Benchmarks test defenses against attacks stealing language models
Do Defenses Against LLM Extraction Work Across Attacks? A Lifecycle Benchmark of Black-Box Model Extraction
Cryptography and Security
Summary
Big language models that answer questions online can be copied by attackers who collect lots of their answers. The authors built a thorough test setup to see how well different protection methods work against several ways to copy these models. They also tried smart tricks that change answers before copying to see if protections still help. This benchmark lets people fairly compare attacks and defenses on the same terms, helping to find the best ways to guard language models shared through text-only APIs.
What this means in practice
- •For ai security teams: Evaluate and compare multiple methods to protect deployed language models from extraction attacks under consistent conditions.
- •For api platform developers: Integrate tested defense techniques into APIs to reduce the risk of model theft via repeated querying by attackers.
Authors
Shuze Liu, Kaixiang Zhao, Runyang Xu, Jingzhi Chen, Nathan Wu, Yu Wang, Yushun Dong
Abstract
Large language models (LLMs) deployed through text-only APIs face model extraction risks, as adversaries can collect their responses to train surrogates that reproduce their capabilities. While prior work has developed diverse attacks and defenses, evaluations remain fragmented across access assumptions, model configurations, query budgets, and security objectives, limiting comparability across methods. To address this gap, we introduce a unified benchmark covering six extraction attacks, ten defenses, and two adaptive attacks that paraphrase or back-translate protected responses before surrogate training. The benchmark controls model configurations, query data, budgets, and held-out evaluation conditions within each comparison while preserving attack-specific querying and training procedures. We measure surrogate capability, fidelity to the victim, output quality using Rep-4, and query-budget sensitivity; defenses use their own security metrics paired with surrogate performance. For the adaptive attacks, we jointly measure provenance-detector scores and the capability and fidelity of surrogates trained on rewritten responses. The benchmark thus provides a reproducible basis for comparing extraction methods and their interactions with defenses under text-only access. Code and artifacts are available at https://github.com/sliu11-byte/MEA-Bench.