🎯MITRE ATLAS AML.T0025Rule: ATLAS-EXF-002high

Model Extraction

Description

Attacker reconstructs a functional copy of the model through query-and-response. Sufficient queries enable training a substitute model with comparable accuracy.

⚠️ Risk Impact

Model extraction is feasible against any API-exposed model. The cost to the attacker is the API call cost; the cost to the defender is loss of the model's competitive moat.

🔍 How EchelonGraph Detects This

ATLAS-EXF-002Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.

🔧 Remediation

Rate-limit and authenticate API calls. Monitor for high-volume systematic queries. Add output noise (prediction-only, no logits). Detect substitute-model training patterns.

💀 Real-World Attack Scenario

Tramèr et al. (2016) demonstrated extraction of BigML and Amazon ML cloud-hosted models with high fidelity using only the prediction API. The extraction cost in API calls was a small fraction of the model's training cost — making it economically attractive for adversaries.

💰 Cost of Non-Compliance

Model extraction = IP loss = avg $1.2M-$4M per case (Wiz AI Threat Report 2024). Hardest to detect; often discovered only when the substitute model surfaces on a competitor's product.

📋 Audit Questions

  • 1.What is the rate limit per API key?
  • 2.What monitoring exists for high-volume systematic queries?
  • 3.Do you expose logits or prediction-only?
  • 4.Has any extraction-pattern alert fired in the last 12 months?

🎯 MITRE ATT&CK Mapping

MITRE_ATLAS-AML.T0025

🏗️ Infrastructure as Code Fix

main.tf
resource "cloudflare_rate_limit" "ai_inference" {
  zone_id = var.zone_id
  threshold = 1000  # requests per period
  period    = 3600  # 1 hour
  match {
    request { url_pattern = "api.example.com/v1/predict" }
  }
  action { mode = "challenge" }
}

⚡ Common Pitfalls

  • ⛔No per-principal rate limit
  • ⛔Exposing full logits (faster extraction)
  • ⛔No detection of query distribution patterns that signal extraction

📈 Business Value

Model-extraction defence preserves the IP value of the trained model — the asset that typically required millions in training infrastructure.

⏱️ Effort Estimate

Manual

2-3 weeks for rate-limit + pattern monitoring

With EchelonGraph

EchelonGraph monitors query patterns; alerts on extraction signatures

🔗 Cross-Framework References

EUAIA-ART15-CYBERSECAML.T0040

Automate MITRE ATLAS AML.T0025 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →