这篇论文提出了Caliber，一种给API返回分数加噪的防御方法，能控制攻击者提取模型的成本，还给出了理论保证和实验数据。
Caliber是一种针对分数返回API的模型提取防御方法，通过向内部logits添加独立同分布高斯噪声来干扰攻击者。论文证明噪声尺度与预测一致性单调递减，并推导了固定输入下恢复干净logits所需查询次数的闭式极小极大下界。在三十多个模型-数据集组合上，逐模型校准的平均绝对相对误差为0.6%-1.4%。端到端实验显示替代模型性能与配置的退化程度一致。
Caliber: Cross-Architecture Extraction-Cost Control for Score-Returning APIs
We present Caliber, an output-perturbation defense against model extraction that formulates noise selection as a calibration problem: how much the defense degrades the supervision signal used to train a surrogate, and the provable per-input query cost of recovering the clean logits. To defend against an attacker that uses returned scores for knowledge distillation, Caliber adds independent and identically distributed Gaussian noise to the internal logits. We establish two properties of the resulting perturbed predictions. Monotone agreement degradation: When the clean logits have a unique maximizer, agreement with the clean prediction decreases strictly with the noise scale, so every target in $(1/K,1)$ corresponds to a unique positive scale; task accuracy is bounded by computable lower and upper envelopes. Per-input recovery cost: We derive a closed-form minimax lower bound on the repeated queries needed to recover the clean logits for a fixed input. Caliber normalizes noise variance by the squared median top-two logit margin and fits the resulting noise-utility relationship with a logistic curve, either per model or shared within a task. Across more than thirty model-dataset combinations, per-model calibration achieves mean absolute relative errors of 0.6-1.4%. End-to-end experiments show that surrogate performance generally tracks the configured degradation, while fixed-input averaging follows the expected variance reduction.