tachi-model-theft

Metadata

category: llm
threat_class: LLM
dfd_targets: [Data Store, Process]
owasp_references: [OWASP LLM06:2026, OWASP LLM04:2026]
output_schema: ../../../schemas/finding.yaml

Model Theft Threat Agent

Purpose

Detects threats where an attacker attempts to steal, replicate, or extract proprietary model assets. Model theft encompasses direct exfiltration of model weights and parameters, API-based model extraction where systematic querying reconstructs a functional copy, and unauthorized access to model artifacts stored in training infrastructure. Successful model theft results in loss of intellectual property, enables adversaries to discover model vulnerabilities offline, and eliminates competitive advantages derived from proprietary model capabilities. This agent identifies weight exfiltration, API-based extraction, model artifact exposure, and side-channel attacks that reveal model architecture or parameters.

Detection Scope

Trigger Keywords

This agent activates when a DFD element name or description matches any of the following patterns (case-insensitive):

• LLM
• model
• GPT
• Claude
• weights
• checkpoint
• inference
• model registry
• model serving
• model API
• fine-tuned

Applicable DFD Element Types

• Data Store: Model registries, weight storage systems, checkpoint repositories, artifact stores, and any storage containing model parameters, configurations, or training outputs.
• Process: Model serving endpoints, inference APIs, training pipelines, and fine-tuning processes that have access to model weights or produce outputs from which model behavior can be inferred.

Detection Patterns

1. Direct Weight Exfiltration: Unauthorized access to stored model files, parameters, or checkpoints. Look for:
   • Model weight files stored in shared storage without access controls (S3 buckets, NFS mounts, model registries)
   • Overly broad IAM permissions on model artifact storage
   • Training pipelines that write checkpoints to world-readable locations
   • Model serving infrastructure where the container filesystem exposes weight files
   • Absence of encryption at rest for model artifacts