AI Model Theft via Inference Attacks: Reconstructing Models Without Touching the Weights
For executives
Model weights are not the only way to steal an AI model. An attacker who has API access to a deployed model can systematically query it, observe its outputs, and use those outputs to reconstruct a functionally equivalent copy of the model — without ever accessing the weights directly. This is model extraction via inference attack, and it requires no vulnerability, no code execution, and no access to GPU memory. It requires only the ability to make queries and observe responses.
The premise: models leak information about themselves
Every time a model generates an output, that output is shaped by its weights. The relationship between inputs and outputs encodes information about the model's learned parameters. Given enough input-output pairs, it is possible to train a second model to approximate the first.
Extraction via systematic querying
The simplest extraction approach queries the target model across a representative distribution of inputs and collects the outputs. Those input-output pairs form a training dataset. A substitute model trained on this dataset will approximate the target model's behaviour.
For models where outputs are probabilities, the substitute model can use those probabilities directly as training signal — soft labels that carry more information than hard class assignments. For language models, the technique is called "distillation via generation": the student model is trained to predict what the teacher model would generate.
The GPU infrastructure relevance
Model extraction attacks do not directly target GPU security — they target the inference API. But inference-time extraction can be accelerated by side-channel information available only from GPU-adjacent vantage points. Timing side-channels on GPU inference can reveal structural information about the model (number of layers, attention head counts, approximate parameter scale) that reduces the query budget needed for effective extraction.
An attacker on the same multi-tenant GPU infrastructure as the target model has access to timing information that an external API caller does not.