During an authorized assessment, testers use a capped query budget to see whether a permitting LLM can be closely approximated. What risk class are they evaluating?

Testers who use a capped query budget to see whether a permitting LLM can be closely approximated are evaluating query-based model extraction under rate-limited civic API access. Extraction risk asks whether an adversary (or authorized assessor) can recover enough input–output behavior to train a surrogate that mimics the municipal model’s decisions. Quotas and budgets in the test design reflect real civic API constraints and measure how much fidelity is obtainable within those limits.

Membership inference on permit histories using confidence outputs, prompt injection via variance narratives evading policy screening, and backdoor poisoning through crafted code interpretations in training are unrelated attack classes. They do not characterize the risk class under test, nor do they measure behavioral leakage through the API. These methods are irrelevant to extraction methodology and defensive design.

Exam caveat: capped-budget extraction tests evaluate approximability risk; they are not theft of proprietary weights unless unauthorized exfiltration occurs. Distinguish extraction from membership inference and from prompt-injection jailbreaks—related but different attack classes. Backdoor poisoning through crafted code interpretations in training is a supply-chain threat, not an API extraction risk.

Operational check: for permitting APIs, baseline normal clerk and resident query patterns, enforce per-client quotas, monitor systematic boundary-mapping traffic, and minimize high-fidelity outputs that accelerate surrogate training.