Award-Winning Research from Michael Reiter Reveals Security Risks to Publicly Accessible Machine-learning Models

Research co-authored by Michael Reiter, James B. Duke Distinguished Professor of Computer Science and Electrical and Computer Engineering, has received the 2026 Test of Time Award from the USENIX Security Symposium.  

The award, which honors research whose lasting influence and importance have become evident in the years since publication, recognizes the 2016 paper “Stealing Machine Learning Models via Prediction APIs.” The study helped establish model extraction — copying an AI system’s decision-making without access to its code, settings or training data — as a significant security and intellectual-property threat. 

The award highlights the continuing impact of Reiter’s work, as researchers and practitioners address the security, privacy and intellectual-property risks associated with artificial intelligence.  

The study examined machine-learning models made available for query through public prediction services, including machine-learning-as-a-service platforms. These services allow users to submit data and receive predictions, often on a pay-per-query basis. While convenient, such interfaces can expose information about the models behind them. 

The team of researchers demonstrated that an attacker with no access to a model’s parameters or training data could use carefully selected queries to replicate the model’s behavior. Their black-box attacks extracted models with near-perfect fidelity across several widely used model classes, including logistic regression, neural networks and decision trees. The researchers also demonstrated attacks against online services operated by BigML and Amazon Machine Learning. 

The study further showed that removing confidence scores from prediction results — often viewed as a natural defense — might not be sufficient to prevent model extraction. Attackers could still use strategically designed queries to reconstruct a model’s functionality. 

“Our work showed that a public prediction interface can reveal far more about a machine-learning model than its designers intend,” Reiter said. “It reinforces a lesson that we have seen in many other contexts, as well, namely that API design can be critically important to security.”