Timing Analysis Exposes Distributed Model Extraction Campaigns

Summary

A new arXiv study shows that API distillation campaigns, which hide model-stealing traffic by splitting requests across thousands of load-balanced accounts, can be detected through request timestamps. Using a 20% seed set, the timing analysis ranks remaining accounts with 0.92–1.00 AUC within 20 minutes across real production accounts. Adaptive attackers using jitter struggle to hide, but pinning keys evades detection at the cost of throughput.

This is a reviewed summary. Read the complete article at the original source.

Why it matters by industry

• Technology

  This research provides a reproducible method for detecting distributed model extraction, directly relevant to cybersecurity and AI infrastructure protection.