Model Extraction Attacks

Follow this topic Ask about this topic

Model extraction attacks aim to reproduce a model’s predictions or recover its architecture, parameters, reasoning traces, or retrieval data. Common approaches use adaptive black-box queries and distillation, while side-channel methods exploit timing, GPU activity, or physical hardware leakage; targets range from classifiers and graph neural networks to language models and retrieval systems. Defenses include query monitoring, output perturbation, input-sensitive responses, and watermarks or fingerprints, with benchmarks testing both extraction success and whether ownership signals survive copying. A central tension is that stronger protections can reduce legitimate utility, while adaptive or distributed attackers may evade detection; high output agreement also does not guarantee that a stolen model behaves equivalently in other settings.

Latest papers

47 papers8 papers in the last four weeks, up 167% on the four weeks before. 0.0% of all new papers.

An Embarrassingly Simple Detector for Model Extraction Attacks in Large Language Model API Traffic
Jun 4, 2026Shuze Liu, Qianwen Guo, Yushun DongModel Extraction Attacks LLM Security
Santa Clara University · Florida State University
Token Rankings are Unforgeable Language Model Signatures
Jun 3, 2026Matthew Finlayson, Andreas Grivas, Xiang Ren +1Model Extraction Attacks Language Model Fingerprinting
University of Southern California · University of Edinburgh
FlowGuard: Flow Matching for Identity-Independent Detection of Data-Free Model Stealing Attacks on Energy System Intrusion Detection Systems
Jun 2, 2026Maxime Schwarzer, Laurin Holz, Tobias Huerten +4Model Extraction Attacks Network Intrusion Detection
CortAIx Labs, Thales Deutschland / Karlsruhe Institute of Technology Germany · CortAIx Labs, Thales Deutschland Germany · Karlsruhe Institute of Technology Germany
AI Model Extraction Attacks: Bypassing Single-Client Assumptions in Defenses
Jun 2, 2026Maxime Schwarzer, Johannes F. Loevenich, Gustavo Sánchez +5Model Extraction Attacks
CortAIx Labs, Thales Deutschland, Ditzingen, Germany · Department of Mathematics/Computer Science, University of Osnabrück, Osnabrück, Germany · Institute for Automation and Applied Informatics (IAI), Karlsruhe Institute of Technology (KIT), Karlsruhe, Germany +2
Can Subgraph Explanations Be Weaponized to Steal Graph Neural Networks?
May 28, 2026Ojas Nimase, Jiate Li, Yue Zhao +1Graph Neural Networks Model Extraction Attacks
University of Southern California Los Angeles, USA · Florida State University Tallahassee, USA
GraphSteal: Structural Knowledge Stealing from Graph RAG via Traversal Reconstruction
May 27, 2026Jinze Gu, Qinghua Mao, Xi Lin +1Model Extraction Attacks Graph Retrieval-Augmented Generation
School of Computer Science, Shanghai Jiao Tong University
The Distillation Game: Adaptive Evaluations & Efficient Defenses
May 21, 2026Youssef Allouah, Mahdi Haghifam, Sanmi Koyejo +1Model Extraction Attacks Adversarial Attacks
Toyota Technological Institute at Chicago · National University of Singapore
Safeguarding Text-to-Image Generative Models Against Unauthorized Knowledge Distillation
May 21, 2026Yilan Gao, Sida Huang, Hongyuan Zhang +1Model Extraction Attacks T2I Generation
School of Artificial Intelligence, OPtics and ElectroNics (iOPEN), Northwestern Polytechnical University, Xi’an 710072, P. R. China · Institute of Artificial Intelligence (TeleAI), China Telecom, P. R. China · The University of Hong Kong
GraphIP-Bench: How Hard Is It to Steal a Graph Neural Network, and Can We Stop It?
May 12, 2026Kaixiang Zhao, Bolin Shen, Yuyang Dai +2Graph Neural Networks Model Extraction Attacks
University of Notre Dame · Florida State University · University of California, Berkeley
On the (In-)Security of the Shuffling Defense in the Transformer Secure Inference
May 6, 2026Zhengyi Li, Yakai Wang, Kang Yang +6Transformer Inference Model Extraction Attacks
Shanghai Jiao Tong University · State Key Laboratory of Cryptology · Shanghai Qizhi Institute
TrEEStealer: Stealing Decision Trees via Enclave Side Channels
Apr 20, 2026Jonas Sander, Anja Rabich, Nick Mahling +5Model Extraction Attacks Decision Tree Learning
University of Luebeck, Luebeck, Germany · Durham University, Durham, United Kingdom
Safety, Security, and Cognitive Risks in State-Space Models: A Systematic Threat Analysis with Spectral, Stateful, and Capacity Attacks
Apr 4, 2026Manoj ParmarState Space Models Adversarial Attacks
SovereignAI Security Labs, Bengaluru, India
Design and Development of an ML/DL Attack Resistance of RC-Based PUF for IoT Security
Mar 26, 2026Joy Acharya, Smit Patel, Paawan Sharma +1Internet of Things Model Extraction Attacks
Department of ICT, Pandit Deendayal Energy University Gandhinagar, Gujarat 382007, India
DistillGuard: Evaluating Defenses Against LLM Knowledge Distillation
Mar 8, 2026Bo JiangLanguage Model Distillation Model Extraction Attacks
CREDIT: Certified Ownership Verification of Deep Neural Networks Against Model Extraction Attacks
Feb 23, 2026Bolin Shen, Zhan Cheng, Neil Zhenqiang Gong +2Model Extraction Attacks Black-Box Model Auditing
Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States · Department of Computer Science, Duke University, Durham, North Carolina, United States +1
CITED: A Decision Boundary-Aware Signature for GNNs Towards Model Extraction Defense
Feb 23, 2026Bolin Shen, Md Shamim Seraj, Zhan Cheng +2Model Extraction Attacks Graph Neural Networks
Department of Computer Science, Florida State University, Tallahassee, Florida, United States · Department of Mathematics, University of Wisconsin, Madison, Wisconsin, United States
InferNet: Exploiting Aggregate GPU Profiles as Side-Channel for DNN Architecture Inference
Apr 6, 2023Raja Hasnain Anwar, Jonah O'Brien Weiss, Tiago Alves +1Model Extraction Attacks
University of Massachusetts Amherst, USA · Rio de Janeiro State University, Brazil

