model extraction

Everything shipped on the phone belongs to the person holding it: the weights, the system prompt and any key the assistant uses. And the assistant now reads notifications, messages and screens written by strangers.

Review caller-controlled options by their actual information, resource and capability effects. Build a bounded product schema instead of forwarding arbitrary configuration.

The API is the attack surface and every response is a training example. Prevention is unrealistic; slowing, limiting and noticing are not.

A label is one bit of information per query. A probability vector is a map of the decision boundary, delivered on request.

Three attacks that all start with queries and end with something the owner did not intend to share. The scored answer separates them by what is stolen and maps each to its defence.

Define the asset and prohibited use before scoring traffic. Distinguish imitation, partial extraction and credential compromise, and test signals against legitimate workloads.