Paper deep dive
Caliber: Cross-Architecture Extraction-Cost Control for Score-Returning APIs
Chi Wang, Hanwen Wang, Yu Xia, Zihan Wang, Guangdong Bai
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:We present Caliber, an output-perturbation defense against model extraction that formulates noise selection as a calibration problem: how much the defense degrades the supervision signal used to train a surrogate, and the provable per-input query cost of recovering the clean logits. To defend against an attacker that uses returned scores for knowledge distillation, Caliber adds independent and identically distributed Gaussian noise to the internal logits. We establish two properties of the resulting perturbed predictions. Monotone agreement degradation: When the clean logits have a unique maximizer, agreement with the clean prediction decreases strictly with the noise scale, so every target in $(1/K,1)$ corresponds to a unique positive scale; task accuracy is bounded by computable lower and upper envelopes. Per-input recovery cost: We derive a closed-form minimax lower bound on the repeated queries needed to recover the clean logits for a fixed input. Caliber normalizes noise variance by the squared median top-two logit margin and fits the resulting noise-utility relationship with a logistic curve, either per model or shared within a task. Across more than thirty model-dataset combinations, per-model calibration achieves mean absolute relative errors of 0.6-1.4%. End-to-end experiments show that surrogate performance generally tracks the configured degradation, while fixed-input averaging follows the expected variance reduction.
Tags
Links
- Source: https://arxiv.org/abs/2608.01023v1
- Canonical: https://arxiv.org/abs/2608.01023v1
Trouble viewing inline? Open PDF directly →
Full Text
58,229 characters extracted from source content.
Expand or collapse full text
11institutetext: University of Queensland, Brisbane, Australia 11email: chi.wang2@student.uq.edu.au, zihan.wang@uq.edu.au 22institutetext: Adelaide University, Adelaide, Australia 22email: hanwen.wang@adelaide.edu.au 33institutetext: Beijing Technology and Business University, Beijing, China 33email: 2307010124@st.btbu.edu.cn 44institutetext: City University of Hong Kong, Hong Kong, China 44email: g.bai@cityu.edu.hk Caliber: Cross-Architecture Extraction-Cost Control for Score-Returning APIs Chi Wang Hanwen Wang Yu Xia Zihan Wang Guangdong Bai Abstract We present Caliber, an output-perturbation defense against model extraction that formulates noise selection as a calibration problem: how much the defense degrades the supervision signal used to train a surrogate, and the provable per-input query cost of recovering the clean logits. To defend against an attacker that uses returned scores for knowledge distillation, Caliber adds independent and identically distributed Gaussian noise to the internal logits. We establish two properties of the resulting perturbed predictions. Monotone agreement degradation: When the clean logits have a unique maximizer, agreement with the clean prediction decreases strictly with the noise scale, so every target in (1/K,1)(1/K,1) corresponds to a unique positive scale; task accuracy is bounded by computable lower and upper envelopes. Per-input recovery cost: We derive a closed-form minimax lower bound on the repeated queries needed to recover the clean logits for a fixed input. Caliber normalizes noise variance by the squared median top-two logit margin and fits the resulting noise-utility relationship with a logistic curve, either per model or shared within a task. Across more than thirty model-dataset combinations, per-model calibration achieves mean absolute relative errors of 0.6–1.4%. End-to-end experiments show that surrogate performance generally tracks the configured degradation, while fixed-input averaging follows the expected variance reduction. 1 Introduction Deep learning models are expensive to train, which makes them valuable intellectual property worth protecting. Training Llama 3 405B consumed 30.84 million GPU hours on up to 16,000 H100 GPUs [9]. For score-returning APIs, confidence vectors improve downstream usefulness but also provide a supervision signal that an attacker can use for distillation. Querying at scale, an attacker collects the returned scores and trains a surrogate by knowledge distillation [12] that approximates the model’s behavior at a fraction of the original cost [41, 32]. Such extraction has already been demonstrated against production language-model APIs [20, 3], and Anthropic reported coordinated distillation campaigns involving more than 16 million API interactions from approximately 24,000 accounts whose operators sought to reproduce Claude’s capabilities [2]. Blocking suspicious accounts is difficult at the scale of a commercial API service. Existing detectors identify query patterns that deviate from benign traffic [18, 15, 47], yet heavy legitimate use and distributed extraction can produce overlapping query volumes and input distributions. Providers therefore maintain conservative false-positive rates, allowing some malicious activity to go undetected. Blocking also offers no intermediate response between unrestricted access and complete denial. An alternative is to keep a flagged account active while limiting the information that its user can extract. The provider perturbs the confidence scores it returns, corrupting the soft labels that distillation needs at a calibrated accuracy cost while each returned response stays plausible [23, 33, 16]. This caps the accuracy of the resulting surrogate, and an attacker who wants the clean scores back must average repeated queries on the same input, paying a multiple of the query budget. Existing output-perturbation defenses require model-specific tuning. Because the map from noise magnitude to utility loss depends on the architecture, a raw noise level that barely dents one model may severely degrade another, so unnormalized settings do not transfer across a heterogeneous portfolio. A practical defense should instead map a specified utility target to the model-specific noise that reaches it. Figure 1: Overview of Caliber. Top: i.i.d. Gaussian noise of variance σ2σ^2 is injected into the logits before the softmax. Bottom: after margin normalization, the noise-utility relationship is a single logistic curve, which Caliber inverts in closed form to map a target utility A∗A^* to the required σ2σ^2, fit per model or shared per task. Caliber is that mechanism. It answers how a provider sets the degradation of returned scores on any served model, capping the supervision an extraction campaign can distill and forcing an attacker who tries to cancel the zero-mean noise on an input to pay a multiplicative query cost that we bound below. As Figure 1 shows, Caliber injects independent and identically distributed (i.i.d.) Gaussian noise of variance σ2σ^2 into the model logits. The noise required for a given utility reduction varies substantially across architectures, and much of this variation is captured by a model-level scale S, defined as the median top-two logit margin over a validation set. Once the noise is normalized by this margin, every architecture we evaluate, spanning CNNs, Vision Transformers, large language models (LLMs), and vision-language models (VLMs), follows the same monotone logistic law. Our contributions are as follows: 1. We recast extraction defense as a controllable problem, proving strictly monotone degradation with a computable accuracy corridor and a minimax lower bound on the queries needed to cancel the injected noise on any single input. The cost is deliberately per-input, and we mark where the empirical evidence takes over. 2. We introduce a margin-normalized calibration law that sets any degradation target on a served model or on an unseen architecture, without per-model tuning. 