[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEFB5FG75ZF1YGA33NCFJ9":3,"skill-same:01M6AEFB5FG75ZF1YGA33NCFJ9":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AEFB5FG75ZF1YGA33NCFJ9","detecting-model-extraction-attacks",null,"Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume\u002Fdistribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability. Use for a public or partner inference API needing cloning\u002Finversion\u002Fmembership-inference detection, or a pre-deployment red-team exercise to measure extraction risk.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-model-extraction-attacks\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"detecting model extraction attacks","extraction","rate-limiting","mlsecops","query-monitoring","mitre-atlas","inference-api","model-inversion","membership-inference","model-extraction","security","detection","ai-security","red-team","monitoring","deployment","cybersecurity","inference","2026-11-10 10:12:30",false,"---\nname: detecting-model-extraction-attacks\ndescription: Detect MITRE ATLAS AML.T0024 attacks (model stealing, inversion, membership inference) performed via inference-API abuse, by monitoring per-principal query volume\u002Fdistribution, rate-limiting and perturbing outputs, and red-teaming your model's extractability. Use for a public or partner inference API needing cloning\u002Finversion\u002Fmembership-inference detection, or a pre-deployment red-team exercise to measure extraction risk.\ndomain: cybersecurity\nsubdomain: ai-security\ntags:\n- ai-security\n- model-extraction\n- membership-inference\n- model-inversion\n- inference-api\n- mitre-atlas\n- query-monitoring\n- mlsecops\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- MEASURE-2.6\natlas_techniques:\n- AML.T0024\n---\n# Detecting Model Extraction Attacks\n\n> **Authorized Use Only:** The extraction, inversion, and membership-inference techniques described here are intended for defenders testing their own models and for red teams operating under written authorization. Querying a third-party model to clone it, reconstruct its training data, or infer membership without permission may violate terms of service, copyright, and privacy law.\n\n## Overview\n\nModel extraction is the family of attacks in which an adversary abuses a model's **inference API** to steal value that the model owner intended to keep private. MITRE ATLAS catalogs these under **AML.T0024 — Exfiltration via AI Inference API**, in the *Exfiltration* tactic, with three sub-techniques:\n\n- **AML.T0024.000 — Infer Training Data Membership** (membership inference): the adversary determines whether a specific record was part of the training set, a privacy violation that can expose, for example, whether a patient's record trained a medical model.\n- **AML.T0024.001 — Invert AI Model** (model inversion): the adversary reconstructs representative training inputs (e.g., faces, text) by exploiting confidence scores returned by the API.\n- **AML.T0024.002 — Extract ML Model** (model stealing): the adversary repeatedly queries the victim model, collects (input, prediction) pairs, and trains a *surrogate* model offline that mimics the victim's decision boundary — avoiding the per-query cost of a Machine-Learning-as-a-Service offering and stealing the owner's intellectual property.\n\nAll three share a common signal: an attacker must send **many queries**, often crafted to probe the decision boundary (high-entropy, near-boundary, synthetic, or systematically grid-sampled inputs), and frequently requests **full confidence vectors \u002F logits** rather than just the top label. Detection therefore centers on per-principal query monitoring, input-distribution analysis, and confidence-exposure controls, while defense centers on rate limiting, output perturbation, and reducing the information returned per query. This skill follows the MITRE ATLAS technique definition for AML.T0024 (https:\u002F\u002Fatlas.mitre.org\u002Ftechniques\u002FAML.T0024) and the NIST AI RMF MEASURE function (MEASURE-2.6, security and resilience of the AI system).\n\n## When to Use\n\n- When you operate a model behind a public or partner inference API and need to detect cloning, inversion, or membership inference.\n- When performing a pre-deployment AI red-team exercise to measure how many queries are needed to extract your own model.\n- When validating that rate limiting, output perturbation, and confidence-suppression controls actually reduce extractability.\n- When investigating anomalous billing\u002Fusage spikes that may indicate surrogate-model harvesting.