Model Extraction / Distillation Attack via Systematic API Probing - ATR-2026-00517 (58c3d71c-cfec-5f01-92ae-f24b8bb9aa53)
Detects systematic attempts to extract a model's behavior by generating bulk synthetic training data or fine-tuning pairs, intended to create a functional equivalent (model distillation attack). OWASP LLM10:2025 Unbounded Consumption. MITRE ATLAS AML.CS0056 (Model Distillation Campaigns Targeting Anthropic Claude). Pattern: bulk synthetic data generation framing (200+, 500+, 1000+ examples) combined with explicit training/fine- tuning intent, model replication framing, chain-of-thought extraction at scale, or safety response enumeration for distillation. Distinguishes from legitimate small example requests (<20) or general research assistance.