3. We validate Caliber across more than thirty model-dataset combinations, hitting utility targets to within ∼1% 1\%. Furthermore, our end-to-end extraction study demonstrates that the stolen surrogate inherits the calibrated degradation. 2 Problem Formulation 2.1 Threat Model Figure 2: Model extraction threat model Assets and attacker goal. A provider serves a target model f through a black-box API. Without access to the model’s parameters, training data, or architecture, the attacker seeks a surrogate f f that minimizes the expected output discrepancy over a task-relevant input distribution PXP_X, namely x∼PX[D(f(x),f^(x))]E_x P_X[D(f(x), f(x))], where D is defined below. Attacker capabilities. The attacker holds a standard API subscription and submits arbitrary queries x∈x , each returning a confidence score vector =f(x)∈ℝK z=f(x) ^K (the logits) over K candidate outputs. The attacker knows the task domain but not f’s architecture or training. This interface matches deployed systems, where production LLM APIs expose top-k log-probabilities and specialized fine-tuned classifiers are served through the same score-returning endpoints. Attack mechanism. The attacker collects steal=(xi,i)i=1ND_steal=\(x_i, z_i)\_i=1^N and trains f f by knowledge distillation (KD) [12], minimizing the KD loss ℒKD=∑i=1NKL(softmax(iT)∥softmax(f^(xi)T)),L_KD= _i=1^NKL\! (softmax\! ( z_iT )\, \|\,softmax\! ( f(x_i)T ) ), (1) where T>1T>1 is the distillation temperature. Figure 2 depicts this query-and-distill pipeline. The full score vector carries inter-class similarity [12], often called the teacher’s dark knowledge, which makes surrogate training far more sample-efficient than learning from hard labels alone [32]. Defender capabilities and constraints. The provider controls the endpoint, sees every query with its metadata (account ID, IP, timing), and has full access to its own confidence scores at inference. It cannot reliably separate extraction traffic from legitimate heavy use, whose query volumes and distributions overlap with distillation campaigns [15]. Defense goal. A good defense degrades a flagged account’s outputs by a calibrated amount, scrambling the soft-label signal and, past the mildest settings, flipping a controlled fraction of predicted labels. Benign accounts receive unmodified outputs. Because a mistaken flag now perturbs rather than bans, the provider can run detection more aggressively than any ban policy allows. The difficulty is calibration. The provider must set a target degradation and reliably reach it, perturbing neither so hard that outputs look visibly wrong nor so little that the surrogate stays usable. 2.2 Defense Requirements A practical perturbation mechanism needs five properties. It must leave the served weights untouched (parameter-free) and add little enough latency to stay under a timing side-channel (minimal overhead). Its degradation must be monotonic, so that surrogate quality can be capped, and transferable enough that one policy covers much of a provider’s fleet. Finally, one-shot calibration makes the mechanism deployable from a single validation pass. 3 Methodology Models differ in logit scale, but once noise is normalized by the logit margin its effect on utility follows a single monotone logistic law that inverts in closed form, fit either per model or once per task. The i.i.d. Gaussian primitive and its order-preservation analysis build on Wang et al. [45]. 3.1 Logits Perturbation Logits, the raw scores before softmax, are an effective point of intervention for controlled degradation. Caliber injects isotropic Gaussian noise into the logits at inference time, which moves utility without touching a single weight. For input logits =(z1,z2,…,zK) z=(z_1,z_2,…,z_K), the perturbed logits are: ′=+ϵ,ϵk∼i.i.d.(0,σ2), z = z+ ε, _k i.i.d. N(0,σ^2), (2) where σ2σ^2 is the noise variance, the core control parameter, and ϵ ε denotes the noise vector with i.i.d. components. The final prediction is derived from the perturbed logits via softmax: y^′=argmaxksoftmax(′)k. y = *arg\,max_ksoftmax( z )_k. (3) The impact of noise on utility stems from its disruption of logit ordering [10, 36, 31, 22]. Following the order-preservation analysis of additive Gaussian logit noise [45], let τ be a permutation that sorts the original logits in ascending order, zτ(1)≤zτ(2)≤⋯≤zτ(K)z_τ(1)≤ z_τ(2)≤…≤ z_τ(K). Define the adjacent logits gap as Δi=zτ(i+1)−zτ(i) _i=z_τ(i+1)-z_τ(i) for i=1,2,…,K−1i=1,2,…,K-1. The probability that the perturbed logits retain the original ordering is approximated by: Pr(order preserved)≈∏i=1K−1Φ(Δi2σ), (order preserved)≈ _i=1^K-1 ( _i 2σ ), (4) where Φ(⋅) (·) is the cumulative distribution function (CDF) of the standard normal distribution. Each factor is the exact marginal survival probability of one adjacent pair, and the product treats these events as independent. Because adjacent gaps share a noise component, this is an approximation rather than an identity. As σ increases, Δi2σ _i 2σ decreases, so Φ(⋅) (·) and the product decline. This product describes survival of the entire ranking. For utility, the operative event is survival of the predicted label. Proposition 1(Exact label preservation and monotone degradation) Fix an input whose clean logits have a unique maximizer a=argmaxkzka= *arg\,max_kz_k, and let gj=za−zj>0g_j=z_a-z_j>0 for j≠aj≠ a. Under i.i.d. noise ϵk∼(0,σ2) _k (0,σ^2), the probability that the perturbed prediction matches the clean one is π(σ):=Pr[argmaxk(zk+ϵk)=a]=∫ℝϕ(u)∏j≠aΦ(gjσ+u)du,π(σ)\;:=\; \! [ *arg\,max_k\,(z_k+ _k)=a ]\;=\; _Rφ(u) _j≠ a \! ( g_jσ+u )\,du, (5) where ϕφ and Φ are the density and CDF of the standard normal. The map π is continuous and strictly decreasing on (0,∞)(0,∞), with limσ→0+π(σ)=1 _σ→ 0^+π(σ)=1 and limσ→∞π(σ)=1/K _σ→∞π(σ)=1/K. Proof sketch. Conditioning on the noise at the top class reduces the event to independent Gaussian comparisons, which gives the integral (5). Since every gap gj>0g_j>0, raising σ strictly shrinks the survival region, driving π from 11 down to the chance level 1/K1/K. The full proof is in Appendix 0.B. Averaged over inputs, the population agreement with the clean decision decreases strictly from 11 to the chance level 1/K1/K. Task accuracy is a distinct quantity. On an input the clean model misclassifies, noise can flip the prediction onto the true label, so accuracy need not fall pointwise in σ. It is nevertheless pinned to the agreement curve, with a slack we can bound explicitly. Corollary 1(Accuracy corridor) On an evaluation distribution with clean accuracy A0A_0, let π¯c(σ) π_c(σ) be the mean of π(σ)π(σ) from Equation (5) over the correctly classified inputs, and for each misclassified input let h=za−zy>0h=z_a-z_y>0 be the deficit of the true label y behind the clean prediction a. Then the accuracy under noise, A(σ)=avgiPr[argmaxk(zk,i+ϵk)=yi]A(σ)= *avg_i [ *arg\,max_k(z_k,i+ _k)=y_i], satisfies for every σ>0σ>0 A0π¯c(σ)≤A(σ)≤A0π¯c(σ)+(1−A0)β(σ),A_0\, π_c(σ)\;≤\;A(σ)\;≤\;A_0\, π_c(σ)+(1-A_0)\,β(σ), (6) where β(σ)=avgmisclassifiedΦ(−h2σ)<12β(σ)= *avg_misclassified \! (\!