MITRE ATLAS 2026 Top AI Detection: Model Extraction via High-Volume Inference Querying (AML.T0056)
Detects anomalous high-frequency requests to machine learning model endpoints from a single client, a pattern indicative of model extraction (stealing) attacks. This rule monitors inference request paths and success statuses to identify potential systematic input-space probing.
Sigma
