Model Distillation Attacks Need API Telemetry

Model distillation is not only a concern for model providers. OpenAI reports a coordinated campaign that allegedly used roughly 30,000 accounts to generate about eight million model conversations. According to OpenAI, the goal was to collect high-quality answers and reasoning traces as training material for other models.

Many ordinary requests can form one attack

The individual interactions did not have to resemble a conventional intrusion. OpenAI describes distributed accounts, rented proxies and recurring tasks involving mathematics, coding, science and tool use. Only correlation across accounts, infrastructure and prompt patterns turned apparently ordinary API calls into a coherent campaign.

Google Threat Intelligence documented a related pattern in early 2026. State-backed actors mainly used Gemini for research, translation, coding assistance and other productivity tasks. Google did not observe novel technical capabilities at the time, but its findings show why misuse detection must consider behavioural patterns and campaign context.

Per-account rate limits are insufficient

A limit on one API key provides little protection when a campaign distributes requests across thousands of identities. Organisations operating proprietary models, agent platforms or sensitive knowledge services need a broader control model:

• Correlate accounts: examine shared infrastructure, payment indicators, devices and network signals.
• Detect prompt patterns: measure repeated task families, systematic variations and unusual coverage.
• Consider response value: long reasoning outputs, code and tool sequences may be more attractive than short answers.
• Preserve evidence: record raw events, model version, time, identity and enforcement decisions.
• Use graduated responses: throttle activity, require additional verification, cluster related accounts and suspend them when evidence is sufficient.

What DACH organisations should consider

API telemetry may contain personal or confidential data. Purpose, retention, access and legal basis must therefore be agreed with privacy, security and legal teams. Privacy should not, however, become an excuse for an opaque platform: without defined signals and reviewable escalation, coordinated campaigns remain invisible.

Do not only ask how many requests one account may send. Ask whether your operations can detect when many accounts pursue the same extraction objective together. Protecting an AI system starts not with one prompt, but with the ability to understand distributed behaviour as one connected event.