- h 2\,σ )< 12, the floor A0π¯c(σ)A_0 π_c(σ) is continuous and strictly decreasing from A0A_0 to A0/KA_0/K, and both envelopes are computable from the same noise-free sweep that fixes S and A0A_0. Moreover A(σ)→1/KA(σ)→ 1/K as σ→∞σ→∞. Corollary 1, proved in Appendix 0.B, ties utility to agreement. Accuracy stays inside a corridor: the floor inherits the strict monotonicity of Proposition 1, and the width (1−A0)β(σ)(1-A_0)β(σ) is computable in closed form from the clean sweep. Across the seventeen CIFAR architectures and eight MMLU LLMs of Section 4, that width at a setting retaining 85%85\% of clean accuracy is 22–33 accuracy points on CIFAR-10, 66–88 points on CIFAR-100, and 66–1414 points on MMLU, scaling with the misclassified mass 1−A01-A_0, and measured accuracy never leaves the corridor at any setting we test. Accuracy is what a provider targets, so the calibration below fits it empirically, the corridor guaranteeing that this fit smooths a bounded band around a monotone mechanism rather than an arbitrary curve. Its endpoints A0A_0 and 1/K1/K are exactly those that normalize utility in Equation (8), and the 1/K1/K floor reappears as the residual term c in Equation (9). When the controlled quantity is agreement itself, no fitting is needed at all. Equation (5) can be inverted numerically per model, and doing so on the cached sweeps of Section 4 hits agreement targets of 0.90.9–0.60.6 with a mean absolute relative error of 0.08%0.08\% (0.27%0.27\% at worst) across those same twenty-five CIFAR and MMLU models, the resolution of the 6464-draw Monte Carlo verification itself. This establishes the monotonic control requirement of Section 2.2 at the mechanism level, and Figure 3 shows the same monotonicity end-to-end. Figure 3: Utility decay under injected logit noise 3.2 Margin Normalization Raw noise variance σ2σ^2 cannot be compared across models because logit scales differ. ResNet-50 on CIFAR-10 may show logit margins an order of magnitude larger than lightweight MobileNetV2 [38], so the same σ causes very different utility drops. We therefore normalize by each model’s own logit margin. For each validation sample we take the margin mi=z(1),i−z(2),im_i=z_(1),i-z_(2),i, set the model-specific scale factor to its median S=median(mii=1N)S=median(\m_i\_i=1^N), which is robust to label-ambiguous outliers and ablated against the mean and trimmed mean in Section 4, and define the normalized noise intensity v=σ2S2.v= σ^2S^2. (7) A given v then corresponds to comparable logit disruption across models. At v=1v=1 the noise variance equals the squared median margin, whatever the architecture. This margin is exactly the smallest gap minj≠agj _j≠ ag_j from the top logit in Proposition 1, the gap to the nearest competitor whose corruption first flips the prediction, which is why it sets the relevant noise scale. The margin also delimits the stealthy region. While σ stays well below it, perturbation scrambles mostly the soft-label tail and usually leaves the predicted label intact, as Equation (4) shows, so v measures how much soft-label corruption a model absorbs before its accuracy starts to fall. 3.3 Calibration Curve Fitting Margin normalization places the noise on a common v=σ2/S2v=σ^2/S^2 axis. We likewise normalize utility to each model’s operating range, A~=A−ArandA0−Arand, A= A-A_randA_0-A_rand, (8) where A0A_0 is the clean baseline and Arand=1/KA_rand=1/K the chance level, so that A~∈[0,1] A∈[0,1] with A~(0)=1 A(0)=1. Across image-classification, LLM, and VLM discriminative tasks the (v,A~)(v, A) relationship follows a monotone logistic decay. Utility holds near the baseline while the logit margin dominates the noise, drops sharply once the ordering starts to randomize, then settles onto a residual floor: A~(v)=c+1−c1+(v/v50)p, A(v)=c+ 1-c1+(v/v_50)^p, (9) where v50>0v_50>0 is the half-degradation scale, p>0p>0 the steepness, and 0≤c<10≤ c<1 a small residual floor. The logistic form captures the flat head and sharp transition of discrete decision tasks more faithfully than a stretched exponential, which over-predicts degradation at low noise. Caliber fits (v50,p,c)(v_50,p,c) by bounded least-squares on the (v,A~)(v, A) points from a single noise-free sweep, in either of two modes. Per-model fitting uses the target model’s own sweep, the precise deployment mode. Shared per-task fitting aggregates a few representative architectures once, after which a new architecture serving that task needs only its margin S, with no sweep of its own, trading some precision for zero per-model cost. Measured leave-one-architecture-out, the shared curve stays within a point of the in-sample fit on every task (Section 4), the residual gap arising because margin normalization equalizes the logit margin but not the full order statistics (Equation (4)), which differ across architectures and class counts K. Both modes are monotone, so the inversion below is well-defined. 3.4 One-Shot Inverse Calculation Given a fitted curve, per-model or shared per-task, Caliber computes in one shot the noise variance that achieves any target utility A∗A^*, with no retraining or per-point search. A noise-free pass on a clean validation set fixes the scale factor S=median(mii=1N)S=median(\m_i\_i=1^N) and baseline A0A_0. We then normalize the target, A~∗=(A∗−Arand)/(A0−Arand) A^*=(A^*-A_rand)/(A_0-A_rand), invert Equation (9), and de-normalize to the model scale: v∗=v50(1−A~∗A~∗−c)1/p,(σ∗)2=v∗S2,v^*=v_50 ( 1- A^* A^*-c )^1/p, (σ^*)^2=v^*\,S^2, (10) where (v50,p,c)(v_50,p,c) are the fitted parameters. Because A~∗ A^* decreases as A∗A^* drops, v∗v^* and hence σ∗σ^* increase monotonically by construction. The inversion is valid for c<A~∗≤1c< A^*≤ 1. For A∗≥A0A^*≥ A_0 no noise is needed ((σ∗)2=0(σ^*)^2=0), and for targets at the chance floor (σ∗)2(σ^*)^2 is set large to saturate degradation. 