How to Prevent Model Extraction Attacks | Quiz

[WHY] The article explicitly lists high risk as: public API with generous limits – high-value proprietary model – and no query monitoring. [CONTEXT] The example given is a custom medical diagnostic LLM with open API access. [REMEMBER] Public plus generous limits plus high value plus no monitoring equals high risk.

[WHY] Attackers can start from the same open-source foundation and focus extraction efforts specifically on stealing your fine-tuned layers or adapters – the part representing your unique investment. [CONTEXT] This partial access attack is particularly concerning because it reduces the extraction effort required. [REMEMBER] Fine-tuned layers are the extraction target.

[WHY] Source code secrecy is irrelevant because extraction works through API behavior – not code access. Attackers only need API responses to various inputs. [CONTEXT] This is explicitly listed as a common misconception in the article. [REMEMBER] Extraction needs API responses – not source code.

[WHY] Watermarks provide legal and forensic evidence if you discover a competitor using an extracted version of your model. [CONTEXT] If their model reproduces your watermark patterns – you have concrete proof of theft essential for legal proceedings. [REMEMBER] Watermarks prove ownership for legal action.

[WHY] Model watermarking must be integrated during the training process – not added at deployment. [CONTEXT] The data science team must incorporate watermarking techniques before the model is finalized for production. [REMEMBER] Watermark during training – not after.

[WHY] Rounding confidence scores destroys the precision attackers need for high-fidelity extraction while having minimal impact on legitimate users. [CONTEXT] This is listed as a quick win – if your API returns 0.847392 – return 0.85 instead. [REMEMBER] Less precision equals less useful extraction data.

[WHY] Extraction attacks are designed to look like normal API usage – attackers spread queries across multiple accounts – use realistic timing patterns – and stay under rate limits. [CONTEXT] Many attacks require no stolen credentials and operate entirely within allowed usage parameters. [REMEMBER] Extraction looks like normal traffic.