If you serve your own model through an API, reduce what each response reveals and how much any caller can do. OWASP recommends restricting logit bias and logprobs, rate limiting, quotas, input size limits, sandboxing, monitoring and access control. These make extraction slower and noisier, though they do not make it impossible.
What extraction means
OWASP's Unbounded Consumption page describes three related abuses of a model API:
- Model extraction. Crafted inputs and prompt injection are used to collect outputs that help replicate a partial or shadow model.
- Functional replication. The target model generates synthetic training data that is used to fine tune another model into a functional equivalent.
- Side channels. Input filtering is exploited to harvest information about weights and architecture.
If your model is a core asset, treat this as intellectual property protection as well as a cost issue.
Settings and controls
- Restrict output detail. OWASP advises restricting or obscuring logit bias and logprobs in API responses. Probabilities leak more about the model than text does.
- Limit input size and validate inputs.
- Rate limit and set user quotas. Include per key and per tenant ceilings.
- Throttle and set timeouts on expensive requests.
- Authenticate and apply least privilege. OWASP mentions strong access controls such as RBAC and a centralised model inventory.
- Monitor. Log usage and look for patterns, such as a single key sending broad, systematic queries.
- Consider watermarking to help detect unauthorised use of outputs, as OWASP lists.
- Sandbox the model's network and internal access.
What to watch in logs
Extraction tends to look different from normal use: very high volume, wide coverage of topics, templated prompts with small changes, and near constant usage. Alert on those shapes per key.
Be honest about residual risk
A determined attacker with a paid account can collect a lot of outputs slowly. Your goal is to raise the cost, notice it, and have contract terms and revocation ready. Terms of service and access control matter as much as technical settings.
For consumers of third party models, most of this list belongs to your provider. Ask what they limit and log.
Safeguard's policies and monitoring cover your software and agent estate, but model serving controls belong in your own API layer.
Contract and policy layer. Technical limits work better with terms that prohibit using outputs to train competing models, and with the ability to revoke keys quickly. Know which customers use the API at scale and keep contact details current, so unusual volume can be discussed rather than only blocked. Some heavy use is legitimate, and a conversation avoids punishing a good customer.
Keep the settings under review. New API parameters appear over time, and each one that returns extra detail about the model is worth a look against this list.
Quick check
Why hide logprobs?
OWASP lists restricting logit bias and logprobs because they expose more of the model's behaviour than plain text output.
Sources
Last reviewed: 19 October 2026.
