How to meet it
OWASP AISVS v1.01
Adversarial Robustness · Model-Extraction Defense
Detect extraction from query patterns
Verify that query-pattern analysis feeds an extraction-attempt detector.
OWASP AISVS v1.01, requirement 11.3.1
In plain English
Analyse query patterns to spot attempts to copy the model through its API, and feed that into a detector.
What good looks like
- Query patterns are analysed per caller.
- Signs of extraction, such as systematic coverage of the input space, raise alerts.
- Detection results are reviewed.
How teams usually do it
- Monitoring query diversity, volume and similarity over time per caller.
Evidence an auditor would accept
- Detector rules and sample alerts.
Common mistakes
- Looking only at volume, while slow, wide-ranging queries go unnoticed.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.