Large-language models (LLMs) already power mission critical tasks such as command-and-control chat, satellite ground-station automation, military analytics, and cyber-defense. Since most of these services are offered through application programming interfaces (APIs) that still expose full or top-k logits and lack mature safeguards, they present a serious, often overlooked attack surface. Earlier work has shown how to rebuild the output projection layer or distill surface behavior, but no attack has produced a deployable clone within a tight query budget. In this thesis, we address this problem by presenting a practical pipeline for cloning LLMs under constrained settings. The approach first estimates the output projection matrix by collecting fewer than 10,000 top-$k$ logits from the target model and analyzing them with singular value decomposition (SVD). Next, it trains smaller student models with varying transformer depths on publicly available data to reproduce the original model’s internal patterns and outputs. Experiments show that a 6-layer student can match 97.6\\% of the teacher model’s hidden-state geometry, with only a 7.31\\% increase in perplexity and an NLL of 7.58. A lighter 4-layer version runs 17.1\\% faster and uses 18.1\\% fewer parameters, while maintaining strong performance. The entire attack completes in under 24 GPU hours without triggering API rate limits. These findings show that even adversaries with limited budgets can recreate the knowledge inside modern LLMs, highlighting the urgent need for stronger API protections and safer deployment practices.
","abstract_html":"<p>Large-language models (LLMs) already power mission critical tasks such as command-and-control chat, satellite ground-station automation, military analytics, and cyber-defense. Since most of these services are offered through application programming interfaces (APIs) that still expose full or top-k logits and lack mature safeguards, they present a serious, often overlooked attack surface. Earlier work has shown how to rebuild the output projection layer or distill surface behavior, but no attack has produced a deployable clone within a tight query budget. In this thesis, we address this problem by presenting a practical pipeline for cloning LLMs under constrained settings. The approach first estimates the output projection matrix by collecting fewer than 10,000 top-$k$ logits from the target model and analyzing them with singular value decomposition (SVD). Next, it trains smaller student models with varying transformer depths on publicly available data to reproduce the original model’s internal patterns and outputs. Experiments show that a 6-layer student can match 97.6\\% of the teacher model’s hidden-state geometry, with only a 7.31\\% increase in perplexity and an NLL of 7.58. A lighter 4-layer version runs 17.1\\% faster and uses 18.1\\% fewer parameters, while maintaining strong performance. The entire attack completes in under 24 GPU hours without triggering API rate limits. These findings show that even adversaries with limited budgets can recreate the knowledge inside modern LLMs, highlighting the urgent need for stronger API protections and safer deployment practices.</p>","abstract_has_math":true,"creators":["Gharami, Kanchon"],"institution":null,"degree_name":"Master of Science in Computer Science","degree_level":"Thesis - Open Access","degree_discipline":"Electrical Engineering and Computer Science","degree_department":null,"school":null,"contributors":[],"advisors":[],"committee_chairs":[],"committee_members":[],"year":2025,"date_issued":"2025-07-10T07:00:00Z","date_published":"2025-07-10T07:00:00Z","updated_at":"2026-07-27T19:26:16Z","subjects":["Adversarial machine learning","large language models","model stealing","LLM attacks","LLM cloning","compression algorithms","inference mechanisms","reverse engineering","Artificial Intelligence and Robotics","Electrical and Computer Engineering","Information Security"],"languages":[],"rights":[],"rights_urls":[],"identifier_entries":[]},"links":{"outbound_url":"https://commons.erau.edu/edt/909","outbound_label":"Repository record","outbound_source":"dc:identifier"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:creator","label":"Author","values":["Gharami, Kanchon"]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"thesis:degree_discipline","label":"Discipline","values":["Electrical Engineering and Computer Science"]},{"key":"thesis:degree_level","label":"Degree Level","values":["Thesis - Open Access"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Master of Science in Computer