Repeated structured queries against a city API suggest an attempt to exfiltrate or approximate a fine-tuned municipal model. What should analysts flag?

Flagging repeated structured queries against a city API that appear to approximate a fine-tuned municipal model as model theft or extraction probing is correct because systematic querying can reconstruct behavior or distill a surrogate of a served model. Fine-tuned civic models often embed proprietary processes, local policy logic, and non-public training investment; extraction erodes that advantage and can enable offline abuse. Analysts should treat patterned, high-volume, structured probes as hostile reconnaissance against the model service itself.

Prompt injection probing via crafted inputs to override served model instructions fails because that pattern targets the model's instruction-following behavior through adversarial wording, not a systematic sweep built to reconstruct the model's outputs across its input space. Membership inference probing via repeated queries to identify training data members fails because that attack targets training-data confidentiality for particular records, not a broad extraction sweep aimed at cloning the model's overall behavior. Model inversion probing via iterative queries to reconstruct training data from outputs fails because that attack aims to recover sensitive training features from model outputs, not to clone overall model behavior through systematic approximation described in the stem.

Exam caveat: legitimate batch research, red-team evaluations, and model inversion probing can resemble extraction; intent, authorization, and whether queries aim to clone behavior versus recover training data distinguish monitoring from criminalization of normal API use. Operational check: baseline query diversity and rate per API key, alert on high-entropy structured probe patterns, bind keys to least privilege and short TTL, and require watermarking or canary outputs where policy allows so stolen surrogates can be attributed.