\n- When responding to a privacy incident where membership inference against a model is suspected.\n\n## Prerequisites\n\n- Python 3.9+ environment.\n- Access to inference-API access logs (per-API-key\u002Fper-principal query counts, timestamps, input features or hashes, returned confidence vectors).\n- For self-assessment red-teaming, install the Adversarial Robustness Toolbox (ART), the reference framework for extraction\u002Finference attacks and defenses:\n  ```bash\n  pip install adversarial-robustness-toolbox scikit-learn numpy\n  ```\n- Optional: access to the target model object (white\u002Fgrey-box) or only its API (black-box).\n- Authorization to test the target model.\n\n## Objectives\n\n- Instrument the inference API to record per-principal query volume, input diversity, and confidence-exposure.\n- Build a detector that scores principals for extraction-like behavior (volume, near-boundary sampling, full-vector requests).\n- Run an ART-based extraction attack against your own model to measure fidelity vs. query budget.\n- Run a membership-inference attack to quantify training-data leakage.\n- Apply and validate defenses: rate limiting, label-only responses, confidence rounding\u002Fperturbation, and prediction poisoning.\n\n## MITRE ATT&CK Mapping\n\n| ID | Name (MITRE ATLAS) | Tactic |\n|----|--------------------|--------|\n| AML.T0024 | Exfiltration via AI Inference API | Exfiltration |\n| AML.T0024.000 | Infer Training Data Membership | Exfiltration |\n| AML.T0024.001 | Invert AI Model | Exfiltration |\n| AML.T0024.002 | Extract ML Model | Exfiltration |\n\n## Workflow\n\n### 1. Instrument the inference API for detection signals\nCapture the fields a detector needs. Per request, log the principal (API key \u002F IP \u002F account), timestamp, an input fingerprint, and whether the caller requested probabilities\u002Flogits.\n\n```python\nimport hashlib, json, time\n\ndef log_inference(principal, features, returned_probs):\n    record = {\n        \"ts\": time.time(),\n        \"principal\": principal,\n        # hash inputs so logs don't store raw sensitive data\n        \"input_hash\": hashlib.sha256(json.dumps(features, sort_keys=True).encode()).hexdigest(),\n        \"wants_probs\": returned_probs,\n        \"n_features\": len(features),\n    }\n    with open(\"inference_audit.jsonl\", \"a\") as f:\n        f.write(json.dumps(record) + \"\\n\")\n```\n\n### 2. Detect extraction-like query patterns\nScore each principal on the three signals that distinguish extraction from normal use: high query volume in a window, high *unique-input* ratio (attackers rarely repeat), and a high rate of full-probability requests.\n\n```python\nimport collections, json\n\ndef score_principals(audit_path=\"inference_audit.jsonl\", window_qps_threshold=100):\n    by_principal = collections.defaultdict(lambda: {\"q\": 0, \"uniq\": set(), \"probs\": 0})\n    for line in open(audit_path):\n        r = json.loads(line)\n        p = by_principal[r[\"principal\"]]\n        p[\"q\"] += 1\n        p[\"uniq\"].add(r[\"input_hash\"])\n        p[\"probs\"] += int(r[\"wants_probs\"])\n    findings = []\n    for principal, p in by_principal.items():\n        uniq_ratio = len(p[\"uniq\"]) \u002F max(p[\"q\"], 1)\n        prob_ratio = p[\"probs\"] \u002F max(p[\"q\"], 1)\n        suspicious = p[\"q\"] > window_qps_threshold and uniq_ratio > 0.9 and prob_ratio > 0.8\n        findings.append({\"principal\": principal, \"queries\": p[\"q\"],\n                         \"unique_ratio\": round(uniq_ratio, 3),\n                         \"prob_request_ratio\": round(prob_ratio, 3),\n                         \"suspected_extraction\": suspicious})\n    return sorted(findings, key=lambda x: -x[\"queries\"])\n```\n\n### 3. Measure your model's extractability with ART (self red-team)\nUse ART's `CopycatCNN` (or `KnockoffNets`) to train a surrogate from black-box queries and report fidelity at a given query budget. Low query budget + high agreement = high risk.\n\n```python\nimport numpy as np\nfrom art.estimators.classification import SklearnClassifier\nfrom art.attacks.extraction import KnockoffNets\nfrom sklearn.ensemble import RandomForestClassifier\n\n# victim is your already-trained model wrapped for ART\nvictim = SklearnClassifier(model=trained_model)            # your production model\nthief_model = RandomForestClassifier(n_estimators=100)\nthief = SklearnClassifier(model=thief_model)\n\nattack = KnockoffNets(classifier=victim, batch_size_fit=64,\n                      batch_size_query=64, nb_epochs=10, nb_stolen=2000)\nstolen = attack.extract(x=x_pool, thief_classifier=thief)   # 2000-query budget\n\nagreement = np.mean(stolen.predict(x_test).argmax(1) == victim.predict(x_test).argmax(1))\nprint(f\"Surrogate fidelity (agreement with victim): {agreement:.2%} at 2000 queries\")\n```\n\n### 4. Quantify training-data leakage with membership inference\nRun ART's black-box membership-inference attack. An accuracy meaningfully above 50% indicates the model leaks membership (AML.T0024.000).