Implementation guide
OWASP AISVS v1.01
Adversarial Robustness · Model-Extraction Defense
Detect extraction from query patterns
Verify that query-pattern analysis feeds an extraction-attempt detector.
OWASP AISVS v1.01, requirement 11.3.1
In plain English
Someone copying your model through its API queries it differently from a normal user. Analyse query patterns per caller, and feed the signs into a detector that raises the alarm.
What good looks like
- Query patterns are analysed per caller over time.
- Signs of extraction raise alerts: unusually broad or systematic coverage of inputs, templated prompts, high volume with little repetition, or requests for maximum output detail.
- Alerts are reviewed and the outcomes recorded.
- Detection looks across accounts that appear related.
How teams usually do it
- Monitoring of volume, diversity and similarity of queries per caller, using embeddings to measure how widely they spread.
- Comparing each caller with the normal profile for their customer type.
- Linking accounts by payment details, network or behaviour to catch split-up extraction.
Suggested evidence
- Detector rules or model.
- Sample alerts and how they were resolved.
Common mistakes
- Looking at volume only, so slow, wide-ranging querying goes unnoticed.
- Analysing each API key alone when one actor holds many.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.