Model Extraction Attacks

Ask about this topic

Overview

Model extraction attacks aim to reproduce a model’s predictions or recover its architecture, parameters, reasoning traces, or retrieval data. Common approaches use adaptive black-box queries and distillation, while side-channel methods exploit timing, GPU activity, or physical hardware leakage; targets range from classifiers and graph neural networks to language models and retrieval systems. Defenses include query monitoring, output perturbation, input-sensitive responses, and watermarks or fingerprints, with benchmarks testing both extraction success and whether ownership signals survive copying. A central tension is that stronger protections can reduce legitimate utility, while adaptive or distributed attackers may evade detection; high output agreement also does not guarantee that a stolen model behaves equivalently in other settings.

Latest papers

CardsList

47 papers8 papers in the last four weeks, up 167% on the four weeks before. 0.0% of all new papers.

  1. Preventing Model Extraction in Contextual Linear Optimization

    Oct 21, 2026Adam N. Elmachtoub, Tianyi Lin, Wenxuan LiuModel Extraction AttacksPredict-Then-Optimize

    Columbia University

  2. BiShield-TEE: On the (In-)Security of Unilateral Weight Obfuscation in On-Device TEE-Shielded LLM Partition

    Oct 15, 2026Zhiyuan Wang, Yuezhi Zhou, Ziqi Zhang +3LLM SecurityOn-Device Language Model Inference

    Department of Computer Science and Technology, Beijing National Research Center for Information Science and Technology, Tsinghua University, Beijing, China · Zhongguancun Laboratory, Beijing, China · University of Illinois Urbana-Champaign, IL, USA

  3. The Limits of Query Monitoring against Distributed Model Extraction

    Oct 9, 2026Snigdha Chandan KhilarModel Extraction Attacks

    Independent Researcher

  4. Reward Stealing Attack on Large Language Models

    Oct 5, 2026Jiaming Qian, Pengyang Zhou, Jiahe Xu +1LLM AlignmentModel Extraction Attacks

    Zhejiang University

  5. Hidden Risks of Jev: An Empirical Study of Security, Privacy, and Dual Use

    Oct 4, 2026Shang Wang, Tianqing Zhu, Huajie Chen +3LLM Backdoor AttacksModel Extraction Attacks

    School of Computer Science, University of Technology Sydney, Sydney, Australia · Faculty of Data Science, City University of Macau, Macau, China

  6. Guess My Weight: Profiled Side-Channel Recovery of Floating-Point Neural-Network Weights

    Oct 3, 2026Timon Lumír Fillo, Ján Mikulec, Anubhab Baksi +2Model Extraction Attacks

    Slovak University of Technology, Bratislava, Slovakia · Indian Institute of Technology Bhilai, India · TTControl GmbH, Vienna, Austria

  7. Walking the Embedding Space: Datastore Extraction from Multimodal RAG

    Oct 1, 2026Maria Carmen Jica, Ali Satvaty, Suzan Verberne +1Multimodal RAGAdversarial Attacks on VLMs

    University of Groningen Groningen, The Netherlands

  8. Dagger: Decoupling-based Model Stealing Attack against Graph Neural Networks

    Sep 29, 2026Ying Song, Xiaowei Jia, Balaji PalanisamyGraph Neural NetworksModel Extraction Attacks

    University of Pittsburgh · Rutgers University

  9. End-to-End Hard-Label Cryptanalytic Model Extraction Using Efficient Sign Recovery

    Sep 18, 2026Akira Ito, Takayuki Miura, Yosuke TodoModel Extraction AttacksReLU Neural Networks

    Tohoku University 2–1–1 Katahira, Aoba-ku, Sendai-shi, 980-8577, Japan · NTT Social Informatics Laboratories, 3–9–11 Midori-cho, Musashino-shi, Tokyo, 180-8585, Japan

  10. Information Design Against Gaming and Learning Adversaries

    Sep 12, 2026Madhava GaikwadInformation DesignStrategic Classification

    Independent Researcher, Bengaluru, India

  11. SoK: Privacy Attacks on Machine Learning via Explainable AI

    Sep 9, 2026Abdullah Caglar Oksuz, Anisa Halimi, Erman AydayModel Extraction AttacksModel Inversion Attacks

    Case Western Reserve University · IBM Research

  12. JudgeStealer: Extracting LLM Judging Capabilities across Evaluation Protocols

    Aug 27, 2026Chen Chen, Yaolin Chen, Xuehan Sun +5Model Extraction AttacksLLM-as-a-Judge

    Nanyang Technological University · Wuhan University

  13. Daydreaming: Stealing Hidden Agent Skills through Black-Box Task Interaction

    Aug 27, 2026Yu-Lin Tsai, Yu-An Lu, Ci-Yang Tsai +3LLM Agent SecurityModel Extraction Attacks

