Caliber Defense Protects AI Models from Extraction Attacks.

A new defense mechanism, named Caliber, has been introduced to protect AI models accessible via score-returning APIs from model extraction attacks. These attacks involve an adversary querying a target model to create a surrogate model that mimics its behavior. Caliber counters this by strategically adding independent and identically distributed Gaussian noise to the model's internal logits before returning scores. This perturbation aims to degrade the quality of the supervision signal an attacker can use for knowledge distillation. The core innovation of Caliber lies in its ability to formulate noise selection as a calibration problem, balancing the degradation of the surrogate's training signal with the provable per-input query cost required for an attacker to recover the original, clean logits. The research establishes two key properties: a monotone degradation of agreement with clean predictions as noise increases, and a closed-form minimax lower bound on the queries needed for recovery. By normalizing noise variance and fitting a logistic curve, Caliber effectively controls the noise-utility relationship, demonstrating strong performance across various models and datasets while making extraction significantly more expensive for attackers.