3.5 Per-Input Recovery Cost Because the injected noise is zero-mean, an attacker can try to cancel it by averaging repeated queries on the same input. The next result bounds what this recovery costs and shows how per-input seeding removes the cheap route. Proposition 2(Minimax query cost of per-input recovery) Let the defender operate at normalized intensity v=σ2/S2v=σ^2/S^2 and consider a single input, whose clean logits z are unknown to the attacker. The attacker issues M repeated queries on that input and applies an arbitrary estimator z to the returned logits. Call the effective intensity of a recovery its worst-case normalized error, veff(^)=sup1KS2‖^−‖2v_eff( z)= _ z 1KS^2\,E\| z- z\|^2. (i) If the perturbation is drawn freshly i.i.d. per query, then every estimator satisfies veff(^)≥v/Mv_eff( z)≥ v/M, with equality attained by the sample mean. Hence to reduce the effective intensity to a usable level vuse∈(0,v]v_use∈(0,v], the attacker must issue M≥v/vuseM≥ v/v_use queries per input. (i) If the perturbation is drawn deterministically from a seed fixed by the input, the M repeats return identical logits. Their average retains effective intensity v, so exact repetition yields no recovery, and the attacker must instead source M near-duplicate inputs that the model maps to essentially the same clean logits, each of which draws its own independent perturbation. Proof sketch. The averaged responses form a sufficient statistic distributed as (,(σ2/M)I)N( z,(σ^2/M)I), and a limiting Gaussian-prior argument shows no estimator improves on worst-case error σ2/Mσ^2/M, which the sample mean attains. The bound is thus minimax over all recovery strategies, not an algebraic property of averaging alone. A per-input deterministic seed instead makes the M draws identical, so their average yields no variance reduction and recovery must come from distinct inputs. The full proof is in Appendix 0.B. Proposition 2(i) turns the deployed intensity into a lower bound v/vusev/v_use on the queries an attacker must spend on a single input to drive that input’s residual error down to vusev_use, holding for every recovery strategy rather than only the sample average. Reading vusev_use back through A~ A as a utility level requires the residual to act like fresh noise of that intensity. That is exact for the sample mean, whose residual is again Gaussian of intensity v/Mv/M, and is otherwise a mean-squared-error proxy, since equal-error residuals need not corrupt the soft labels equally. The scope is narrow. Proposition 2 concerns recovery of one input’s clean logits from repeated observations of that input, and extraction is not that problem. An attacker fits a surrogate across many distinct inputs, pooling information through the surrogate’s inductive bias, which no per-input bound constrains. The ∼M× M× figure in Section 4.3 is measured rather than derived, and a lower bound on the query complexity of extraction remains open. What the proposition rules out is the one adaptive strategy that would let an attacker undo the defense for free, and composed with a volume-based detector that caps M it caps how far per-input recovery can be pushed. Section 4.3 measures the cross-input route directly and finds that distilling across tens of thousands of distinct perturbed responses attenuates the penalty but does not erase it. 4 Experiments We evaluate Caliber on eight LLMs, one VLM, and twenty-five vision model-dataset combinations spanning eight backbone families and three datasets. Table 1: LLM and VLM calibration per-model closed-form inversion. Relative error (%) between target and measured accuracy at targets of 90/80/70/60% of each model’s clean baseline. LLMs are scored on MMLU, the VLM on ScienceQA. Model Family Size Base. Rel. error at target (%) Mean (%) 90% 80% 70% 60% ||err|| Qwen2.5-7B Qwen 7B 71.6 +2.8+2.8 −0.1-0.1 −2.2-2.2 −2.1-2.1 1.8 Qwen2.5-14B (4-bit) Qwen 14B 75.9 +3.4+3.4 +0.6+0.6 −2.1-2.1 −2.1-2.1 2.0 Llama-3.1-8B Llama 8B 67.1 +2.2+2.2 +0.9+0.9 −0.9-0.9 −1.3-1.3 1.3 Mistral-7B Mistral 7B 59.2 +2.3+2.3 −0.2-0.2 −1.3-1.3 −0.9-0.9 1.2 Phi-4 (4-bit) Phi 14B 76.0 +2.4+2.4 +1.4+1.4 −0.6-0.6 −1.7-1.7 1.5 DeepSeek-R1-Qwen-7B DeepSeek 7B 48.1 +1.3+1.3 −0.5-0.5 −0.9-0.9 +0.7+0.7 0.8 DeepSeek-R1-Qwen-14B (4-bit) DeepSeek 14B 71.4 +2.6+2.6 +0.8+0.8 −1.6-1.6 −2.1-2.1 1.8 DeepSeek-R1-Llama-8B DeepSeek 8B 51.6 +1.6+1.6 +1.3+1.3 −0.1-0.1 +0.2+0.2 0.8 Qwen2-VL-7B Qwen-VL 7B 82.3 +0.5+0.5 −0.2-0.2 −1.0-1.0 −0.9-0.9 0.6 Mean ||relative error|| (LLMs / VLM) 1.4 / 0.6 4.1 Experimental Setup We test eight instruction-tuned LLMs from five families and three size classes on MMLU, three of them DeepSeek-R1 distills [4], and a vision-language model [43] on ScienceQA. We report multiple-choice accuracy over 2,0002,000 held-out questions, 1,5001,500 for the VLM, taking the score vector to be the model’s logits over the candidate answer letters. The vision suite is our primary calibration testbed because it compares many architectures under matched conditions within each dataset. Its backbones vary in depth and design family, from ResNet [11] to VGG [40], each measured by top-1 accuracy on the same 2,000-sample split of CIFAR-10, CIFAR-100 [21], and ImageNet-1K [5]. Accuracies under noise are averaged over 32–64 realizations. With a fixed ∼2,000 2,000-sample evaluation set the finite-sample error is about one point, so sub-percent table entries sit at the measurement floor rather than being exact. 4.2 Experimental Results We first analyze models subjected to simulated extraction pressure. For LLMs and VLMs, Caliber perturbs the confidence scores over candidate outputs, calibrating the noise to a target accuracy. This score interface is the one the threat model assumes, not an artifact of our benchmark. As Table 1 shows, Caliber fits a per-model logistic curve from one noise-free sweep and inverts it in closed form, driving every LLM to within a mean relative error of 1.4%1.4\% of the target, 3.4%3.4\% at worst, and the VLM to within 0.6%0.6\%. Under leave-one-model-out evaluation, task-specific shared curves transfer to held-out LLM and vision models, although with higher calibration error than per-model fitting; detailed results are reported in Appendix 0.A. The vision suite supplies the architectural breadth to test how well calibration holds. The closed-form inverted σ drives measured accuracy onto the target with a mean absolute relative error of 1.1%1.1\% across all twenty-five vision variants, 5.0%5.0\% at worst. Measured accuracy decreases as the injected noise grows, tracking the monotone floor of the accuracy corridor (Corollary 1). Per-model results for the eleven CIFAR-100 and eight ImageNet architectures, including VGG-16 and ViT-B/16, can be found in Table 4 in the Appendix. A single shared curve is looser but still transfers leave-one-architecture-out to an unseen model, the precision-cost trade-off we quantify in the margin-statistic ablation of Section 4.4. Table 2: Extraction under calibrated output perturbation at 95%, 85%, and 75% retention of clean teacher accuracy. Base: student accuracy before distillation; Clean: accuracy after distillation from the unperturbed teacher. Vision surrogates are trained from scratch (Base: N/A). † : surrogate accuracy ≤ Base. (a) Vision (CIFAR-100) (b) LLM (MMLU, Qwen2.5) base clean 95% 85% 75% base clean 95% 85% 75% Teacher — 64.0 60.7 54.3 47.2 Teacher — 72.0 68.2 61.2 53.1 RN-56 — 59.7 57.8 54.2 49.3 0.5B 44.1 51.1 48.9 48.3 46.4 RN-110⋆ — 61.0 59.5 55.1 50.2 1.5B 59.0 62.1 61.7 60.0 58.6† VGG-16 — 