AI Control Library / CF-13: Model & Adversarial Security
Designation: Core | Control types represented: Operational and Technical
Control requirement
Protect model weights, artifacts and interfaces against unauthorized copying and extraction. Monitor attempts to reconstruct model behavior through queries while keeping legitimate use practical.
Why this matters
Theft may involve direct access to weights or systematic imitation through an exposed interface. Protecting only the artifact repository leaves query-based extraction and leaked checkpoints unaddressed.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Apply to proprietary, sensitive or restricted models and to services whose outputs expose valuable functionality. Include backups, registries and developer environments.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The model owner classifies assets; platform teams protect storage and endpoints; security investigates suspicious access.
Implementation guidance
- Inventory model artifacts, copies and authorized distribution paths.
- Restrict download and administrative access with accountable identities.
- Apply query limits and monitor extraction-like patterns across related accounts.
- Test artifact access and evaluate interface exposure against realistic extraction scenarios.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Unauthorized weight download | Access is denied and recorded. |
| Coordinated high-volume probing | Detection or limits trigger investigation. |
| Approved artifact transfer | Recipient and integrity are verified. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Artifact inventory
- Access reviews
- Query-abuse records
- Extraction evaluations
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Revoke suspect access, preserve evidence and assess whether model replacement or distribution restrictions are necessary.
Example in practice
Hypothetical example: A commercial prediction service detects coordinated accounts covering a systematic input grid. Analysts investigate the pattern and constrain the accounts while preserving customer access.
Related controls
- CF13-009: Model Inference API Abuse Detection
- CF12-002: AI System Least Privilege Access Control
- CF13-011: Model Supply Chain Tampering Defense
Framework mappings
- NIST AI RMF (MEASURE 2.5)
- MITRE ATLAS
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Model & Adversarial Security
Version 1.0