Adversarial Robustness · Membership-Inference and Model-Inversion Mitigation
Rate limits sized against model extraction
Verify that inference endpoints enforce per-principal and global rate limits sized to the extraction threat model, and not solely as a generic API throttle.
OWASP AISVS v1.01, requirement 11.2.2
In plain English
An attacker can copy a model's behaviour by sending it a very large number of queries and training their own model on the answers. Set rate limits, per caller and overall, that make this slow and costly. Size them from an estimate of what extraction would take. A generic throttle set to protect capacity is usually far too generous.
What good looks like
- A written estimate says roughly how many queries a useful extraction would need for your model.
- Per-caller limits (by key, account and where possible by organisation) are set with that number in mind, over long windows such as a day or a month as well as short ones.
- A global limit caps the total.
- Breaches are logged and reviewed.
How teams usually do it
- API gateway rate limiting with per-key and per-account quotas, counted in requests and tokens.
- Controls on account creation, so limits cannot be dodged by opening many accounts.
- Higher quotas granted to known customers after verification.
Suggested evidence
- The extraction estimate and the limits derived from it.
- Gateway configuration.
- Logs of limit breaches and what was done.
Common mistakes
- Generic limits set only to protect capacity.
- Per-key limits with unlimited free keys.
- Per-minute limits only, which a patient attacker stays under for months.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.