Q: What is a distillation or model extraction attack? A: Distillation attacks are repeated questions designed to get a chatbot to reveal its inner workings, and Google describes this activity as model extraction in which would-be copycats probe a system for the patterns and logic that make it work. Google reported a single campaign that prompted Gemini more than 100,000 times, showing attackers use scale and automation to copy models. Q: What are the five core steps that show how to protect LLMs from model extraction attacks? A: The article lists five steps that show how to protect LLMs from model extraction attacks: detect and throttle abnormal prompting, authenticate and fingerprint clients and segment access, harden prompts and outputs, watermark and seed canaries and monitor for reuse, and architect for resilience and least privilege. Together these measures cut risk from large-scale probing and help keep proprietary model logic safer. Q: How can teams detect and throttle suspicious prompting without breaking legitimate user experience? A: Teams should track anomalies like high-volume bursts, repeated parameter sweeps, near-duplicate prompts, and very long back-and-forth chains while scoring sessions on risk signals such as IP reputation and tool use. Apply adaptive rate limits and start with soft blocks like cooldowns or extra verification before escalating to hard blocks to preserve legitimate users. Q: What authentication and segmentation practices help reduce extraction risk? A: Require strong authentication such as rotated API keys, OAuth for apps, and mTLS for enterprise, and fingerprint clients by IP, ASN, and device traits while watching for rotation across many accounts. Segment users by trust tier, keep sensitive features behind elevated review, add friction in high-risk regions, and enforce Terms of Service that ban scraping and distillation while logging evidence for action. Q: How should prompts, outputs, and reasoning traces be hardened against cloning attempts? A: Avoid returning chain-of-thought or detailed internal reasoning by giving concise answers or structured summaries, keep system prompts and tool specs private, and use server-side tools with strict input/output filters. Randomize minor style elements, add refusal scaffolds when users probe for internals, and curate safety exemplars so the model avoids self-description. Q: What are watermarks and canaries, and how do they help detect reuse of outputs? A: Watermarks are semantic or lexical markers in outputs to spot bulk reuse, while canaries are seeded harmless phrases or stylistic tells that detectors can later find at scale. Monitoring the open web, code repositories, and model cards for these signatures and automating alerts lets teams tighten controls, notify partners, and pursue legal or remediation steps when reuse is detected. Q: What architectural choices improve resilience and minimize sensitive leakage? A: Gate sensitive capabilities behind approvals and strong authentication, split high-risk tools into microservices with separate rate limits and logging, and apply data minimization or differential privacy where possible to reduce leakage. Use ensembles or retrieval layers that can swap or degrade gracefully under attack and run red-team exercises to uncover and fix gaps. Q: What signals and metrics should be tracked to spot active model extraction campaigns quickly? A: Watch for signals such as very high prompt volume from one client or many fresh accounts on the same network, prompt sweeps requesting explanations or step-by-step reasoning, attempts to bypass refusals, and spikes in long-context sessions or downloads of reasoning-like content. Measure time to detect abnormal prompting and time to block or verify, ratio of high-risk sessions, prompt similarity rates, refusal-trigger and evasion attempts per session, and watermark or canary hit rates to guide fast response.