Systematic high-volume API querying indicative of model extraction/distillation
Detects anomalous, high-frequency interaction with AI model endpoints characterized by a high volume of requests with a near 1:1 ratio of distinct inputs. This pattern is indicative of automated knowledge-distillation or model extraction attacks against AI services.
Microsoft Sentinel (KQL)
