Model Stealing Attacks on Cloud-Based AI: A New Zero-Query Trojan Method Emerges

Cloud-based artificial intelligence services, from OpenAI's GPT-4 to Google's Gemini and Anthropic's Claude, are increasingly treated as crown jewels by their developers, protected by layers of encryption, authentication, and usage policies. But a new attack method presented at the ACM Conference on Computer and Communications Security (CCS) this week challenges those defenses at a fundamental level.

Dubbed "Zero-Query Model Stealing" (ZQMS), the technique can reconstruct a victim model's architecture, weight sizes, and even approximate hyperparameters by observing only the side-channel signals generated during inference, without the attacker ever making a single API call.

How It Works

The attack is deceptively simple in concept, though technically sophisticated in execution. The researchers discovered that cloud platforms often deploy multiple AI models on shared hardware, a GPU or TPU server. By co-locating a malicious process on the same physical machine (achievable via cloud instances like AWS EC2 GPU instances), an attacker can monitor memory access patterns, cache behavior, and timing variations.

"When a model processes a user query, it performs a specific sequence of matrix multiplications, attention operations, and layer normalizations," explains Dr. Li Xia, lead author of the study and a researcher at Tsinghua University. "These operations leave a distinct 'fingerprint' in the hardware counters and memory latency. We trained a small neural network to decode that fingerprint into a reconstruction of the original model's architecture."

The attack's zero-query nature is its most alarming feature. Traditional model stealing requires thousands of (often expensive) API queries to train a surrogate model that mimics the original. ZQMS sidesteps that entirely, making it much harder to detect.

Implications for Security and Intellectual Property

For companies like OpenAI, Anthropic, and Meta AI, whose business models rely on the proprietary nature of their models, the implications are severe. A successful ZQMS attack could allow a competitor to clone a model's architecture and training pipeline, bypassing years of research and billions of dollars in investment.

"This is a paradigm shift in model security," says Dr. William Grant, a cybersecurity expert at MIT. "Until now, the threat model assumed the attacker would need direct interaction. This shows that just hosting a model on shared cloud infrastructure is enough to leak its secrets."

The attack reportedly works on both transformer-based LLMs and convolutional neural networks used for image recognition. The team successfully stole approximations of popular architectures including GPT-2 (a proxy for larger LLMs) and ResNet-50 on Google Cloud and AWS platforms. They did not attempt to steal GPT-4 or other gated models, but claim the technique should scale.

Mitigations and the Road Ahead

The researchers suggest several countermeasures. First, cloud providers could deploy models on dedicated, isolated hardware to prevent co-location attacks. Second, they could obfuscate memory access patterns by injecting dummy operations or using constant-time implementations of critical layers. Third, secure enclaves, such as Intel SGX or AMD SEV, could protect model weights even from a compromised hypervisor.

Major cloud providers have been notified. Google and Amazon Web Services both released statements emphasizing their commitment to security and noting they are evaluating the paper's findings. OpenAI declined to comment but is reportedly working on a technical report in response.

The attack highlights a growing tension in the AI industry: the push for faster, cheaper inference through shared hardware versus the need to protect increasingly valuable intellectual property. As AI models become integrated into everything from healthcare to finance, the stakes of model theft skyrocket.

The ZQMS paper is available on arXiv and will be presented at a dedicated CCS workshop on adversarial machine learning next month. The authors have released a proof-of-concept detection tool to help cloud providers identify potential side-channel leaks, but they stress that comprehensive defense requires hardware-level changes.