{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "K-0022",
    "slug": "weight-exfiltration",
    "title": "Weight exfiltration",
    "aliases": [
      "model weight theft",
      "data exfiltration"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "Unauthorized copying of a model's trained parameters out of the environment meant to contain them, by theft or through covert channels.",
    "sources": [
      {
        "source": "S-1610",
        "supports": "model weights as a target for theft; 38 attack vectors; 5 security levels; adversaries from opportunistic criminals to nation-state operations",
        "locator": "summary"
      },
      {
        "source": "S-0015",
        "supports": "exfiltration by hiding weights in model responses (steganography); security game; verification against a reference; on MoE-Qwen-30B, exfiltratable information under 0.5% at a false-positive rate under 0.01%",
        "locator": "abstract"
      },
      {
        "source": "S-0038",
        "supports": "physical side channels can bypass network monitoring",
        "locator": "side channels of concern"
      },
      {
        "source": "S-0018",
        "supports": "malicious verifier may aim to exfiltrate prover secrets; checkpoints committed, not revealed, to an independent governing body; only hashes sent to a verifier outside the facility",
        "locator": "threat model; weights"
      }
    ],
    "related": [
      "K-0013",
      "K-0014",
      "K-0021"
    ],
    "type": "concept",
    "url": "https://trustbutveri.fyi/concepts/weight-exfiltration/",
    "source_file": "content/concepts/weight-exfiltration.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "Weight exfiltration is the unauthorized copying of a model's trained parameters, its weights, out of the environment meant to contain them [[S-1610]] [[S-0015]].\n\nRAND researchers identified 38 meaningfully distinct attack vectors for stealing frontier model weights, and defined five security levels for defending against actors ranging from opportunistic criminals to highly resourced nation-state operations [[S-1610]]. Exfiltration can be covert: an attacker who controls an inference server could hide weights inside ordinary model responses using steganography [[S-0015]]. Rinberg and colleagues verify inference outputs against a reference to limit what responses can carry; on the MoE-Qwen-30B model, under benign prompts, their detector reduced exfiltratable information to under 0.5% at a false-positive rate below 0.01% [[S-0015]], the approach of [[M-0024|bounding unexplained information in outputs]]. Physical [[K-0013|side channels]] offer another route past network monitoring [[S-0038]], the target of [[M-0022|side-channel suppression]]. In verification the concern runs both ways: the verifier's equipment could leak the prover's secrets, so one low-trust design commits model checkpoints to an independent governing body rather than revealing them, and sends only hashes to the verifier outside the facility [[S-0018]].",
    "body_text": "Weight exfiltration is the unauthorized copying of a model's trained parameters, its weights, out of the environment meant to contain them [S-1610] [S-0015]. RAND researchers identified 38 meaningfully distinct attack vectors for stealing frontier model weights, and defined five security levels for defending against actors ranging from opportunistic criminals to highly resourced nation-state operations [S-1610]. Exfiltration can be covert: an attacker who controls an inference server could hide weights inside ordinary model responses using steganography [S-0015]. Rinberg and colleagues verify inference outputs against a reference to limit what responses can carry; on the MoE-Qwen-30B model, under benign prompts, their detector reduced exfiltratable information to under 0.5% at a false-positive rate below 0.01% [S-0015], the approach of bounding unexplained information in outputs. Physical side channels offer another route past network monitoring [S-0038], the target of side-channel suppression. In verification the concern runs both ways: the verifier's equipment could leak the prover's secrets, so one low-trust design commits model checkpoints to an independent governing body rather than revealing them, and sends only hashes to the verifier outside the facility [S-0018].",
    "referenced_by": [
      {
        "id": "M-0024",
        "title": "Bounding unexplained information in outputs",
        "url": "https://trustbutveri.fyi/mechanisms/bounding-unexplained-information/"
      },
      {
        "id": "M-0012",
        "title": "Model identity attestation",
        "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/"
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/"
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "M-0022",
        "title": "Side-channel suppression for isolated facilities",
        "url": "https://trustbutveri.fyi/mechanisms/side-channel-suppression/"
      },
      {
        "id": "I-0007",
        "title": "Attestable Audits",
        "url": "https://trustbutveri.fyi/implementations/attestable-audits/"
      },
      {
        "id": "I-0010",
        "title": "RAND secure inference data center (SIDC) design",
        "url": "https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/"
      },
      {
        "id": "C-0009",
        "title": "Model weights or data have not left the facility",
        "url": "https://trustbutveri.fyi/claims/weights-have-not-left/"
      },
      {
        "id": "K-0013",
        "title": "Side channel",
        "url": "https://trustbutveri.fyi/concepts/side-channel/"
      }
    ]
  }
}