ATK-018 Model integrity
Model Theft — Extraction via API
Applies to: LLM, Traditional ML, Computer Vision · Last reviewed 2026-05-01
Prerequisites
- Target model is exposed via an API permitting sufficient query volume.
- No anomaly detection on inference traffic patterns.
Test approach
With written authorization and within a documented query budget, the tester issues structured queries designed to enable training a surrogate model approximating the target's behavior. The tester reports the surrogate's similarity to the target as evidence of the attack's feasibility.
Expected evidence
- Query corpus used.
- Surrogate model evaluation report.
- Resource consumption metrics.
Detection signals
- Single source generating high-volume, structurally varied queries.
- Query patterns matching public extraction-attack corpora.
- Sudden increase in API spend per source.
Defensive recommendations
- Rate limit and pattern-detect on inference traffic.
- Apply output perturbation where consistent with use case.
- Restrict API access via authenticated keys with quotas and behavioral monitoring.
Framework mappings
- OWASP LLM Top 10: LLM10:2025
- MITRE ATLAS: AML.T0024
- NIST AI RMF: MEASURE-2.7
Related AI Controls Catalog entries
These controls provide the audit test procedures that validate defences against this attack pattern.