Model Stealing Attacks on Cloud-Based AI: A New Zero-Query Trojan Method Emerges

Cloud-based AI services (OpenAI's GPT-4, Google's Gemini, Anthropic's Claude) are protected by encryption, authentication, and usage policies. A new attack method presented at the ACM Conference on Computer and Communications Security (CCS) this week undermines those defenses in a way few anticipated. Previous cloud security incidents mainly involved data exposure, not model theft.

Dubbed "Zero-Query Model Stealing" (ZQMS), the technique reconstructs a victim model's architecture, weight sizes, and approximate hyperparameters by observing side-channel signals generated during inference. No API calls needed. A recent analysis of model security noted that zero-query methods are emerging as a distinct threat.

How It Works

The attack works by exploiting shared hardware. Cloud platforms often deploy multiple AI models on the same GPU or TPU server. An attacker can co-locate a malicious process on the same physical machine (via cloud instances like AWS EC2 GPU instances) and monitor memory access patterns, cache behavior, and timing variations.

"When a model processes a user query, it performs a specific sequence of matrix multiplications, attention operations, and layer normalizations," says Dr. Li Xia, lead author of the study and a researcher at Tsinghua University. "These operations leave a distinct 'fingerprint' in the hardware counters and memory latency. We trained a small neural network to decode that fingerprint into a reconstruction of the original model's architecture."

The zero-query nature makes the attack hard to detect. Traditional model stealing requires thousands of API queries to train a surrogate. ZQMS sidesteps that, leaving no query-based footprint.

Implications for Security and Intellectual Property

For companies whose business models depend on proprietary models (OpenAI, Anthropic, Meta AI), a successful ZQMS attack could let a competitor clone the architecture and training pipeline, bypassing research investment.

"This is a paradigm shift in model security," says Dr. William Grant, a cybersecurity expert at MIT. "Until now, the threat model assumed the attacker would need direct interaction. This shows that just hosting a model on shared cloud infrastructure is enough to leak its secrets." The debate over who controls AI infrastructure now includes this new vulnerability.

The attack works on both transformer-based LLMs and convolutional neural networks. The team stole approximations of GPT-2 (a proxy for larger LLMs) and ResNet-50 on Google Cloud and AWS. They did not attempt to steal GPT-4 or other gated models, but claim the technique should scale.

Mitigations and the Road Ahead

The researchers suggest countermeasures: deploy models on dedicated hardware to prevent co-location, obfuscate memory access patterns with dummy operations, or use secure enclaves (Intel SGX, AMD SEV) to protect model weights from a compromised hypervisor. Specialized security models like Microsoft's MAI-Cyber-1-Flash could also help detect such anomalies.

Major cloud providers have been notified. Google and Amazon Web Services both released statements emphasizing their commitment to security and noting they are evaluating the paper's findings. OpenAI declined to comment but is reportedly working on a technical report in response.

The attack highlights a tension in the AI industry: faster, cheaper inference via shared hardware versus protecting valuable intellectual property. As AI models enter healthcare and finance, the stakes are high.

The ZQMS paper is available on arXiv and will be presented at a dedicated CCS workshop on adversarial machine learning next month. The authors have released a proof-of-concept detection tool to help cloud providers identify potential side-channel leaks, but they stress that comprehensive defense requires hardware-level changes.