Jun 4, 2026J/K move · Enter open · S save

An Embarrassingly Simple Detector for Model Extraction Attacks in Large Language Model API Traffic

Shuze Liu, Qianwen Guo, Yushun Dong

Santa Clara University · Florida State University

Model Extraction Attacks LLM Security

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly deployed through hosted APIs, making model extraction a practical threat to model ownership and service security. However, individual extraction queries often resemble benign requests, and existing evaluations often focus on single-query anomaly scoring or pure benign-versus-attacker user settings. We formulate model extraction monitoring as benign-calibrated traffic-window distribution testing and show that an embarrassingly simple detector is effective: embed incoming queries into a semantic space and test whether their aggregate distribution deviates from historical benign traffic. We instantiate the detector with maximum mean discrepancy (MMD), using only benign-vs-benign comparisons to set the decision threshold. We evaluate on fourteen attacker-normal query pairs from four extraction scenarios and compare with adapted PRADA, SEAT, CAP, DATE, and marginal Mahalanobis baselines. Across three random seeds, MMD achieves 0.3% benign FPR, 100.0% pure-attacker TPR, 90.5% average TPR over attacker fractions, and 95.1% balanced accuracy. These results show that benign-calibrated distribution testing is a strong empirical baseline for model extraction detection in both user-level and mixed multi-user LLM API traffic. Code is released at: https://github.com/LabRAI/mmd-llm-mea-detection.