---
title: 'If your model has a public API, it can be stolen'
description: 'Publicly exposed AI features can be used to extract models and run free inference, with implications for model theft and systematic API abuse.'
date: '2025-11-14'
category: technical
cover: /covers/if-your-model-has-a-public-api-it-can-be-stolen.jpg
tags: ['security', 'ai', 'api', 'llm']
published: true
---

Every day, millions of people upload photos to Facebook, and alternative descriptions are automatically generated: "two men in a restaurant", "woman with dog in a park." Automatic Alt Text has existed since 2017, designed for blind users. But it can be exploited in a completely different way.

An e-commerce store owner needs descriptions for a hundred thousand product photos. They could pay an external service, hire people, or just exploit Facebook - upload photos as unpublished posts, extract the generated descriptions, delete the posts without a trace. Facebook's computer vision model, which cost millions to develop, now works for free for someone else's business. And technically, no rules are being broken.

## Model extraction through a public endpoint

The same logic applies to any exposed inference endpoint. Say you spent three months building a message classifier - detecting whether a user is trying to move a conversation off-platform. 95% accuracy, tuned through many iterations. You expose a simple endpoint: text in, true/false out.

Someone writes a script, sends tens of thousands of varied inputs, records the responses. After a few days they have 50k labeled pairs - enough to train a functionally identical model. Cost: a few dozen dollars for cloud GPU time. Your cost: months of work and thousands in compute. In your server logs, you see nothing but regular HTTP requests.

## Free inference via LM Arena

LM Arena lets you compare language models through a public interface - and underneath, there's an endpoint that can be queried programmatically. Instead of paying for API access, you route requests through LM Arena with a basic proxy to bypass rate limits. Some people build entire commercial products this way, saving thousands monthly. The platform runs on research grants, presumably not intended for this use case.

## Why these attacks work

The pattern is consistent across all three cases. First, the traffic is indistinguishable from normal usage at low volumes - only statistical analysis of request patterns reveals anything. Second, the cost asymmetry is extreme: copying an API-exposed model takes hours of scripting, while building the original took months of engineering. Third, the legal situation is genuinely unclear - querying a public API according to its documentation is hard to litigate, even if the intent is systematic model extraction.

## The broader point

Automatic Alt Text wasn't designed to be a free image captioning API. LM Arena wasn't meant to power commercial chatbots. Every publicly exposed AI feature is also a potential free R&D resource for anyone with the right tools and enough patience.

This is a distinct threat category - not exploitation of vulnerabilities in the traditional sense, but systematic use of what's been made legally available, contrary to its intended purpose. The interface simplicity that makes a feature easy to integrate is the same property that makes it easy to automate at scale.