MR-016 Security & adversarial System scope

Model theft, extraction and weight leakage

Model weights or behavior are stolen via extraction attacks or leaked, causing IP loss and loss of control over the model.

Risk family: Security & adversarial
MIT domain: 2. Privacy & Security
MIT subdomain: 2.2 > AI system security vulnerabilities and attacks
AI type: GPAI, Classical_ML
Scope: System
Source standard: MIT AI Risk Repository v4

Provenance

Source standard

MIT AI Risk Repository v4

MIT source entries

12 entries across 7 papers

Cui2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems02.10.00 02.10.01
Gabriel2024The Ethics of Advanced AI Assistants24.03.08 24.08.02
Gipiškis2024Risk Sources and Risk Management Measures in Support of Standards for General-Purpose AI Systems62.28.04
IBM2025AI Risk Atlas65.09.02
Marchal2024Generative AI Misuse: A Taxonomy of Tactics and Insights from Real-World Data64.04.04 64.04.05 64.05.02
Sherman2023AI Risk Profiles: A Standards Proposal for Pre-Deployment AI Risk Disclosures12.09.00
Wang2025A Survey on Responsible LLMs: Inherent Risk, Malicious Use, and Mitigation Strategy74.01.02 74.01.05

Ev IDs of the entries consolidated into this risk in the MIT AI Risk Repository (V4); the source sheet row appears on hover.

ISO/IEC references

23894 obj A.11; src 7, 9; mech B.6 | 42001 ctrl A.4.5

Framework crosswalk

Every framework item mapped to this risk. Items marked partial overlap only in part; definitions appear on hover where the source licence permits.

Sourcesframeworks that contributed to the register

A.11 ISO/IEC 23894 Annex A A.11

A.4.5 ISO/IEC 42001 Annex A A.4.5

Expanded into this risk’s technique sub-risks.

Cross-checksframeworks mapped in to test coverage

ibm-extraction-attack Extraction attack

AISubtech-10.1.1 API Query Stealing
AISubtech-10.1.2 Weight Reconstruction
AISubtech-10.1.3 Sensitive Data Reconstruction

NISTAML.03 Privacy Compromises
NISTAML.031 Model Extraction

LLM10:2025 Unbounded Consumption

Sub-risks (3)

Technique-level decompositions of this risk, each anchored to the MITRE ATLAS technique it derives from.

MR-016.1

Model or data extraction via the inference API

Repeated API queries are used to reconstruct the model or recover its training data.

MITRE ATLAS technique: AML.T0024 Exfiltration via AI Inference API

MR-016.2

Collection of AI artifacts for exfiltration

Models, weights, and related artifacts are gathered on the victim system in preparation for theft.

MITRE ATLAS technique: AML.T0035 AI Artifact Collection

MR-016.3

White-box model access enabling theft

Adversaries obtain full access to model weights and architecture, enabling theft and tailored attacks.

MITRE ATLAS technique: AML.T0044 Full AI Model Access

More in Security & adversarial

MR-010 MR-012 MR-014 MR-015 MR-020 MR-071

See all Security & adversarial risks →

Part of the Deployer AI Risk Register, an open-source resource powered by MindXO. Version 1.0, 3 July 2026. Derived from the MIT AI Risk Repository (V4, December 2025) under CC BY 4.0; an independent derivative work, not endorsed by or affiliated with MIT. Sub-risk decomposition references MITRE ATLAS™ v5.6.0 (© 2021-2026 The MITRE Corporation, reproduced and distributed with permission). ISO/IEC and EU AI Act references are by number only. License: CC BY 4.0. Full attribution and licensing.