Talk and live demonstration at the 2026 AI Security Forum (Las Vegas).
Abstract:
Suppose you own model weights worth protecting, as valuable intellectual property and because an unguarded model can be misused. To serve the model you must load those weights onto a server, and anyone who compromises that server, whether it’s rented, a partner’s, or your own, can exfiltrate them. The usual protections limit network egress from the serving environment, so an operator can’t just push the weights out over the network. But one path stays open by design, because it’s the product you’re selling: the stream of output tokens. We ask how fast an attacker can leak the weights through that stream once the server is compromised, and whether that adds up to years or something far shorter. Conventional controls assume exfiltration means a large file crossing the network, and defend for that. This attack looks nothing like it. A compromised server still returns fluent, correct answers, but instead of sampling the next token from the model’s allowed choices, it quietly picks among near-equivalent tokens in a way that the choice itself encodes hidden bits. A client the attacker controls or colludes with sends ordinary queries, reads the replies, and decodes those bits until enough of the weights have leaked to rebuild and run the model elsewhere. Nothing in the traffic looks wrong: the queries are normal, and only the token choice carries the payload. The defense we propose is a live statistical monitor. Because you hold a trusted copy of the weights, you can calibrate it against the model’s honest behavior and run anytime-valid tests, which watch the output stream continuously and hold a fixed false alarm rate. How much an attacker can actually move against this monitor depends on what they know and how patient they are. A pure throughput-maximizer is flagged almost immediately. A full-knowledge attacker is the worst case, able to evade indefinitely but only by throttling to a low residual rate, which the monitor bounds at the chosen false alarm threshold.. A realistic partial-knowledge attacker evades better than the naive one, yet without knowing the exact decision threshold it can’t reach that worst-case rate without risking detection.
The talk includes a live demonstration, running attack and the monitor side by side to show, in real time, how many bits per token leak and how far the defense limits it.