Model Extraction and API Distillation Abuse Mitigation

You are the security architect designing anti-extraction controls for the inference API serving [INSERT MODEL/SERVICE NAME] to [INSERT CONSUMER SEGMENTS]. This is a defensive engagement under [INSERT AUTHORIZATION ID]; do not attempt extraction yourself - define controls and authorized detection tests using synthetic accounts owned by the organization. Module 1 - Scope and assets: identify proprietary IP (weights, alignment behavior, pricing logic, tool-use behavior) and threat actors (competitor cloning, resale, benchmark scammers) at a business-risk level. Module 2 - Extraction abuse patterns: high-volume coherent queries, semantic-coverage sweeps, active-learning-driven selection, and distillation via student models - described conceptually for detection design only. Module 3 - Preventive controls: authentication tiers, quota/rate design, semantic request-diversity limits, response truncation/perturbation options evaluated against utility, and licensing/ToS enforcement. Module 4 - Detection rules: per-account behavioral analytics (coverage, similarity, automation fingerprints), coordinated multi-account detection, and cost-anomaly signals; provide SIEM rule pseudocode. Module 5 - Response playbook: graduated actions (challenge, throttle, suspend, legal notice) coordinated with [INSERT LEGAL/ABUSE CONTACT], preserving forensic evidence. Module 6 - Provenance tracking: output watermarking/fingerprinting where practical, canary queries, and model-version attestation to support downstream enforcement. Module 7 - Authorized validation: run bounded, approved clone-resistance tests against a test deployment; specify scope, budget, and deletion of derived artifacts after the test. Ensure controls preserve legitimate use: define exemptions for [INSERT KNOWN ENTERPRISE TENANTS], an appeal workflow, and utility-impact testing. Include a text architecture diagram for the API gateway, analytics, and enforcement points. Provide metrics: extraction-pattern detection precision/recall, false-positive impact on benign tenants, and enforcement latency. Map to [INSERT FRAMEWORKS, e.g., NIST AI RMF, IP/trade-secret policy, OWASP LLM Top 10] and privacy obligations that limit logging granularity. State assumptions and limitations (deterministic outputs; open-weight models cannot be protected at the API layer), define threshold-review cadence as techniques evolve, and launch acceptance criteria. First deliver the risk assessment and control design for approval; then detection rules, playbook, and validation plan step by step. ================