Model exfiltration

Model exfiltration is the unauthorised extraction of an AI model or of the sensitive information associated with it. In its most direct form it means the theft of a model’s weights — the trained parameters that constitute the model itself — which represent significant investment and may encode proprietary or sensitive knowledge. It can also refer to reconstructing a model’s behaviour by systematically querying it, or extracting confidential data the model was trained on or can retrieve at inference time.

The risk arises through several routes: compromise of the infrastructure hosting the model, insufficient access controls around where weights are stored, extraction attacks that probe a model through its API to approximate its parameters or recover training data, and exposure of data the model can reach through connected systems. Where a model has outbound network access, exfiltration of its inputs and outputs — the sensitive prompts and responses — is also a concern, not only theft of the model itself.

Controls against exfiltration include strict access management and encryption for stored weights, isolating the model so it has no unnecessary network egress, monitoring and rate-limiting query patterns that resemble extraction attempts, and, for the highest-sensitivity cases, air-gapping so there is no path off the system at all. Treating the model weights and the data they touch as assets requiring protection in their own right is central to secure AI deployment.