None of what happened in 2026 was technically novel. The security literature described model extraction years before anyone thought it was worth a sanctions discussion, and the findings have held up well.
The founding result
Work published in 2016 demonstrated that machine learning models exposed through prediction APIs could be extracted by querying them systematically and training a local model on the responses. It applied across model families, and crucially it showed that a model exposed for use is inherently exposed for copying.
The core insight has not been overturned since: a model that answers questions reveals itself through its answers. Every defence proposed in the decade following has tried to reduce how much, without ever eliminating it, because the thing being leaked is the thing the service exists to provide.
What the research established
- Extraction fidelity rises with query budget. More queries, closer copy. The relationship is smooth, so there is no threshold below which a service is safe and above which it is not.
- Targeted queries beat random ones. Probing near decision boundaries is far more efficient than sampling the input space uniformly, which is why traffic shape is more diagnostic than traffic volume.
- Confidence scores accelerate everything. Returning probabilities rather than labels dramatically reduces the queries needed. This is the direct ancestor of modern logprob restrictions.
- Defences trade utility for protection. Every mitigation degrades the service for legitimate users, in proportion to how much it protects.
Extraction and distillation are the same procedure
This is worth stating plainly, because the vocabulary carries a great deal of argumentative weight.
Distillation is the neutral term, used freely when compressing your own model. Extraction is the adversarial term, implying a target that did not consent. The procedure is identical: query, collect, train.
Which word gets used is determined entirely by the relationship between the parties, which is why the 2026 disputes were so linguistically loaded. The same activity is a published technique or an attack depending on who is describing it.
Why it stopped being academic
Three things changed, none of them technical.
The models became worth extracting: a frontier model represents an enormous capital investment in a way that a 2016 classifier did not. The interfaces became universal, so extraction requires only an account. And the outputs became rich, in that a paragraph of generated text carries far more trainable signal than a class label.
The technique stayed the same. The stakes moved several orders of magnitude, which is how a topic from a security conference ended up in a White House statement.
What the literature says about defending
The uncomfortable conclusion, consistent across a decade of work, is that extraction cannot be prevented, only made expensive. Rate limiting, output restriction, watermarking and anomaly detection all raise cost. None closes the channel, because the channel is the product.
The practical record bears this out: see the 2026 countermeasure timeline.
Common questions
What is a model extraction attack?
A model extraction attack queries a machine learning system through its public interface and uses the responses to build a local copy that approximates its behaviour. The academic literature dates to at least 2016, well before large language models made it commercially significant.
Is model extraction the same as distillation?
The mechanics are the same. The framing differs. Distillation describes the technique neutrally, including when applied to your own model. Extraction describes it as an attack, implying an unwilling target. Nothing in the procedure distinguishes them.