Stealing Part of a Production Language Model

Our summary

The first precise model-extraction attack on deployed LLMs: from ordinary black-box API access it recovers the final embedding projection layer and the hidden dimension of production models, extracting them from OpenAI's Ada and Babbage for under $20 (with OpenAI's approval and subsequent mitigation).

Why it matters

Establishes that a deployed model's API is itself a leak surface for proprietary internals — the exact confidentiality risk model-extraction probing is meant to quantify.

Cited by these methods

Related findings (1)

• Production model internals extracted through the APIHigh

  With ordinary black-box API access, researchers recovered the embedding projection layer and hidden dimension of production models for under $20 — the first precise model-stealing attack on deployed LLMs.

Cite this