\n\n```python\nfrom art.attacks.inference.membership_inference import MembershipInferenceBlackBox\n\nmia = MembershipInferenceBlackBox(victim, attack_model_type=\"rf\")\n# fit the attack on a labeled split of known members \u002F non-members\nmia.fit(x_train[:500], y_train[:500], x_test[:500], y_test[:500])\nmember_pred = mia.infer(x_train[500:1000], y_train[500:1000])\nnonmember_pred = mia.infer(x_test[500:1000], y_test[500:1000])\nacc = (member_pred.mean() + (1 - nonmember_pred.mean())) \u002F 2\nprint(f\"Membership-inference accuracy: {acc:.2%} (0.50 = no leakage)\")\n```\n\n### 5. Apply and validate defenses\nReduce the information returned and the query economics. Re-run steps 3 and 4 after each control to confirm extractability drops.\n\n```python\n# (a) Label-only responses: never return full probability vectors to untrusted callers.\ndef respond(probs, trusted):\n    return int(probs.argmax()) if not trusted else probs.tolist()\n\n# (b) Confidence rounding \u002F output perturbation (raises queries needed for inversion):\ndef perturb(probs, decimals=2, noise=0.01):\n    p = np.round(probs, decimals) + np.random.normal(0, noise, probs.shape)\n    p = np.clip(p, 0, None)\n    return p \u002F p.sum()\n```\nDefense in depth combines these with strict **per-principal rate limiting**, anomaly alerting from step 2, ART's `ReverseSigmoid` \u002F prediction-poisoning postprocessor, and watermarking so an extracted surrogate remains attributable.\n\n### 6. Alert and respond\nWire step-2 findings into your SIEM. On a confirmed extraction pattern: throttle or revoke the API key, switch the principal to label-only responses, preserve the audit log as evidence, and assess membership-inference exposure for any sensitive training data.\n\n## Tools and Resources\n\n| Resource | Link |\n|----------|------|\n| MITRE ATLAS AML.T0024 — Exfiltration via AI Inference API | https:\u002F\u002Fatlas.mitre.org\u002Ftechniques\u002FAML.T0024 |\n| Adversarial Robustness Toolbox (ART) | https:\u002F\u002Fgithub.com\u002FTrusted-AI\u002Fadversarial-robustness-toolbox |\n| ART extraction attacks (CopycatCNN, KnockoffNets) | https:\u002F\u002Fadversarial-robustness-toolbox.readthedocs.io\u002F |\n| MITRE ATLAS Matrix | https:\u002F\u002Fatlas.mitre.org\u002Fmatrices\u002FATLAS |\n| NIST AI RMF (MEASURE function) | https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework |\n\n## Detection Signal Reference\n\n| Signal | Normal use | Extraction behavior |\n|--------|-----------|---------------------|\n| Query volume per principal | Bounded, bursty | Very high, sustained |\n| Unique-input ratio | Repeats common inputs | Near-1.0 (rarely repeats) |\n| Confidence-vector requests | Mostly top label | Demands full probs\u002Flogits |\n| Input distribution | In-distribution | Near-boundary \u002F synthetic \u002F grid |\n| Inter-query timing | Human-paced | Automated, regular |\n\n## Validation Criteria\n\n- [ ] Inference API logs per-principal query volume, input fingerprint, and confidence-exposure.\n- [ ] Detector scores principals and flags high-volume, high-unique-ratio, full-vector callers.\n- [ ] ART extraction attack run against own model; surrogate fidelity vs. query budget reported.\n- [ ] Membership-inference accuracy measured and compared against the 50% baseline.\n- [ ] Label-only \u002F confidence-perturbation defenses applied and re-tested.\n- [ ] Per-principal rate limiting enforced and validated.\n- [ ] Alerts routed to SIEM with response playbook (throttle, revoke, preserve evidence).\n","# Detecting Model Extraction Attacks\n\n> **Authorized Use Only:** The extraction, inversion, and membership-inference techniques described here are intended for defenders testing their own models and for red teams operating under written authorization. Querying a third-party model to clone it, reconstruct its training data, or infer membership without permission may violate terms of service, copyright, and privacy law.