A company exposes its proprietary pricing model through a public inference API. Monitoring shows one client account sending millions of systematically varied queries and storing every response. Which threat does this pattern most indicate, and which control most directly reduces it?

Model extraction, sometimes called model stealing, uses large numbers of crafted queries and the resulting outputs to train a substitute model that approximates the target's behavior, undermining the owner's intellectual property and enabling further attacks offline. The systematic variation of inputs and wholesale recording of responses are the signature. Per-client rate limits and quotas raise the cost of collecting enough samples, and monitoring for unusual query volume and input coverage lets the team detect and suspend the account; returning less detailed outputs further reduces what each query reveals. Membership inference also uses queries, but its goal is to learn whether specific records were in the training data, which does not match an attacker trying to map the whole input space. Data poisoning targets training data, and inference queries do not change a deployed model unless it learns online; schema checks on queries would not stop extraction anyway. Treating the pattern as a capacity problem and autoscaling would keep the API responsive while giving the attacker every answer faster. Exam caveat: extraction threatens confidentiality of the model, while inference attacks threaten privacy of the training data. Operational check: review per-account query volumes and alert on clients whose request patterns cover the input space systematically.