Model Extraction
Duplicating a Model's Functionality Through Queries
Description
Model extraction attacks replicate a deployed model’s functionality by systematically querying it to train a cloned or surrogate model. For example, without API rate limits, attackers can collect thousands of input-output pairs from a target LLM to build a dataset and train a copycat model at a fraction of the original cost. Stolen models can be used to duplicate behavior, create imitation products, mount adversarial attacks, or monetize the model’s intellectual property.
Additionally, stolen models may also serve as safe “training ranges” for attackers to identify vulnerabilities before targeting the original.
Difficulty Level — Low-Moderate
Without safeguards, such as access controls or query limits, these attacks are relatively easy to carry out. The difficulty increases for models with complex output spaces (e.g., control policies, multimodal embeddings), but extraction is still feasible with modern distillation and imitation-learning techniques.
Attack Consequence — High
Risks include loss of intellectual property, competitive advantage, revenue, exposure to adversarial attacks via the surrogate model, reputational harm, and even devaluation of an AI-based business, leading to challenges attracting talent or investment.