ATLAS AML.T0144: Recover AI Model Internals

A model you never published can still give away its architecture, its dimensions and some of its weights through the answers it returns. MITRE ATLAS added this as AML.T0144 Recover AI Model Internals in release 2026.10 (28 October 2026). It sits under two tactics, Discovery (AML.TA0008) and Collection (AML.TA0009), applies to both predictive and generative AI, and is rated Feasible. This page explains what the technique covers, the published research behind it, and the controls that make recovery slower, costlier and more visible. It is for teams that run inference APIs, AI platform owners and AI red teams.

Key takeaways

The target is structure and parameters, not behaviour. ATLAS lists architecture, layer dimensions, hyperparameters, decision-tree structure, projection matrices and numerical parameters, recovered partly, approximately or exactly.
Your API surface is the attack surface. Published attacks relied on output features such as confidence scores, log-probabilities and logit bias, so every extra field an endpoint returns is something to justify.
It has worked against production systems. Carlini and colleagues recovered the embedding projection matrix of OpenAI's Ada and Babbage models for under 20 US dollars in queries, and the hidden dimension of gpt-3.5-turbo.
ATLAS maps one mitigation today. AML.M0040 Adaptive AI Response Degradation, which degrades responses when extraction activity is suspected. Output minimisation and query limits support it.
Detection is about query patterns per identity. Recovery needs many structured queries, so the useful signals are volume, unusual parameter combinations and systematic input coverage by one key or tenant.

What the technique covers

ATLAS defines AML.T0144 as an adversary inferring or recovering non-public model internals through analysis of model behaviour or exposed information. Methods named in the technique include strategically selected queries, equation solving, numerical reconstruction and statistical identification. The result may be partial, approximate or exact.

Three neighbouring ATLAS techniques are easy to confuse with it:

Technique	What the adversary obtains	Typical use
AML.T0144 Recover AI Model Internals	The model's internal structure or parameter values	Precise knowledge for later attacks, or a first step towards a copy
AML.T0005 Replicate AI Model Behavior	A model that imitates the target's outputs (a proxy)	Offline attack development and stealing functionality
AML.T0014 Discover AI Model Family	The general family or type of model in use	Choosing which attacks to try
AML.T0013 Discover AI Model Ontology	The model's output space, such as its classes	Understanding what the model can return

The distinction matters for defence. Behaviour replication can be done with ordinary outputs and a training budget. Recovering internals usually needs specific, high-information outputs, which is why output design is the main control here. See AML.T0014 Discover AI Model Family and AML.T0013 Discover AI Model Ontology for the discovery steps that often come first.

How it has been demonstrated

ATLAS cites three research papers for this technique. As of November 2026 it lists no ATLAS case study for AML.T0144, so the evidence is published research against real services rather than a reported criminal incident.

Research	Target	What was recovered	What it relied on
Tramèr et al., Stealing Machine Learning Models via Prediction APIs (2016)	BigML and Amazon Machine Learning online services	Logistic regression, neural network and decision tree models with near-perfect fidelity	Black-box queries; APIs that accepted partial feature vectors and returned confidence values
Jagielski et al., High Accuracy and High Fidelity Extraction of Neural Networks (2019, revised 2020)	Academic datasets and an image classifier trained on 1 billion proprietary images	Weights recovered directly, giving a functionally equivalent model	Query access; the paper separates accuracy (task performance) from fidelity (matching the victim)
Carlini et al., Stealing Part of a Production Language Model (2024)	OpenAI Ada, Babbage and gpt-3.5-turbo	The embedding projection layer (up to symmetries) of Ada and Babbage, confirming hidden dimensions of 1024 and 2048; the exact hidden dimension of gpt-3.5-turbo	The logit bias parameter combined with top-K log-probabilities; a costlier variant needed only logit bias and the top token

Two lessons carry across all three. First, the 2016 authors found that omitting confidence values, the obvious defence, still allowed harmful extraction, so no single output change is enough. Second, the 2024 paper was handled through responsible disclosure: the authors report that both affected APIs implemented defences, and that after disclosure OpenAI's API stopped logit bias from affecting the returned top log-probabilities. The cost estimate the authors gave for recovering gpt-3.5-turbo's full projection matrix was under 2,000 US dollars in queries.

Why it matters

Loss of intellectual property: exact or near-exact parameters are a direct leak of what the organisation paid to build.
Better follow-on attacks: knowing the architecture and dimensions lets an adversary build a closer proxy (AML.T0005) and develop evasion or adversarial inputs offline, then use them against the live model.
Undermined assumptions: teams that rely on "the weights are secret" as a control for misuse or evasion lose that control without any system being breached.
Low visibility: the activity looks like normal API use from a valid account, unless you look at the pattern.

Mitigations

ATLAS maps one mitigation to AML.T0144. The others below are ATLAS mitigations that target the same conditions (high-information outputs and unlimited querying); they are listed here as supporting controls, not as official mappings for this technique.

