Secure Model Deployment for AI/LLM

Model Extraction Defense

// Model Extraction Defense Implementation
class ModelExtractionDefense {
  constructor(model, config) {
    this.model = model;
    this.config = config;
    this.queryHistory = new Map();
    this.suspiciousPatterns = new Set();
  }

  async protectedInference(request, userId) {
    // 1. Rate limiting per user
    if (!this.checkRateLimit(userId)) {
      throw new Error('Rate limit exceeded');
    }

    // 2. Query pattern analysis
    const queryFingerprint = this.generateQueryFingerprint(request);
    this.recordQuery(userId, queryFingerprint);

    // 3. Detect extraction attempts
    if (this.detectExtractionPattern(userId)) {
      await this.handleSuspiciousActivity(userId);
      throw new Error('Suspicious activity detected');
    }

    // 4. Input perturbation
    const perturbedInput = this.perturbInput(request.input);

    // 5. Model inference with protection
    let output = await this.model.predict(perturbedInput);

    // 6. Output obfuscation
    output = this.obfuscateOutput(output);

    // 7. Watermark injection
    output = this.injectWatermark(output, userId);

    // 8. Log for audit
    await this.logInference({
      userId,
      timestamp: Date.now(),
      inputHash: this.hashInput(request.input),
      outputHash: this.hashOutput(output),
      protectionsApplied: ['rate_limit', 'perturbation', 'obfuscation', 'watermark']
    });

    return output;
  }

  checkRateLimit(userId) {
    const userQueries = this.queryHistory.get(userId) || [];
    const recentQueries = userQueries.filter(
      q => Date.now() - q.timestamp < this.config.rateLimitWindow
    );

    return recentQueries.length < this.config.maxQueriesPerWindow;
  }

  detectExtractionPattern(userId) {
    const userQueries = this.queryHistory.get(userId) || [];
    
    // Check for systematic querying patterns
    const patterns = {
      gridSearch: this.detectGridSearch(userQueries),
      boundaryProbing: this.detectBoundaryProbing(userQueries),
      highFrequency: userQueries.length > this.config.suspiciousThreshold,
      lowEntropy: this.calculateQueryEntropy(userQueries) < this.config.entropyThreshold
    };

    return Object.values(patterns).some(detected => detected);
  }

  perturbInput(input) {
    // Add controlled noise to prevent exact extraction
    const noise = this.generateNoise(input, this.config.noiseLevel);
    return this.addNoise(input, noise);
  }

  obfuscateOutput(output) {
    // Round confidence scores
    if (output.confidences) {
      output.confidences = output.confidences.map(
        c => Math.round(c * 100) / 100
      );
    }

    // Limit precision of numerical outputs
    if (output.embeddings) {
      output.embeddings = output.embeddings.map(
        e => Math.round(e * 10000) / 10000
      );
    }

    // Add random delay to timing attacks
    const delay = Math.random() * this.config.maxDelayMs;
    return new Promise(resolve => 
      setTimeout(() => resolve(output), delay)
    );
  }

  injectWatermark(output, userId) {
    // Embed traceable watermark in model outputs
    const watermark = this.generateWatermark(userId, Date.now());
    
    if (output.embeddings) {
      // LSB watermarking for embeddings
      output.embeddings = this.embedWatermarkInEmbeddings(
        output.embeddings,
        watermark
      );
    }

    if (output.text) {
      // Linguistic watermarking for text
      output.text = this.embedWatermarkInText(output.text, watermark);
    }

    return output;
  }

  async handleSuspiciousActivity(userId) {
    // Log security event
    await this.securityLogger.log({
      event: 'MODEL_EXTRACTION_ATTEMPT',
      userId,
      timestamp: Date.now(),
      evidence: this.gatherEvidence(userId)
    });

    // Notify security team
    await this.alerting.send({
      severity: 'high',
      message: `Potential model extraction attempt by user ${userId}`
    });

    // Apply temporary restrictions
    this.applyRestrictions(userId);
  }
}