After extraction attempts on a city model API, which compensating controls best reduce further theft risk?

After extraction attempts on a city model API, scoping API keys to least privilege and applying aggressive rate limits on model endpoints is the best compensating control set because it constrains how fast and how broadly an adversary can query the served model. Extraction thrives on unrestricted, high-throughput access; throttling and key hygiene raise cost, improve detection, and limit blast radius without requiring an immediate full model redesign. Municipal SecOps should treat model endpoints like other high-value APIs: authenticated, scoped, monitored, and rate-limited.

Sanitizing training data for PII and applying adversarial training to hosted models fails as an extraction compensating control because it targets training-time privacy and evasion robustness rather than post-deployment query abuse and does nothing to constrain query rate, scope, or volume. Enforcing TLS encryption for API traffic and at-rest encryption for stored artifacts fails as a theft compensating control because it protects data in transit and at rest but does nothing to slow an authenticated adversary querying the model endpoint repeatedly to extract it. Centralizing query logging for audits and deploying generic WAF rules at the API edge fails as a primary compensating control because logging is detective rather than preventive and generic WAF rules do not specifically throttle or block the high-volume model queries that drive extraction.

Exam caveat: rate limits alone do not stop a patient, distributed extraction using many identities; pair throttling with identity proofing, anomaly detection, and contractual acceptable-use enforcement. Operational check: rotate exposed keys, enforce per-key and per-org quotas with burst controls, deny anonymous model calls, review logs for pre-incident probe patterns, and document residual risk if the model must remain externally reachable for civic services.