Extract AI Model
Sub-technique of AML.T0024 Exfiltration via AI Inference API
Description
Adversaries may extract a functional copy of a private model.
By repeatedly querying the victim's AI Model Inference API Access, the adversary can collect the target model's inferences into a dataset.
The inferences are used as labels for training a separate model offline that will mimic the behavior and performance of the target model.
Adversaries may extract the model to avoid paying per query in an artificial-intelligence-as-a-service (AIaaS) setting.
Model extraction is used for AI Intellectual Property Theft.
- ATLAS ID
- AML.T0024.002
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Predictive AIGenerative AIAgentic AI
Mitigations
- AML.M0002Predictive AI Output Obfuscation
Suggested approaches:
- Restrict the number of results shown
- Limit specificity of output class ontology
- Use randomized smoothing techniques
- Reduce the precision of numerical outputs
- AML.M0004Limit AI Service Query Volume and Rate
Limit the volume of API queries in a given period of time to regulate the amount and fidelity of potentially sensitive information an attacker can learn.
- AML.M0024AI Telemetry Logging
Telemetry logging can help identify if sensitive data has been exfiltrated.
- AML.M0035AI Red Team
Simulate functional model extraction through inference queries. Establish appropriate authentication, rate limits, output restrictions, anomaly detection, and extraction monitoring.