Weight exfiltration

Weight exfiltration is the unauthorized copying of a model's trained parameters, its weights, out of the environment meant to contain them ^{1 2}.

RAND researchers identified 38 meaningfully distinct attack vectors for stealing frontier model weights, and defined five security levels for defending against actors ranging from opportunistic criminals to highly resourced nation-state operations ¹. Exfiltration can be covert: an attacker who controls an inference server could hide weights inside ordinary model responses using steganography ². Rinberg and colleagues verify inference outputs against a reference to limit what responses can carry; on the MoE-Qwen-30B model, under benign prompts, their detector reduced exfiltratable information to under 0.5% at a false-positive rate below 0.01% ², the approach of bounding unexplained information in outputs. Physical side channels offer another route past network monitoring ³, the target of side-channel suppression. In verification the concern runs both ways: the verifier's equipment could leak the prover's secrets, so one low-trust design commits model checkpoints to an independent governing body rather than revealing them, and sends only hashes to the verifier outside the facility ⁴.