Control	What to do	Status for AML.T0144
AML.M0040 Adaptive AI Response Degradation	When extraction is suspected, route requests to a more constrained model, reduce output precision, withhold confidence or auxiliary outputs, restrict structured responses, or add controlled perturbations, in proportion to detection confidence	Mapped by ATLAS
AML.M0002 Predictive AI Output Obfuscation	Return only what the application needs: withhold or round confidence scores, logits, class rankings, embeddings and model metadata	Supporting control
AML.M0004 Limit AI Service Query Volume and Rate	Rate, burst, concurrency and long-term quotas per user, API key or tenant; watch for limit evasion through account rotation	Supporting control
AML.M0001 Limit Model Artifact Release	Avoid publishing architectures, checkpoints or details that match production models	Supporting control

ATLAS adds a caution for AML.M0040 that is worth repeating: degradation must not produce misleading or unsafe outputs, must not reveal that detection has fired, and must not break authorised use. For generative APIs, the 2024 paper's own list of options is a useful design checklist: remove logit bias or replace it with a token blocklist, disallow logit bias and log-probabilities in the same request (the authors estimate this alone makes the attack about ten times more expensive), add noise to output logits at some cost to usefulness, rate-limit logit-bias queries, and detect malicious query patterns, noting that such detectors can themselves be evaded.

Implementation steps

Inventory every inference endpoint and its outputs. For each, list the fields returned (labels, scores, log-probabilities, embeddings, token counts, model version strings) and the request parameters accepted (logit bias, temperature, partial inputs).
Remove what the product does not need. Drop or round confidence values and log-probabilities by default; expose them only to named, authenticated consumers with a documented need.
Separate high-information features. Where log-probabilities or bias controls are a product feature, prevent risky combinations in one request and put them behind a separate scope or tier.
Bind every request to an identity. Anonymous inference makes per-caller limits and detection impossible. Issue API keys or tokens per customer and per workload.
Set quotas and alerts in audit mode first. Log what limits would have blocked for two to four weeks, tune against real usage, then enforce. Keep a documented rollback (raise the limit for a tenant) for false positives.
Add adaptive degradation last. Once detection is trusted, apply AML.M0040 responses to flagged callers, starting with the least disruptive (rounding, withholding auxiliary outputs) and test that legitimate users are not affected.

Detection and measurement

Log at the inference gateway: caller identity, endpoint, model version, request parameters (including bias and log-probability settings), output fields returned, token counts and timestamps. Signals worth alerting on:

One identity sending large volumes of short, systematically varied prompts or feature vectors.
Heavy use of logit bias, log-probability or partial-input features well above the tenant's baseline.
Many new accounts or keys with the same query pattern, suggesting quota evasion.
Queries that sweep the input space evenly rather than following realistic usage.

Metric	Why it matters
Share of endpoints returning confidence scores or log-probabilities without a documented need	Measures exposed attack surface; aim for zero
Share of inference traffic tied to a named identity	Per-caller limits and detection depend on it
Number of extraction-pattern alerts per month and median time to triage	Shows detection is running and reviewed
False positive rate of degradation actions	Keeps AML.M0040 from harming real users
Red team extraction exercises run per year on high-value models	Confirms controls hold against current research

See the Rate Limiting and API Abuse Guide for quota design at the gateway.

Where identity fits

Query-based recovery is carried out through credentials: an API key, an OAuth client or a service account. A leaked or shared key gives an adversary someone else's quota and hides the pattern inside legitimate traffic. Treat inference API keys as non-human identities with an owner, a scope that excludes high-information features by default, rotation, and usage baselines per key. See the AI Agent Rate Limits guide for per-identity limits.

Common failure patterns

Returning full probability vectors by default because a framework does so, when the application only shows a label.
Rate limits per IP address only, which distributed or rotated clients bypass; limits must follow the authenticated identity.
Treating the omission of scores as sufficient. The 2016 research showed extraction remained possible without confidence values.
Silent degradation that misleads. Perturbing outputs for a falsely flagged customer can cause real harm, which ATLAS warns against.
Publishing architecture details in model cards or blog posts that match production exactly, reducing the work left to recover.

How to test

Ask an authorised AI red team (AML.M0035) to attempt recovery of a non-production copy behind the same gateway, using the methods described in the cited papers, and measure how many queries and how much cost it takes before detection fires. Re-run after any change to output fields or request parameters. See the AI Red Teaming Guide.

Framework mapping

Framework	Reference	Relevance
MITRE ATLAS	AML.TA0008 Discovery, AML.TA0009 Collection; AML.M0040	Technique tactics and mapped mitigation
NIST SP 800-53 Rev 5	SI-4 System Monitoring; AU-6 Audit Record Review, Analysis, and Reporting	Monitoring inference traffic for extraction patterns
NIST SP 800-53 Rev 5	CA-8 Penetration Testing	Extraction exercises against high-value models
NIST CSF 2.0	DE.CM-09	Monitoring runtime environments and their data for adverse events

Practitioner checklist

List every inference endpoint with the output fields and request parameters it exposes.
Remove or round confidence scores, logits and log-probabilities where the product does not need them.
Block risky parameter combinations, such as logit bias with log-probabilities, in a single request.
Require an authenticated identity for every inference call and set per-identity quotas.
Log request parameters and returned fields at the gateway and baseline them per tenant.
Alert on systematic, high-volume or quota-evading query patterns.
Pilot AML.M0040 degradation on flagged callers and track false positives.
Run a red team extraction exercise on each high-value model at least yearly.

AML.T0144 Recover AI Model Internals: How the Technique Works Against AI Systems and How to Defend