Model Extraction

Model extraction seeks to reproduce aspects of a model's behavior or recover information about it through available access. Query responses can provide examples for building an approximation. This does not necessarily recover the original parameters or architecture.

Similar answers do not imply identical models

A fictional prediction API returns labels or scores. A party observing many responses may learn a substitute that behaves similarly on some inputs. Agreement on those inputs does not demonstrate identical behavior everywhere.

Directly stealing model files is a different access path. Inferring whether a record was used in training is also a distinct privacy question.

Define what is exposed

Consider query access, returned detail, usage patterns, and the value of the behavior being reproduced. Access controls and query limits can constrain opportunities but do not prove extraction impossible. Assess the specific service and evidence rather than equating every repeated query with an attack.

References

• NIST: Adversarial Machine Learning Overview