\n\n## Overview\n\nModel extraction is the family of attacks in which an adversary abuses a model's **inference API** to steal value that the model owner intended to keep private. MITRE ATLAS catalogs these under **AML.T0024 — Exfiltration via AI Inference API**, in the *Exfiltration* tactic, with three sub-techniques:\n\n- **AML.T0024.000 — Infer Training Data Membership** (membership inference): the adversary determines whether a specific record was part of the training set, a privacy violation that can expose, for example, whether a patient's record trained a medical model.\n- **AML.T0024.001 — Invert AI Model** (model inversion): the adversary reconstructs representative training inputs (e.g., faces, text) by exploiting confidence scores returned by the API.\n- **AML.T0024.002 — Extract ML Model** (model stealing): the adversary repeatedly queries the victim model, collects (input, prediction) pairs, and trains a *surrogate* model offline that mimics the victim's decision boundary — avoiding the per-query cost of a Machine-Learning-as-a-Service offering and stealing the owner's intellectual property.\n\nAll three share a common signal: an attacker must send **many queries**, often crafted to probe the decision boundary (high-entropy, near-boundary, synthetic, or systematically grid-sampled inputs), and frequently requests **full confidence vectors \u002F logits** rather than just the top label. Detection therefore centers on per-principal query monitoring, input-distribution analysis, and confidence-exposure controls, while defense centers on rate limiting, output perturbation, and reducing the information returned per query. This skill follows the MITRE ATLAS technique definition for AML.T0024 (https:\u002F\u002Fatlas.mitre.org\u002Ftechniques\u002FAML.T0024) and the NIST AI RMF MEASURE function (MEASURE-2.6, security and resilience of the AI system).\n\n## When to Use\n\n- When you operate a model behind a public or partner inference API and need to detect cloning, inversion, or membership inference.\n- When performing a pre-deployment AI red-team exercise to measure how many queries are needed to extract your own model.\n- When validating that rate limiting, output perturbation, and confidence-suppression controls actually reduce extractability.\n- When investigating anomalous billing\u002Fusage spikes that may indicate surrogate-model harvesting.\n- When responding to a privacy incident where membership inference against a model is suspected.\n\n## Prerequisites\n\n- Python 3.9+ environment.\n- Access to inference-API access logs (per-API-key\u002Fper-principal query counts, timestamps, input features or hashes, returned confidence vectors).\n- For self-assessment red-teaming, install the Adversarial Robustness Toolbox (ART), the reference framework for extraction\u002Finference attacks and defenses:\n  ```bash\n  pip install adversarial-robustness-toolbox scikit-learn numpy\n  ```\n- Optional: access to the target model object (white\u002Fgrey-box) or only its API (black-box).\n- Authorization to test the target model.\n\n## Objectives\n\n- Instrument the inference API to record per-principal query volume, input diversity, and confidence-exposure.\n- Build a detector that scores principals for extraction-like behavior (volume, near-boundary sampling, full-vector requests).\n- Run an ART-based extraction attack against your own model to measure fidelity vs. query budget.\n- Run a membership-inference attack to quantify training-data leakage.\n- Apply and validate defenses: rate limiting, label-only responses, confidence rounding\u002Fperturbation, and prediction poisoning.\n\n## MITRE ATT&CK Mapping\n\n| ID | Name (MITRE ATLAS) | Tactic |\n|----|--------------------|--------|\n| AML.T0024 | Exfiltration via AI Inference API | Exfiltration |\n| AML.T0024.000 | Infer Training Data Membership | Exfiltration |\n| AML.T0024.001 | Invert AI Model | Exfiltration |\n| AML.T0024.002 | Extract ML Model | Exfiltration |\n\n## Workflow\n\n### 1. Instrument the inference API for detection signals\nCapture the fields a detector needs. Per request, log the principal (API key \u002F IP \u002F account), timestamp, an input fingerprint, and whether the caller requested probabilities\u002Flogits.\n\n```python\nimport hashlib, json, time\n\ndef log_inference(principal, features, returned_probs):\n    record = {\n        \"ts\": time.time(),\n        \"principal\": principal,\n        # hash inputs so logs don't store raw sensitive data\n        \"input_hash\": hashlib.sha256(json.dumps(features, sort_keys=True).encode()).hexdigest(),\n        \"wants_probs\": returned_probs,\n        \"n_features\": len(features),\n    }\n    with open(\"inference_audit.jsonl\", \"a\") as f:\n        f.write(json.dumps(record) + \"\\n\")\n```\n\n### 2. Detect extraction-like query patterns\nScore each principal on the three signals that distinguish extraction from normal use: high query volume in a window, high *unique-input* ratio (attackers rarely repeat), and a high rate of full-probability requests.