60.1 60.2 56.3 51.5 3B 64.2 67.8 67.9 65.7 62.9† 4.3 Extraction Evaluation The calibration above controls the exposed accuracy of the defended teacher, the target model f. We now test whether that degrades a surrogate distilled from it. The attacker queries same-distribution data the teacher has never seen and receives possibly perturbed score vectors with no ground-truth labels, distills a surrogate from them, and is scored on a disjoint held-out set, so teacher and surrogate share one yardstick. The σ is calibrated on the evaluation distribution exactly as deployed, following Section 3. Vision: a ResNet-110 teacher trained on 25,00025,000 CIFAR-100 images, clean test accuracy 64.0%64.0\%. The remaining 25,00025,000 training images form the attacker’s query pool, with margin statistics indistinguishable from test, median 3.553.55 versus 3.533.53. Surrogates are ResNet-56, an exact-match ResNet-110, and VGG-16, trained from scratch and scored on the official test set. LLM: a Qwen2.5-7B teacher on MMLU, held-out accuracy 72.0%72.0\%. The attacker submits 12,04212,042 unseen questions, and pretrained students Qwen2.5-0.5B, 1.5B, 3B are distilled via LoRA [13] from the returned answer-score vectors and scored on 2,0002,000 held-out questions. Because a pretrained student’s absolute accuracy is dominated by its prior, the quantity the defense controls there is the distillation gain over the student’s own pre-attack accuracy. A rational attacker can always early-stop, so driving the gain to zero is the strongest achievable outcome. Table 3: Repeated-query averaging attack. Surrogate top-1 accuracy (%) after averaging M queries per input, in the ResNet-110 configuration of Table 2(a) at the 75% retention target. Fresh i.i.d. noise is redrawn per query, whereas deterministic per-input seeding reuses one draw, which makes its M=16M=16 entry a replicate of fresh M=1M=1. This is a separate training run, so the single-draw values here and in Table 2 (50.050.0, 50.350.3, 50.250.2) differ by run-to-run variation alone. Dashes indicate settings not evaluated. Noise drawn M=1M=1 M=2M=2 M=4M=4 M=8M=8 M=16M=16 Fresh i.i.d. (attack) 50.0 54.3 56.9 59.2 60.4 Deterministic seeding (defense) — — — — 50.3 The calibrated perturbation transfers from teacher to surrogate in both modalities (Table 2). In the vision domain, every surrogate degrades with the throttle, remaining within measurement noise at the 95% setting, and tracks the throttled teacher. At the 85% setting, the three surrogates score 54.254.2, 55.155.1, and 56.3%56.3\% against the teacher’s 54.3%54.3\%, and at 75% they follow the teacher down to 49.349.3, 50.250.2, and 51.5%51.5\% as it falls to 47.2%47.2\%. Cross-sample distillation averages away roughly 40% of the teacher’s accuracy drop at the 75% setting, but a residual penalty survives in every surrogate, even at a single query per input. Neither the exact-match ResNet-110⋆ nor the 8 times larger VGG-16 circumvents the defense. At the 75% setting they fall 10.8 and 8.6 points respectively. On LLMs, the defense similarly regulates the distillation gain. Undefended distillation adds +7.0+7.0, +3.1+3.1, and +3.6+3.6 points over the students’ base accuracy, while mild throttling shrinks this improvement. At the 75% setting the gain of the two stronger students is erased outright, yielding −0.4-0.4 and −1.3-1.3 points for the entries marked †, so 12,04212,042 queries against the throttled API buy those two students nothing. Given the evaluation sample sizes, the clean-to-75% drop is about 3σ3σ, so the milder per-step differences should be read as a consistent trend rather than as individually significant. An attacker who knows the defense can try to cancel the zero-mean noise by averaging M repeated queries per input, paying ∼M× M× the queries. Table 3 measures the trade-off on a ResNet-110 teacher calibrated to retain 75%75\% of its clean accuracy. Under fresh i.i.d. noise the surrogate is averaged back toward this run’s undefended 60.5%60.5\%, so recovering an essentially clean surrogate costs ∼16× 16× the budget and even a merely usable one ∼4 4–8×8×. Drawing the noise deterministically per input removes the free repeats, holding the surrogate at 50.3%50.3\% even at M=16M=16. The attacker must then source M distinct near-duplicate queries per example, which is strictly more expensive. If the endpoint returns only the predicted label, the provider can still inject the noise internally to flip a fraction of labels. Driving a ResNet-110 teacher to ∼47% 47\% this way, a standard black-box attacker with one query per image distills only 44.9%44.9\%, against a 60.5%60.5\% undefended hard-label ceiling. Majority-voting over M repeated queries recovers the flipped labels, but again only at the ∼M× M× query cost, label accuracy climbing from 47.3%47.3\% at M=1M=1 to 63.1%63.1\% at M=64M=64 and surrogate accuracy from 44.9%44.9\% to 56.0%56.0\%. The cost multiplier is thus not specific to the soft-label interface. Figure 4: Margin-statistic ablation under amortized calibration using one shared logistic curve per task. Error bars denote 95% confidence intervals over 12 independent resampling of the calibration probe. 4.4 Ablations and Analysis Within the margin-normalization step, the principal design choice is the statistic used to define S. It matters only in the amortized regime, since a per-model fit absorbs any rescaling. On CIFAR-10, CIFAR-100, and MMLU the median, mean, and 10%10\%-trimmed mean all hold the shared-curve error in single digits, with the mean tightest at 2.52.5, 5.25.2, and 4.3%4.3\% and the default median loosest at 3.33.3, 8.08.0, and 7.2%7.2\%. As Figure 4 shows, a provider sharing curves at scale recovers up to three points by switching to the mean. The per-model breakdown and held-out transfer appear in Appendix 0.A. A per-model fit of Equation (9) attains R2≈0.998R^2≈ 0.998 across the vision architectures, and its closed-form monotone inversion is what yields the 1.1%1.1\% error reported above. Its flat head and sharp transition match how accuracy decays on discrete decision tasks, which exponential-family alternatives over-smooth (Section 3). 