| name | model-theft |
| description | Detects inference endpoints without authentication or throttling, allowing model weight reconstruction. Use when writing inference API endpoints, deploying LLM-serving infrastructure, implementing model access controls, or configuring rate limiting and authentication for model endpoints. |
Model Theft (OWASP LLM10:2025)
What this checks
Prevents unauthorized replication of proprietary models through API abuse. Unauthenticated
or unthrottled inference endpoints let attackers systematically query a model to
reconstruct its weights or distill a clone — stealing the commercial and IP value
of the deployment.
Vulnerable patterns
- Inference endpoint has no authentication — any client can query freely
- Rate limiting applied per IP only, trivially bypassed with rotating proxies
- Response includes raw
logprobs or full embedding vectors, enabling extraction
- No monitoring for systematic/grid-search query patterns that signal extraction attempts
Fix immediately
Flag the vulnerable code and explain the risk. Then suggest a fix that establishes
these properties:
- Every inference endpoint requires authentication — API key, bearer token,
or mTLS. Unauthenticated endpoints are free training data for anyone who wants
to clone the model.
- Rate limits are keyed on the authenticated principal, not the IP. IP-only
throttles are defeated by rotating proxies and residential IP pools; a
per-user or per-key quota follows the attacker even as IPs churn.
- Extraction-signal fields are stripped from responses. Log-probabilities,
full embedding vectors, and per-token probabilities are the primary signals
distillation attacks use to reconstruct a model. If a caller does not strictly
need them, do not return them.
- Query patterns are monitored for extraction signatures — high-volume,
low-entropy, systematic grid-search probes. Alerts fire on anomalies; the
handler records user identity, timestamp, and prompt (or a content
fingerprint) for after-the-fact investigation.
Translate each principle to the serving framework, auth provider, and rate-limiter
of the audited file. Use the framework's documented authentication and throttling
middleware — do not roll your own.
Verification
References