    National Yang Ming Chiao Tung University

  14. LLMscope: Extracting LLM Assets from Edge AI Chips via Optical Probing

    Aug 26, 2026Dev Mehta, Lily Dukette, William Folan +4LLM SecurityModel Extraction Attacks

    Worcester Polytechnic Institute

  15. EchoCoT: Extracting Hidden Chain-of-Thought from Large Reasoning Models

    Aug 20, 2026Yiting Qu, Ziqing Yang, Chi Cui +3LLM SecurityModel Extraction Attacks

    CISPA Helmholtz Center for Information Security

  16. Defending against Model Extraction for GNNs with Model Reprogramming

    Aug 11, 2026Yan Wen, Zhenyi Wang, Heng HuangGraph Neural NetworksModel Extraction Attacks

    University of Maryland, College Park Department of Computer Science College Park, MD, USA · University of Central Florida Department of Computer Science and Institute of Artificial Intelligence Orlando, FL, USA

  17. Stealing Reasoning Traces from Proprietary LLM APIs

    Aug 10, 2026Alexander Panfilov, David Schmotz, Ilia Shumailov +5Model Extraction AttacksAdversarial Attacks

    MATS Research · ELLIS Institute Tübingen · Max Planck Institute for Intelligent Systems +4

  18. MaxModShift: Model Privacy via Designed Shifts

    Aug 10, 2026Nomaan A. Kherani, Urbashi MitraModel Extraction AttacksPrivacy-Preserving ML

    University of Southern California

  19. Cryptanalytic Extraction of Isolated Bias-Free GLU Feed-Forward Blocks by Antipodal Separation

    Aug 6, 2026Chunhui Shi, Xinwen FuTransformer FFNsModel Extraction Attacks

  20. Gecko: Fast Private Inference via Secure Public Encoder Offloading

    Aug 3, 2026Cheng'an Wei, Kai Chen, Yue Zhao +2Efficient Neural Network InferenceModel Extraction Attacks

    Institute of Information Engineering, Chinese Academy of Sciences, China, and the School of Cyber Security, University of Chinese Academy of Sciences, China

  21. Caliber: Cross-Architecture Extraction-Cost Control for Score-Returning APIs

    Aug 2, 2026Chi Wang, Hanwen Wang, Yu Xia +2Model Extraction Attacks

    University of Queensland, Brisbane, Australia · Adelaide University, Adelaide, Australia · Beijing Technology and Business University, Beijing, China +1

  22. Leaky Language Models: Stealing Architecture and Inference Optimizations via Per-Token Timing

    Jul 22, 2026Sadegh Majidi, Niloofar Mireshghallah, Kazem TaramModel Extraction AttacksLanguage Model Fingerprinting

    Purdue University West Lafayette, IN, USA · Carnegie Mellon University Pittsburgh, PA, USA

  23. Black-Box Inference of LLM Architectural Properties with Restrictive API Access

    Jul 1, 2026Christopher Ellis, Shreyas Chaudhari, Mei-Yu Wang +3Model Extraction AttacksLLM Security

    Carnegie Mellon University Pittsburgh, PA 15213 · Pittsburgh Supercomputing Center

  24. Steal the Patch Size: Adversarially Manipulate Vision-Language Models

    Jun 30, 2026Kai Hu, Akash Bharadwaj, Weichen Yu +1Adversarial Attacks on VLMsModel Extraction Attacks

    Carnegie Mellon University, Pittsburgh, USA.

  25. RECAST: Model Reconstruction via Counterfactual-Aware Wasserstein Geometry under Limited Data

    Jun 26, 2026Xuan Zhao, Lena Krieger, Zhuo Cao +3Surrogate ModelingModel Extraction Attacks

    IAS-8, Forschungszentrum Jülich, Germany · LMU Munich, Munich Center for Machine Learning (MCML), Germany · Department of Computer Science, Aarhus University, Denmark

  26. What Does It Mean to Break a Distillation Defense?

    Jun 23, 2026Lena Libon, Pura Peetathawatchai, Michael Aerni +2Model Extraction AttacksLLM Security

    ETH Zurich

  27. Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot

    Jun 14, 2026Yuyang Dai, Yushun DongModel Extraction AttacksLLM Security

    Florida State University

  28. Model Stealing Through the Lens of Model Multiplicity

    Jun 13, 2026Eliott Baltz, Satoshi Hara, Ulrich AïvodjiSurrogate ModelingModel Extraction Attacks

    §ÉTS, Mila : Montréal · ‡The University of Electro-Communications : Tokyo

  29. T2S: A Rehearsal-Based Approach for Extraction-Resistant Model Watermarking

    Jun 10, 2026Jian-Ping Mei, Weibin Zhang, Ao Yao +2Watermark RemovalModel Extraction Attacks

    College of Computer Science and Technology, Zhejiang University of Technology, Hangzhou, 310023 China

  30. The Geometry of Last-Layer Model Stealing

    Jun 5, 2026Snigdha Chandan KhilarParameter IdentifiabilityModel Extraction Attacks

    Independent Researcher.