Model Extraction: How Someone Can Steal Your AI IP Just by Querying Your API

You don't need to break into your infrastructure to steal your model — it's enough to ask your API enough questions and record the answers. That's, in essence, a model extraction attack.

How an extraction attack works

In a model extraction attack, an adversary with query access to an ML model steals its underlying functionality by systematically querying it and using those responses to build a replica model that mimics the original's behavior. Attackers can replicate model behavior through systematic queries, steal specialized logic via distillation, or reconstruct sensitive information through inversion or abuse of a RAG system.

The real scale of the problem

Scraping — the primary vector for model extraction — reached a median rate close to 20% of global traffic in 2025-2026, practically doubling since 2022, with volumes growing 47% year over year and 138% since 2022. It isn't a marginal risk — it's a significant and growing fraction of all traffic hitting an exposed AI API.

Why traditional rate limiting no longer cuts it

Modern adversaries spread their queries across distributed IPs, compromised accounts, and usage windows that look normal, instead of triggering obvious rate limits from a single origin — the classic defense of "block IPs with too many queries per minute" is increasingly ineffective against an attacker who takes their time and spreads the load.

The specific case of reasoning traces

In May 2026, vulnerabilities were disclosed related to the possibility of exchanging reasoning traces between models — with providers confirming receipt of the reports but not yet acknowledging the full security implications. It's a relatively new vector: it's not just a model's final output that can be stolen, but potentially the "how it got there" in models that expose their chain of reasoning.

What to do if you expose your own model via API

Practical mitigations include limiting the granularity of information returned in each response (avoid exposing full probabilities or logits if unnecessary), monitoring anomalous query patterns at the account level rather than individual IP, and for truly high-value proprietary models, considering knowledge honeypots — trap responses designed to detect and identify whoever is systematically trying to extract the model.