Attack-Informed Model Extraction: A Systematic Study of API-Based Model Stealing Techniques

API Information Leakage and Adversarial Amplification Every API query leaks information. We ran nine experiments to measure exactly how much and found that adversarial prompts dramatically amplify the threat. Testing three open-weight models (Phi-3 Mini, Llama-2 7B, Llama-2 13B) through a minimal HTTP API with deterministic decoding, we discovered that attack-informed prompting—including role framing, hypothetical pretexts, and instruction-override attempts—increased architectural disclosure rates by +21 to +43 percentage points over baseline queries. This represents a 53–213% relative improvement for attackers. Mechanistic Insights A disambiguation experiment revealed that these disclosures mostly reflect memorized public specifications rather than runtime introspection. When we secretly modified deployment configs (context window, system template, RoPE scaling), models still reported the public spec 89–94% of the time. Attackers obtain accurate architectural intelligence, though not through the mechanism they might assume. Optimized Attack Strategies We also optimized boundary probing through monotone request intensity parameterization, enabling binary search and cutting queries from 50 to approximately 6 per boundary—an 88% reduction while improving precision. For distillation attacks, attack-shaped prompts boosted fidelity by approximately 16 points and reduced queries to 80% fidelity by approximately 54%. Implications Volume-only rate limits will not stop these attacks. Defenders need controls that analyze semantic intent and shape outputs accordingly.