Model extraction: the attacker repeatedly queries the target model's public API and records each input-output pair. Those pairs become a training set for a local "clone" network that gradually imitates the target's decision boundary — no access to weights or architecture required, only the API. This is a real intellectual-property risk for hosted generative models.
- Rate limiting — capping requests per second slows how fast an attacker can accumulate query-response pairs.
- Query obfuscation — returning only the top answer instead of the full probability distribution starves the clone of the fine-grained signal it needs to converge quickly.
- Membership inference: the attacker submits a candidate record and studies the model's confidence on it. Models are typically more confident on examples they were trained on than on unseen ones, so a confidence gap can reveal whether that record was part of the private training set.
- Differential privacy — adding calibrated noise during training mathematically bounds how much any single training example can influence the model's output, shrinking that confidence gap regardless of how many queries the attacker sends.