Abstract
Frontier AI models are worth billions to build, yet they can be copied without stealing a single weight file. An attacker who can repeatedly obtain rich outputs — full probability distributions (logits, log-probabilities), embeddings, hidden states or diagnostic traces — can collect a training set that makes model extraction and distillation far cheaper and more accurate. Today's defences do not stop this at the right moment. API keys and OAuth confirm who is asking; remote attestation and confidential GPUs confirm the machine is trustworthy; rate limits, monitoring, watermarking and inference receipts count or record what has already left. None of them is an enforced gate that decides whether this specific output may leave now. Software counters can be reset by restoring a virtual-machine snapshot, replayed, raced by parallel requests, or bypassed through DMA, peer-GPU, debug or telemetry paths. This paper describes a release-control architecture built on one rule: computation is not authority to release. Every high-value output is held as a candidate release inside the protected GPU or trusted execution environment until a release gate at the exit point verifies release class, requester, destination, security epoch and a rollback-resistant extraction counter, and atomically consumes authority bound to that one output. If any check fails, nothing leaves — even though the model computed the answer. The design covers snapshot rollback, replay, concurrent races, mislabelling by compromised serving code, and alternate egress paths; separates a slow attestation path from a fast local release path so ordinary chat traffic pays nothing extra; and lets remote parties verify, through RATS attestation, that the gate is actually running. It does not claim to stop distillation from ordinary, deliberately released answers, nor attacks by insiders who control the enforcement hardware. Frontier providers such as OpenAI and Anthropic are referenced only as recognisable examples. A runnable reference implementation is publicly available. The author is open to acquihire or strategic collaboration.
Moare details: https://datatracker.ietf.org/doc/draft-das-rats-openai-anthropic-extraction/
Keywords:
model extraction, model distillation, model theft, AI intellectual property, frontier AI security, logits, log-probabilities, embeddings, egress control, data loss prevention, remote attestation, RATS, Entity Attestation Token, confidential computing, confidential GPU, trusted execution environment, anti-rollback, monotonic counter, replay protection, policy enforcement point, fail-closed
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Recommended Citation
Das, Sangam Kumar, "Attested, Authenticated — and Still Being Distilled: A Release Gate That Stops Frontier-Model Extraction After Every Other Check Has Passed", Technical Disclosure Commons, (November 05, 2026)
https://www.tdcommons.org/dpubs_series/12748