission	OWASP: watermarking

Anthropic’s own platform applies the same idea in reverse. Its rate limits are set per organisation, with optional lower limits per workspace, so one project cannot consume everything. Copy that structure for your customers: one key per customer, with its own limits.

How should you set up keys and accounts for customers?

Issue one key per customer, tie it to a verified identity, and make it revocable on its own. Shared keys hide who is doing the copying, and revoking one means cutting off everyone.

Steps to put in place:

1. Create a separate API key for each customer or integration.
2. Set a rate limit and a monthly quota on each key.
3. Pass an end-user identifier with each request if you build on a vendor’s API. OpenAI’s safety guidance says a unique, hashed identifier per user helps detect abuse and makes it less likely that a single misbehaving user gets your whole organisation cut off. It is a tracing tool, not a quota.
4. Require stronger checks before granting high-volume access. Anthropic reports tightening verification for education, security research and startup accounts, which it says are commonly exploited.
5. Keep payment details and sign-up information searchable, so you can link accounts that share them.

How do you monitor for distillation?

Record usage per key, then review for the patterns above. Log request counts, token volumes, the variety of prompts and the time of day for each key. OWASP advises tracking resource use continuously and using anomaly detection to flag unusual consumption.

Questions worth asking of the logs each week:

• Which keys sent the most requests, and does that match what the customer does?
• Do several keys share a payment method, an IP range or the same request timing?
• Did traffic jump soon after you released a new model? Anthropic reports that one campaign shifted nearly half its traffic within 24 hours of a new model release.
• Are many requests near-identical in structure, with only a small part changing?

Can terms of service help?

Yes, as a basis for cutting access and taking action. Anthropic’s Commercial Terms show the kind of clause to include: section D.4 bars using the service to build a competing product, including training competing AI models, and bars reverse engineering and copying the service. Ask a lawyer to adapt wording for your own contracts. A clause does not stop copying itself, but it lets you suspend an account without argument and gives you grounds to act.

What should you do when you spot it?

Suspend the key first, then keep the evidence. A suspended key stops the copying while you work out what happened, and you can reinstate it if the traffic turns out to be legitimate.

1. Suspend or revoke the key that sent the traffic.
2. Save the logs for that key and for any accounts that look linked to it.
3. Check whether the customer has a plausible explanation, such as a load test or a bulk job.
4. Apply a stricter quota before reinstating any account.
5. Review your contract wording with a lawyer if the copying was deliberate.

Anthropic says it also passes technical signs of these attacks to other AI labs, to cloud providers and to the authorities. If you build on a vendor’s model, tell the vendor what you saw.

What are the limits of these defences?

None of these controls stops a determined copier. OWASP notes that distillation uses the target model to generate training data, which sidesteps limits designed against query-based extraction. The aim is to make copying slower, costlier and easier to notice.

Read what a distillation attack is for the background. If your own keys with an AI vendor might be exposed, use the first-hour checklist for leaked AI API credentials.