\n\n```python\nimport collections, json\n\ndef score_principals(audit_path=\"inference_audit.jsonl\", window_qps_threshold=100):\n    by_principal = collections.defaultdict(lambda: {\"q\": 0, \"uniq\": set(), \"probs\": 0})\n    for line in open(audit_path):\n        r = json.loads(line)\n        p = by_principal[r[\"principal\"]]\n        p[\"q\"] += 1\n        p[\"uniq\"].add(r[\"input_hash\"])\n        p[\"probs\"] += int(r[\"wants_probs\"])\n    findings = []\n    for principal, p in by_principal.items():\n        uniq_ratio = len(p[\"uniq\"]) \u002F max(p[\"q\"], 1)\n        prob_ratio = p[\"probs\"] \u002F max(p[\"q\"], 1)\n        suspicious = p[\"q\"] > window_qps_threshold and uniq_ratio > 0.9 and prob_ratio > 0.8\n        findings.append({\"principal\": principal, \"queries\": p[\"q\"],\n                         \"unique_ratio\": round(uniq_ratio, 3),\n                         \"prob_request_ratio\": round(prob_ratio, 3),\n                         \"suspected_extraction\": suspicious})\n    return sorted(findings, key=lambda x: -x[\"queries\"])\n```\n\n### 3. Measure your model's extractability with ART (self red-team)\nUse ART's `CopycatCNN` (or `KnockoffNets`) to train a surrogate from black-box queries and report fidelity at a given query budget. Low query budget + high agreement = high risk.\n\n```python\nimport numpy as np\nfrom art.estimators.classification import SklearnClassifier\nfrom art.attacks.extraction import KnockoffNets\nfrom sklearn.ensemble import RandomForestClassifier\n\n# victim is your already-trained model wrapped for ART\nvictim = SklearnClassifier(model=trained_model)            # your production model\nthief_model = RandomForestClassifier(n_estimators=100)\nthief = SklearnClassifier(model=thief_model)\n\nattack = KnockoffNets(classifier=victim, batch_size_fit=64,\n                      batch_size_query=64, nb_epochs=10, nb_stolen=2000)\nstolen = attack.extract(x=x_pool, thief_classifier=thief)   # 2000-query budget\n\nagreement = np.mean(stolen.predict(x_test).argmax(1) == victim.predict(x_test).argmax(1))\nprint(f\"Surrogate fidelity (agreement with victim): {agreement:.2%} at 2000 queries\")\n```\n\n### 4. Quantify training-data leakage with membership inference\nRun ART's black-box membership-inference attack. An accuracy meaningfully above 50% indicates the model leaks membership (AML.T0024.000).\n\n```python\nfrom art.attacks.inference.membership_inference import MembershipInferenceBlackBox\n\nmia = MembershipInferenceBlackBox(victim, attack_model_type=\"rf\")\n# fit the attack on a labeled split of known members \u002F non-members\nmia.fit(x_train[:500], y_train[:500], x_test[:500], y_test[:500])\nmember_pred = mia.infer(x_train[500:1000], y_train[500:1000])\nnonmember_pred = mia.infer(x_test[500:1000], y_test[500:1000])\nacc = (member_pred.mean() + (1 - nonmember_pred.mean())) \u002F 2\nprint(f\"Membership-inference accuracy: {acc:.2%} (0.50 = no leakage)\")\n```\n\n### 5. Apply and validate defenses\nReduce the information returned and the query economics. Re-run steps 3 and 4 after each control to confirm extractability drops.\n\n```python\n# (a) Label-only responses: never return full probability vectors to untrusted callers.\ndef respond(probs, trusted):\n    return int(probs.argmax()) if not trusted else probs.tolist()\n\n# (b) Confidence rounding \u002F output perturbation (raises queries needed for inversion):\ndef perturb(probs, decimals=2, noise=0.01):\n    p = np.round(probs, decimals) + np.random.normal(0, noise, probs.shape)\n    p = np.clip(p, 0, None)\n    return p \u002F p.sum()\n```\nDefense in depth combines these with strict **per-principal rate limiting**, anomaly alerting from step 2, ART's `ReverseSigmoid` \u002F prediction-poisoning postprocessor, and watermarking so an extracted surrogate remains attributable.\n\n### 6. Alert and respond\nWire step-2 findings into your SIEM. On a confirmed extraction pattern: throttle or revoke the API key, switch the principal to label-only responses, preserve the audit log as evidence, and assess membership-inference exposure for any sensitive training data.