5 Discussion Design rationale. We intervene on logits because a softmax decision depends on logit differences. Adding i.i.d. Gaussian noise reshapes that difference distribution without touching any learned parameter, corrupting the soft-label signal a surrogate trains on by a calibrated amount the provider sets, at a cost of O(K)O(K) per query from K random draws and an element-wise addition. Limitations. Caliber controls the utility an attacker distills from an API, not orthogonal properties such as safety, bias, or robustness. It works best when the API returns confidence scores, and reaches only the endpoints the provider still tracks [37]. For hard-label APIs, the mechanism can still increase an attacker’s query cost, but it necessarily reduces the accuracy observed by legitimate users because no non-top-1 scores can be perturbed without changing the returned label. Margin normalization weakens under highly imbalanced scores, and the operating range must be validated so extreme noise stays well-behaved. Our evaluation of more than thirty model-dataset combinations does not cover every domain, and its breadth sits where the threat is thinnest. The broadest cross-model study uses image classifiers, whereas documented campaigns increasingly target LLM APIs, so the vision results read primarily as evidence of cross-model calibration transfer. As for the guarantees, Proposition 1 controls agreement with the clean model, so accuracy control holds only up to the corridor of Corollary 1 plus the empirical fit. Proposition 2 covers per-input recovery rather than extraction as a whole, for the reasons Section 3.5 sets out. Input-seeded noise reaches its limit at the same place. It removes exact repeats, but a determined attacker can still manufacture fresh draws by paraphrasing or near-duplicating inputs and average the noise out. Our study also fixes one query regime, standard distillation from in-distribution inputs at a single temperature, while attacks in the wild draw from out-of-distribution or synthetic data and select actively [32, 34, 15]. Active, uncertainty-based selection is unlikely to help, since it targets exactly the low-margin points our noise disrupts hardest. At the evaluated 75% retention setting the lowest-margin quintile has its predicted labels flipped at 1.5–1.7 times the overall rate, 59.8% versus 39.1% on MMLU and 72.8% versus 42.6% on CIFAR-100. Temperature rescales the perturbed logits uniformly, so the corruption of the soft targets should survive whatever temperature the attacker distills at. Caliber is therefore a cost-amplification mechanism, not a denial one, and works best alongside query-volume monitoring or rate limits that bound the repeat factor M, and post hoc ownership verification. Ethics. Throttling acts on detector-flagged accounts, so a misclassified legitimate user may receive degraded output. What that user loses is set by the retention target, up to calibration error and distribution shift. At a 75%75\% target the account keeps three quarters of the clean model’s accuracy, and unmodified service resumes once the flag is lifted. The burden still falls unevenly. A client that reads only top-1 labels sees a change only when the prediction flips, whereas one that consumes full score vectors sees perturbed values at much milder settings and has the greater need for an appeal mechanism. Graduated degradation is gentler than a ban, but the provider still has to audit the detector for disparate impact and keep throttling out of safety-critical deployments. Future work. The most direct extension is from scored decisions to free-form generation, where perturbing every token may compound the error but sequence-level quality needs its own evaluation. Adaptive throttling could raise the noise as a suspected account’s cumulative query count grows, with the ramp driven by drift in a tracked signal [27]. On the theory side, a bound on the surrogate quality reachable at a given degradation level would complement Proposition 2, though a worst-case version depends on convex relaxations of the surrogate’s activations [28]. Empirically, extraction on further datasets and variance estimates across training seeds remain open. 6 Related Work Model extraction builds on knowledge distillation [12]. Tramèr et al. [41] carried this into the black-box setting, fitting a surrogate on the scores a prediction API returns. Later attacks cloned from out-of-distribution images [32] or synthesized queries [42], and Jagielski et al. [14] showed high-accuracy extraction is cheap even when exact recovery is hard. The threat now reaches language models, from BERT APIs [20] to recovering a production LLM’s output projection [3], where querying stays far cheaper than training. Defenses split into reactive and proactive. Detection flags query streams that deviate from benign use [15, 47], while watermarking and fingerprinting pursue after-the-fact attribution, from trigger sets [1] to dataset inference [29] and decoding-time LLM watermarks [19] that survive distillation yet are erasable by paraphrasing [35]. Detection can only decide whether to cut an account off, and attribution arrives once the surrogate has already shipped. Proactively, AlgoSpec obscures released data so only an authorized algorithm can use it [25], non-transferable examples recode inputs into a model-specific subspace [44], and key-based usage control locks utility in the weights behind an owner’s key [46]. All three assume the defender owns the inputs or ships the weights, neither of which holds against an attacker who only queries an API. Output perturbation instead controls what the surrogate learns, serving a suspect plausible-but-corrupted scores. Reverse-sigmoid perturbation [23] introduced the idea. Prediction poisoning [33] and gradient redirection [30] steer the surrogate’s gradient under a utility budget. Adaptive misinformation [17] and diverse ensembles [16] mislead out-of-distribution queries, while undistillable training reshapes the output so any student degrades [26]. Recent LLM variants poison reasoning traces [39], fine-tune the output layer [24], or bound distillable information [8]. A parallel line raises the query cost of extraction [7, 6], a goal Caliber shares on the output side. Yet in all of these output-perturbation defenses the map from perturbation strength to surrogate accuracy is architecture-dependent, so strength must be set per model by hand and does not scale to hundreds of variants under latency constraints. Caliber absorbs that architecture-specific scale into the squared median logit margin, normalizing the noise variance by it and fitting a monotone logistic curve that inverts in closed form. We build on the i.i.d. Gaussian logit-noise primitive and order-preservation analysis of Wang et al. [45], introduced there for training-free utility tiering with per-model tuning, a non-security use. We repurpose it against distillation-based extraction and add the cross-architecture calibration that removes the per-model cost. 7 Conclusion We presented Caliber, which lets a score-returning API control the utility it exposes to a suspected extraction client. The control rests on one regularity, the monotone logistic law that every architecture we evaluate follows once the noise is normalized by the logit margin. Caliber inverts it in closed form to hit any target within ∼1% 1\% per model, or at single-digit held-out error across architectures. Undoing the zero-mean perturbation on a single input costs several times the query budget, a multiplier we lower-bound in closed form. What a provider previously hand-tuned per model it can now set once, from a target, on any architecture it serves. Appendix 0.A Ablations This section expands the margin-statistic ablation of Figure 4. Each seed re-estimates S from a fresh one-shot 2,0002,000-sample probe, a bootstrap resample of margins for the probe-sized LLM evaluation set. The task-level ordering reported in Section 4 holds at the per-model level, the