Capability Theft Through Query Distillation
查詢蒸餾竊取能力
Operation & Monitoring
Risk Description
When an organization notices an account making sustained high-frequency queries with an unusually broad distribution of content; due to unmitigated control gaps, investigation suggests systematic harvesting, but because all queries constitute legitimate paid usage, the organization has difficulty blocking the activity or substantiating a claim, triggering compliance exposure and operational reputational costs.
Framework Mappings
OWASP Top 10 for LLMLLM10
MITRE ATLASAML.T0024
NIST AI 100-2Privacy—Model Extraction
ISO/IEC 5338運作與監控
MIT AI Risk RepositoryDomain 6
Risk Treatment & Implementation Guidance
Apply tiered rate limits and usage quotas to suppress sustained high-frequency harvesting; Detect distributional anomalies identifying systematic coverage-seeking queries; Prohibit distillation use in contracts and terms, terminating and pursuing violators