The Limits of Query Monitoring against Distributed Model Extraction
Study finds query-only monitors detect some distributed model-extraction campaigns but miss slow, low-share, or relayed ones.
The paper studies what model providers can infer from queries alone when distillation campaigns are split across thousands of unlinkable accounts. Using one million real chat turns and 17 held-out weeks, a calibrated monitor caught naive distributed extraction in 0.86 to 1.00 of weeks, and a co-movement variant still caught campaigns padded with natural text in 0.50 to 0.96 of weeks. Campaigns that evaded every detector retained at most 42 percent of a detectable campaign's capability in the testbed. Slow ramp-ups poison calibration, benign evaluation pipelines resemble distillation, no deployable detector worked at colluder shares of 2.5 percent or below, and relays of real user requests may be invisible.
- Detection depends on being more distinctive than ordinary user groups.
- Calibrated monitor caught naive extraction in 0.86-1.00 of weeks.
- Evasive campaigns kept at most 42% of detectable capability.
- No deployable detector at colluder shares of 2.5% or below.
- Relayed real-user requests may evade query-only monitoring.
From the original article
1 min read at arxiv.orgModel providers now face distillation campaigns run through thousands of accounts, each of which looks like an ordinary user. When network and payment metadata cannot link those accounts, the only evidence left is what they ask.
By Snigdha Chandan Khilar · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.