\n\n## Tools and Resources\n\n| Resource | Link |\n|----------|------|\n| MITRE ATLAS AML.T0024 — Exfiltration via AI Inference API | https:\u002F\u002Fatlas.mitre.org\u002Ftechniques\u002FAML.T0024 |\n| Adversarial Robustness Toolbox (ART) | https:\u002F\u002Fgithub.com\u002FTrusted-AI\u002Fadversarial-robustness-toolbox |\n| ART extraction attacks (CopycatCNN, KnockoffNets) | https:\u002F\u002Fadversarial-robustness-toolbox.readthedocs.io\u002F |\n| MITRE ATLAS Matrix | https:\u002F\u002Fatlas.mitre.org\u002Fmatrices\u002FATLAS |\n| NIST AI RMF (MEASURE function) | https:\u002F\u002Fwww.nist.gov\u002Fitl\u002Fai-risk-management-framework |\n\n## Detection Signal Reference\n\n| Signal | Normal use | Extraction behavior |\n|--------|-----------|---------------------|\n| Query volume per principal | Bounded, bursty | Very high, sustained |\n| Unique-input ratio | Repeats common inputs | Near-1.0 (rarely repeats) |\n| Confidence-vector requests | Mostly top label | Demands full probs\u002Flogits |\n| Input distribution | In-distribution | Near-boundary \u002F synthetic \u002F grid |\n| Inter-query timing | Human-paced | Automated, regular |\n\n## Validation Criteria\n\n- [ ] Inference API logs per-principal query volume, input fingerprint, and confidence-exposure.\n- [ ] Detector scores principals and flags high-volume, high-unique-ratio, full-vector callers.\n- [ ] ART extraction attack run against own model; surrogate fidelity vs. query budget reported.\n- [ ] Membership-inference accuracy measured and compared against the 50% baseline.\n- [ ] Label-only \u002F confidence-perturbation defenses applied and re-tested.\n- [ ] Per-principal rate limiting enforced and validated.\n- [ ] Alerts routed to SIEM with response playbook (throttle, revoke, preserve evidence).\n",{"name":5,"tags":55,"author":56,"domain":48,"license":15,"version":57,"subdomain":44,"description":7,"nist_ai_rmf":58,"atlas_techniques":60},[44,41,40,39,38,37,36,35],"mahipal","1.0",[59],"MEASURE-2.6",[61],"AML.T0024","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-model-extraction-attacks",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-model-extraction-attacks",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-model-extraction-attacks",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-model-extraction-attacks","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-model-extraction-attacks\u002FSKILL.md",true,[86,91,97,101],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-model-extraction-attacks\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2340,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-model-extraction-attacks\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fstandards.md",1645,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-model-extraction-attacks\u002Freferences\u002Fstandards.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",5873,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-model-extraction-attacks\u002Fscripts\u002Fagent.py",[108,134,158,185,211,238],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":50},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[114],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118,119,42,48,120,121,122,123,124,125,126,127,128,129,130,131,132,133],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":141,"publishedAt":50},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[140],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[142,130,143,144,42,145,48,122,146,147,148,149,150,151,152,153,154,155,156,157],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":168,"publishedAt":50},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[164,167],{"categoryNo":165,"categoryName":166,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[152,169,170,171,172,48,173,174,146,175,176,177,178,179,43,180,181,182,183,184],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":192,"publishedAt":50},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[191],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[193,194,195,48,196,197,198,199,200,201,202,203,204,205,206,207,149,208,209,210],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":212,"name":213,"nameZh":6,"description":214,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":215,"categories":216,"keywords":218,"publishedAt":50},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[217],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[219,220,221,48,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":50},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[244],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[42,246,48,247,248,249,250,251,252,253,254,180,255,181,256,257,258,259,260,261],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]