mean beating the median on five of six CIFAR-10 models, seven of eleven CIFAR-100 models, and seven of eight LLMs. Seed-to-seed variability is negligible for every statistic (95% CIs of ±0.1±0.1–0.30.3 points), so the median’s robustness-to-outliers motivation carries no measurable cost at N=2,000N=2,000. These are in-sample shared fits that isolate the statistic. Held-out transfer (leave-one-architecture-out). For each architecture we fit the shared logistic curve on the other architectures of the task and calibrate the held-out one from its margin S alone. Held-out error stays within a point of the in-sample fit on every task, 3.7%3.7\% versus 3.3%3.3\% on CIFAR-10 (6 architectures), 8.8%8.8\% versus 8.0%8.0\% on CIFAR-100 (11), and 8.2%8.2\% versus 7.2%7.2\% on MMLU (8), so the curve generalizes to unseen architectures. Transfer is uneven per architecture. Holding out a ResNet on CIFAR-100 costs ∼12% 12\%, the reference set then being dominated by other families, while VGG-13 and RepVGG-A0 cost ∼1 1–2%2\%. On MMLU the Qwen models are hardest to predict held-out (∼11 11–13%13\%) and the Mistral and Phi models the easiest (∼3% 3\%). Appendix 0.B Omitted Proofs Proof(of Proposition 1) Write ϵk=σξk _k=σ _k with ξk∼(0,1) _k (0,1) i.i.d. Up to the probability-zero event of ties, argmaxk(zk+ϵk)=a=ξj−ξa<gj/σ∀j≠a\ *arg\,max_k(z_k+ _k)=a\=\ _j- _a<g_j/σ\ ∀ j≠ a\. Conditioning on ξa=u _a=u and using independence of ξjj≠a\ _j\_j≠ a gives Pr[⋅∣ξa=u]=∏j≠aΦ(gj/σ+u) [\,· _a=u]= _j≠ a (g_j/σ+u); integrating against ϕφ yields (5). For monotonicity, the event is ∈R(σ)\ ξ∈ R(σ)\ with R(σ)=:ξj−ξa<gj/σ∀j≠aR(σ)=\ ξ: _j- _a<g_j/σ\ ∀ j≠ a\. Since every gj>0g_j>0, each threshold gj/σg_j/σ is strictly decreasing in σ, so R(σ′)⊊R(σ)R(σ ) R(σ) for σ′>σ >σ; the Gaussian law assigns the nonempty difference positive measure, hence π(σ′)<π(σ)π(σ )<π(σ). The integrand of (5) is continuous in σ and dominated by ϕφ, so dominated convergence gives both continuity of π on (0,∞)(0,∞) and its limits: as σ→0+σ→ 0^+ all thresholds diverge and π→1π→ 1; as σ→∞σ→∞ all thresholds vanish and π→Pr[ξj<ξa∀j≠a]=1/Kπ→ [ _j< _a\ ∀ j≠ a]=1/K by exchangeability of i.i.d. continuous variables. ∎ Proof(of Corollary 1) Split the evaluation set into the correctly classified inputs (fraction A0A_0) and the misclassified ones (fraction 1−A01-A_0). On a correct input the event argmaxk(zk+ϵk)=y\ *arg\,max_k(z_k+ _k)=y\ is exactly the label-preservation event of Proposition 1, with probability π(σ)π(σ); averaging gives the contribution A0π¯c(σ)A_0 π_c(σ), which is continuous and strictly decreasing from A0A_0 to A0/KA_0/K termwise by Proposition 1. On a misclassified input the probability of predicting y is nonnegative, and argmaxk(zk+ϵk)=y⊆zy+ϵy>za+ϵa\ *arg\,max_k(z_k+ _k)=y\ \z_y+ _y>z_a+ _a\; since ϵy−ϵa∼(0,2σ2) _y- _a (0,2σ^2) and h=za−zy>0h=z_a-z_y>0, this event has probability Φ(−h/(2σ))<1/2 (-h/( 2σ))<1/2. Averaging over the misclassified inputs yields the upper envelope. Finally, A(σ)→1/KA(σ)→ 1/K as σ→∞σ→∞ by the exchangeability argument of Proposition 1. ∎ Proof(of Proposition 2) (i) Write the responses as (m)=+ϵ(m) z^(m)= z+ ε^(m), m=1,…,Mm=1,…,M. Their sample mean ¯∼(,(σ2/M)IK) z ( z,(σ^2/M)I_K) is a sufficient statistic for z, so it suffices to bound estimation of a Gaussian mean with per-coordinate variance σ2/Mσ^2/M. For any estimator z, the worst-case risk dominates the Bayes risk under the prior ∼(0,ρ2IK) z (0,ρ^2I_K), which is minimized by the posterior mean at per-coordinate risk ρ2σ2/(Mρ2+σ2)ρ^2σ^2/(Mρ^2+σ^2). Letting ρ→∞ρ→∞ gives sup1K‖^−‖2≥σ2/M _ z 1KE\| z- z\|^2≥σ^2/M, which ¯ z attains, so σ2/Mσ^2/M is the minimax risk. Dividing by S2S^2, the residual perturbation of any recovered logit vector carries worst-case effective intensity at least v/Mv/M; since v/M≤vusev/M≤ v_use iff M≥v/vuseM≥ v/v_use, the bound follows. (i) With a per-input deterministic seed the M draws coincide, so their average equals a single draw of intensity v. ∎ Appendix 0.C Per-Model Calibration Results Table 4 reports per-model calibration for the nineteen CIFAR-100 and ImageNet architectures, listing for each the closed-form inverted noise level σ and the accuracy it produces at every utility target. Within each row σ increases as the target decreases, matching the strict monotonicity of Proposition 1. Over these nineteen the measured accuracy lands on the target with a mean relative error of 0.8%0.8\%; the 1.1%1.1\% quoted in Section 4 pools them with the six CIFAR-10 architectures, whose per-model figures we omit for space. Table 4: Vision per-model calibration. Each architecture is fit its own logistic curve. Cells report the closed-form inverted σ and the measured top-1 accuracy, averaged over 64 noise realizations, per-entry std ≤0.5%≤0.5\%. (a) CIFAR-100 σ / measured top-1 (%) at target accuracy (%) Model Base 65 60 55 50 45 40 ResNet-20 66.7 0.70/64.8 1.44/59.6 1.99/54.7 2.50/49.8 3.01/45.1 3.55/40.2 ResNet-32 68.4 1.23/64.7 1.95/59.5 2.52/54.8 3.07/50.0 3.61/45.1 4.19/40.2 ResNet-44 68.7 1.38/64.6 2.13/59.7 2.74/54.9 3.30/50.0 3.88/45.3 4.48/40.4 ResNet-56 69.3 1.59/64.5 2.33/59.5 2.95/54.8 3.54/50.0 4.12/45.2 4.75/40.3 VGG-13 70.9 2.11/64.6 2.76/59.9 3.31/55.1 3.82/50.3 4.34/45.3 4.87/40.3 VGG-16 70.3 1.99/65.8 2.59/61.0 3.08/55.7 3.52/50.2 3.96/44.7 4.41/39.4 VGG-19 67.0 1.33/65.1 2.16/60.7 2.72/55.6 3.20/50.2 3.65/44.8 4.12/39.7 MobileNetV2 72.9 2.14/64.7 2.70/59.9 3.20/55.1 3.68/50.2 4.17/45.2 4.69/40.2 RepVGG-A0 73.0 2.37/64.6 2.99/59.9 3.55/55.2 4.08/50.3 4.63/45.3 5.21/40.2 RepVGG-A1 74.2 2.59/64.7 3.17/60.0 3.70/55.2 4.21/50.2 4.73/45.2 5.29/40.1 RepVGG-A2 75.2 2.61/64.8 3.14/60.1 3.63/55.2 4.11/50.3 4.59/45.3 5.11/40.1 (b) ImageNet-1K Model Base 70 60 50 40 30 20 ResNet-18 71.8 1.11/68.8 2.34/59.3 3.15/50.5 3.92/40.8 4.81/30.5 6.00/19.8 ResNet-50 80.9 2.89/70.0 3.66/60.2 4.32/50.1 5.00/40.1 5.80/29.9 6.89/19.9 VGG-16 72.2 0.80/69.7 2.03/59.4 2.98/49.9 3.98/40.4 5.21/30.5 6.94/20.1 MobileNetV3-L 75.8 1.31/68.5 1.85/60.4 2.27/51.0 2.68/40.7 3.15/29.9 3.77/19.5 EfficientNet-B0 78.3 1.49/69.0 1.96/60.7 2.35/51.0 2.73/40.5 3.18/29.9 3.78/19.6 DenseNet-121 76.2 1.22/68.1 1.76/59.9 2.18/51.0 2.60/40.9 3.09/30.3 3.75/19.6 ConvNeXt-T 84.5 1.90/71.0 2.23/60.5 2.53/49.9 2.83/39.6 3.18/29.6 3.67/20.1 ViT-B/16 85.7 1.88/71.2 2.19/60.7 2.47/49.9 2.76/39.4 3.11/29.6 3.58/20.0 References [1] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet (2018) Turning your weakness into a strength: watermarking deep neural networks by backdooring. In USENIX Security, Cited by: §6. [2] Anthropic (2026) Detecting and preventing distillation attacks. Note: https://w.anthropic.com/news/detecting-and-preventing-distillation-attacksNews post, February 2026 Cited by: §1. [3] N. Carlini, D. Paleka, K. D. Dvijotham, T. Steinke, J. Hayase, A. F. Cooper, K. Lee, M. Jagielski, M. Nasr, A. Conmy, et al. (2024) Stealing part of a production language model. In ICML, Cited by: §1, §6. [4] DeepSeek-AI, D. Guo, et al. (2025) DeepSeek-R1: incentivizing reasoning capability in LLMs via reinforcement learning. arXiv preprint arXiv:2501.12948. Cited by: §4.1. [5] J. Deng, W. Dong, R. Socher, L. Li, K. Li, and L. Fei-Fei (2009) ImageNet: a large-scale hierarchical image database. In CVPR, Cited by: §4.1. [6] J. Dubiński, S. Pawlak, F. Boenisch, T. Trzciński, and A. Dziedzic (2023) Bucks for buckets (B4B): active defenses against stealing encoders. In NeurIPS, Cited by: §6. [7] A. Dziedzic, M. A. Kaleem, Y. S. Lu, and N. Papernot (2022) Increasing the cost of model extraction with calibrated proof of work. In ICLR, Cited by: §6. [8] H. Fang, T. Zhang, T. Zhuang, J. Kong, K. Gao, B. Chen, L. Zheng, S. Xia, and K. Xu (2026) Towards distillation-resistant large language models: an information-theoretic perspective. arXiv preprint arXiv:2602.03396. Cited by: §6. [9] A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. (2024) The Llama 3 herd of models. arXiv preprint arXiv:2407.21783. Cited by: §1. [10] C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger (2017) On calibration of modern neural networks. In ICML, Cited by: §3.1. [11] K. He, X. Zhang, S. Ren, and J. Sun (2016) Deep residual learning for image recognition. In CVPR, Cited by: §4.1. [12] G. Hinton, O. Vinyals, and J. Dean (2015) Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531. Cited by: §1, §2.1, §2.1, §6. [13] E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, and W. Chen (2022) LoRA: low-rank adaptation of large language models. In ICLR, Cited by: §4.3. [14] M. Jagielski, N. Carlini, D. Berthelot, A. Kurakin, and N. Papernot (2020) High accuracy and high fidelity extraction of neural networks. In USENIX Security, Cited by: §6. [15] M. Juuti, S. Szyller, S. Marchal, and N. Asokan (2019) PRADA: protecting against DNN model stealing attacks. In IEEE EuroS&P, Cited by: §1, §2.1, §5, §6. [16] S. Kariyappa, A. Prakash, and M. K. Qureshi (2021) Protecting DNNs from theft using an ensemble of diverse models. In ICLR, Cited by: §1, §6. [17] S. Kariyappa and M. K. Qureshi (2020) Defending against model stealing attacks with adaptive misinformation. In CVPR, Cited by: §6. [18] M. Kesarwani, B. Mukhoty, V. Arya, and S. Mehta (2018) Model extraction warning in MLaaS paradigm. In ACSAC, Cited by: §1. [19] J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein (2023) A watermark for large language models. In ICML, Cited by: §6. [20] K. Krishna, G. S. Tomar, A. P. Parikh, N. Papernot, and M. Iyyer (2020) Thieves on Sesame Street! Model extraction of BERT-based APIs. In ICLR, Cited by: §1, §6. [21] A. Krizhevsky and G. Hinton (2009) Learning multiple layers of features from tiny images. Technical report University of Toronto. Cited by: §4.1. [22] B. Lakshminarayanan, A. Pritzel, and C. Blundell (2017) Simple and scalable predictive uncertainty estimation using deep ensembles. In NeurIPS, Cited by: §3.1. [23] T. Lee, B. Edwards, I. Molloy, and D. Su (2019) Defending against neural network model stealing attacks using deceptive perturbations. In IEEE S&P Workshops, Cited by: §1, §6. [24] P. Li, Z. Tan, M. Zhang, H. Qu, H. Liu, and T. Chen (2025) DOGe: defensive output generation for LLM protection against knowledge distillation. arXiv preprint arXiv:2505.19504. Cited by: §6. [25] S. Liu, Z. Wang, M. Xue, L. Wang, Y. Zhang, and G. Bai (2024) Being transparent is merely the beginning: enforcing purpose limitation with polynomial approximation. In USENIX Security, Cited by: §6. [26] H. Ma, T. Chen, T. Hu, C. You, X. Xie, and Z. Wang (2021) Undistillable: making a nasty teacher that CANNOT teach students. In ICLR, Cited by: §6. [27] M. Ma, S. Liu, V. Vo, M. Fang, S. Nepal, and G. Bai (2026) ClieND: client-side neuron-level detection against poisoning attacks on cross-silo federated learning. In ASIA CCS, p. 1108–1124. External Links: Document Cited by: §5. [28] Z. Ma, Z. Wang, and G. Bai (2025) Convex hull approximation for activation functions. Proc. ACM Program. Lang. 9 (OOPSLA2). External Links: Document Cited by: §5. [29] P. Maini, M. Yaghini, and N. Papernot (2021) Dataset inference: ownership resolution in machine learning. In ICLR, Cited by: §6. [30] M. Mazeika, B. Li, and D. Forsyth (2022) How to steer your adversary: targeted and efficient model stealing defenses with gradient redirection. In ICML, Cited by: §6. [31] A. Niculescu-Mizil and R. Caruana (2005) Predicting good probabilities with supervised learning. In ICML, Cited by: §3.1. [32] T. Orekondy, B. Schiele, and M. Fritz (2019) Knockoff Nets: stealing functionality of black-box models. In CVPR, Cited by: §1, §2.1, §5, §6. [33] T. Orekondy, B. Schiele, and M. Fritz (2020) Prediction poisoning: towards defenses against DNN model stealing attacks. In ICLR, Cited by: §1, §6. [34] S. Pal, Y. Gupta, A. Shukla, A. Kanade, S. Shevade, and V. Ganapathy (2020) ActiveThief: model extraction using active learning and unannotated public data. In AAAI, Vol. 34. Cited by: §5. [35] L. Pan, A. Liu, S. Huang, Y. Lu, X. Hu, L. Wen, I. King, and P. S. Yu (2025) Can LLM watermarks robustly prevent unauthorized knowledge distillation?. In ACL, Cited by: §6. [36] J. Platt et al. (1999) Probabilistic outputs for support vector machines and comparisons to regularized likelihood methods. In Advances in Large Margin Classifiers, Cited by: §3.1. [37] R. Ren, C. Yan, N. Dong, and G. Bai (2026) Evolution but still exposed: an empirical study of residual APIs in the ChatGPT plugin ecosystem. In FSE Companion, p. 1593–1598. External Links: Document Cited by: §5. [38] M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L. Chen (2018) MobileNetV2: inverted residuals and linear bottlenecks. In CVPR, Cited by: §3.2. [39] Y. Savani, A. Trockman, Z. Feng, Y. E. Xu, A. Schwarzschild, A. Robey, M. Finzi, and J. Z. Kolter (2025) Antidistillation sampling. In NeurIPS, Cited by: §6. [40] K. Simonyan and A. Zisserman (2015) Very deep convolutional networks for large-scale image recognition. In ICLR, Cited by: §4.1. [41] F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart (2016) Stealing machine learning models via prediction APIs. In USENIX Security, Cited by: §1, §6. [42] J. Truong, P. Maini, R. J. Walls, and N. Papernot (2021) Data-free model extraction. In CVPR, Cited by: §6. [43] P. Wang, S. Bai, S. Tan, S. Wang, Z. Fan, J. Bai, K. Chen, X. Liu, J. Wang, W. Ge, et al. (2024) Qwen2-VL: enhancing vision-language model’s perception of the world at any resolution. arXiv preprint arXiv:2409.12191. Cited by: §4.1. [44] Z. Wang, Z. Ma, Z. Ma, S. Liu, A. Liu, D. Wang, M. Xue, and G. Bai (2025) Catch-only-one: non-transferable examples for model-specific authorization. arXiv preprint arXiv:2510.10982. Cited by: §6. [45] Z. Wang, Z. Ma, X. Feng, Z. Mei, Z. Ma, D. Wang, M. Xue, and G. Bai (2025) AI model modulation with logits redistribution. In W, External Links: Document Cited by: §3.1, §3, §6. [46] Z. Wang, Z. Ma, X. Feng, C. Yan, D. Liu, R. Sun, D. Wang, M. Xue, and G. Bai (2026) Re-key-free, risky-free: adaptable model usage control. arXiv preprint arXiv:2511.18772. Cited by: §6. [47] Z. Zhang, Y. Chen, and D. Wagner (2021) SEAT: similarity encoder by adversarial training for detecting model extraction attack queries. In ACM AISec, Cited by: §1, §6.