Science"]}]},{"id":"subjects_keywords","label":"Subjects and Keywords","entries":[{"key":"dc:subject","label":"Dc Subject","values":["Adversarial machine learning","large language models","model stealing","LLM attacks","LLM cloning","compression algorithms","inference mechanisms","reverse engineering","Artificial Intelligence and Robotics","Electrical and Computer Engineering","Information Security"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier","label":"Identifier","values":["https://commons.erau.edu/edt/909"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["Large-language models (LLMs) already power mission critical tasks such as command-and-control chat, satellite ground-station automation, military analytics, and cyber-defense. Since most of these services are offered through application programming interfaces (APIs) that still expose full or top-k logits and lack mature safeguards, they present a serious, often overlooked attack surface. Earlier work has shown how to rebuild the output projection layer or distill surface behavior, but no attack has produced a deployable clone within a tight query budget. In this thesis, we address this problem by presenting a practical pipeline for cloning LLMs under constrained settings. The approach first estimates the output projection matrix by collecting fewer than 10,000 top-$k$ logits from the target model and analyzing them with singular value decomposition (SVD). Next, it trains smaller student models with varying transformer depths on publicly available data to reproduce the original model’s internal patterns and outputs. Experiments show that a 6-layer student can match 97.6\\% of the teacher model’s hidden-state geometry, with only a 7.31\\% increase in perplexity and an NLL of 7.58. A lighter 4-layer version runs 17.1\\% faster and uses 18.1\\% fewer parameters, while maintaining strong performance. The entire attack completes in under 24 GPU hours without triggering API rate limits. These findings show that even adversaries with limited budgets can recreate the knowledge inside modern LLMs, highlighting the urgent need for stronger API protections and safer deployment practices.
"]},{"key":"dc:title","label":"Title","values":["In the Shadow of Prompts: Adversarial Attacks and Model Cloning in Large Language Models"]}]}],"canonical_facts":{"dc:creator":["Gharami, Kanchon"],"dc:description.abstract":["Large-language models (LLMs) already power mission critical tasks such as command-and-control chat, satellite ground-station automation, military analytics, and cyber-defense. Since most of these services are offered through application programming interfaces (APIs) that still expose full or top-k logits and lack mature safeguards, they present a serious, often overlooked attack surface. Earlier work has shown how to rebuild the output projection layer or distill surface behavior, but no attack has produced a deployable clone within a tight query budget. In this thesis, we address this problem by presenting a practical pipeline for cloning LLMs under constrained settings. The approach first estimates the output projection matrix by collecting fewer than 10,000 top-$k$ logits from the target model and analyzing them with singular value decomposition (SVD). Next, it trains smaller student models with varying transformer depths on publicly available data to reproduce the original model’s internal patterns and outputs. Experiments show that a 6-layer student can match 97.6\\% of the teacher model’s hidden-state geometry, with only a 7.31\\% increase in perplexity and an NLL of 7.58. A lighter 4-layer version runs 17.1\\% faster and uses 18.1\\% fewer parameters, while maintaining strong performance. The entire attack completes in under 24 GPU hours without triggering API rate limits. These findings show that even adversaries with limited budgets can recreate the knowledge inside modern LLMs, highlighting the urgent need for stronger API protections and safer deployment practices.
"],"dc:identifier":["https://commons.erau.edu/edt/909"],"dc:subject":["Adversarial machine learning","large language models","model stealing","LLM attacks","LLM cloning","compression algorithms","inference mechanisms","reverse engineering","Artificial Intelligence and Robotics","Electrical and Computer Engineering","Information Security"],"dc:title":["In the Shadow of Prompts: Adversarial Attacks and Model Cloning in Large Language Models"],"thesis:degree_discipline":["Electrical Engineering and Computer Science"],"thesis:degree_level":["Thesis - Open Access"],"thesis:degree_name":["Master of Science in Computer Science"]},"updated_at":"2026-07-27T19:26:16Z"}