Append-only. Newest entries at the bottom.
2026-07-28 — Initial ingest
Sources ingested: raw/Model-theft/ — 5 files, ~7,300 words, added by the user on 2026-07-28. All read in full.
| Source | Words |
|---|---|
| Stealing AI Models Through the API (Praetorian, 2026-01-23) | 1,725 |
| Thwarting Model Theft (F5, 2023-12-14) | 1,774 |
| Model Theft in AI: How IP and Models Get Stolen (LayerX, 2025-10-21) | 1,770 |
| Understanding AI Model Theft (Snyk, 2025-08-18) | 1,323 |
| Model Theft: The Essential Guide (Nightfall) | 717 |
Pages created (5): index.md, log.md, model-theft.md, model-extraction.md, model-theft-defenses.md
Findings recorded:
- “Behavior is the model.” Praetorian’s central claim: keeping weights private is insufficient because every query-response pair is a training example for a replica.
- Worked attack: 1,000 queries → replica with 80.8% agreement with the victim, using a deliberately different architecture. A separate real-target run used only 100 queries.
- Replicas inherit the victim’s failure modes — confusion matrices match — which makes a stolen model a white-box oracle for attacking the original. This connects directly to PITAX T09, which needs white-box access or thousands of queries; extraction supplies the former.
- Soft probability outputs are the leak. Confidence scores reveal inter-class relationships; truncation to top-k or hard labels is the highest-leverage control and degrades the product.
- Snyk’s sophistication/detectability table puts supply chain in the worst quadrant — low resources, very high detection difficulty.
- Rate limiting is the convergent control across four independent vault sources (Praetorian, PITAX T09, PITAX T41, Code of Practice Appendix 4.3).
Source quality noted on the index page: all five are vendor or consultancy content. Only Praetorian contains original technical work. Nightfall’s article duplicates its own section text verbatim between “Types” and “Strategies” headings — noted rather than treated as two distinct claims.
Coverage gap noted: the worked extraction targets a CNN image classifier. No source covers extraction against LLMs specifically, where the economics differ substantially. Recorded on the index page.
Cross-links added to ai-attack-techniques-wiki/weight-level-attacks.md (which previously said this source folder was empty), ai-regulations-wiki/article-15-cybersecurity.md, mitre-atlas-wiki/*.
Root index updated: yes.
Open items:
raw/Supply-chain-attacks/andraw/OWASP-Top-10-for-LLMs/remain empty; both are cited here.- No primary research on LLM extraction economics.