Model theft

What it means

Model theft is the copying of a proprietary machine learning model that someone else built. It takes two main forms. One is stealing the model files, known as the weights, from storage or a build system. The other is model extraction, where an attacker queries your model many times and trains a copy on the answers.

The idea that makes it click: the model is an asset you paid to build, and a trained model does not need to be broken into to be copied. If your API returns good answers to anyone who asks, the answers are themselves a way to rebuild much of the value.

Why it matters

A model can hold months of work, private training data and a competitive edge. A stolen copy lets a rival skip that cost, or lets an attacker study the model offline to find weaknesses and plan inputs that fool it. Where training data included private information, a copy can leak parts of it.

There is also a running cost. Heavy querying to extract a model pays no fee if your API is free or loosely metered, and it can be expensive to serve. Earlier editions of the OWASP list of risks for large language model applications named model theft explicitly, and later editions cover extraction under unbounded consumption.

How it shows up

The file route runs through ordinary weaknesses: an exposed cloud storage bucket, a leaked credential in a repository, an over-broad role, or an insider. See S3 bucket exposure and hardcoded secrets. The query route runs through an API with no rate limiting and rich output, such as full probability scores.

Reduce the risk by locking down storage and build systems with least privilege, authenticating and limiting API use per account, returning only what clients need, and watching for patterns of systematic querying. Contract terms can forbid copying, but they do not stop it. Treat it as an application security problem first.