Potential Azure OpenAI Model Theft
Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are…
Description
Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are unusual during model interactions.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Known benign triggers
- Authorized model training
- Legitimate high volume data exchanges during scheduled updates
MITRE ATT&CK mappings
Not mapped to ATT&CK.
References
| Reference | Cited by |
|---|---|
| atlas.mitre.org/techniques/AML.T0044 | 2 |
| genai.owasp.org/llmrisk/llm10-model-theft | 2 |
From the source
- At source
- Open at source
- Upstream identifier
- 4021e78d-5293-48d3-adee-a70fa4c18fab
- Tagged by the source as
- Data Source: Azure Event HubsData Source: Azure OpenAIDomain: LLMMitre Atlas: T0044Resources: Investigation GuideUse Case: Model Theft
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Aug 27, 2026
- Version
- 1