Detection of relay-based extraction campaigns

Determine whether query-only monitoring can detect model-extraction campaigns that relay real users’ requests, including relays that interleave multiple users’ sessions or selectively forward high-value requests.

Background

The paper identifies relays as a central unresolved case because a relay may have an effectively unlimited supply of useful, user-like prompts. Under the paper’s law-matching argument, a relaying account whose traffic has the same joint distribution as genuine users cannot be separated from benign traffic by any query-only monitor.

The authors note that practical relays could nonetheless differ from benign users through session interleaving or selective forwarding. No relay simulation was conducted, leaving the detectability of these variants unresolved.

References

We did not simulate relays; it is the most important open experiment.

— The Limits of Query Monitoring against Distributed Model Extraction  (2610.13083 - Khilar, 9 Oct 2026) in Section 4, “Where real campaigns sit, and what passive monitoring cannot do,” paragraph “Why relays are the hard case”

We had planned to test real same-week populations far larger than the development weeks. In this period, WildChat-4.8M's weekly populations held only 260--469 accounts with at least 5 queries, so whether real populations of $104$ accounts are harder than our pooled ones remains open.

— The Limits of Query Monitoring against Distributed Model Extraction  (2610.13083 - Khilar, 9 Oct 2026) in Appendix, Section “The untouched weeks in full,” paragraph “What could not be tested”