Capability Manifold Surveillance: Topological Detection of Model Distillation via Activation Fingerprint Geometry

Executive Summary

Model distillation — training a smaller model to replicate a larger model's behavior using its outputs — poses a growing security challenge for API-based AI providers. Existing defenses such as PRADA and VarDetect operate in input space. The OMED impossibility theorem establishes that any defense permitting benign access cannot reliably distinguish all adversarial clients from input distributions alone.

CMS does not claim to violate the OMED bound. Instead, it shifts from absolute prevention to economic deterrence — making extraction more expensive without guaranteeing detection of every adversarial client. CMS extracts activation fingerprints (mean-pooled final hidden states) during normal inference and applies a sliding-window detector over centered cosine similarity to distinguish task-focused legitimate sessions from the high-entropy manifold sweeps characteristic of extraction. Across GPT-2 124M and Qwen 2.5 1.5B, 3B and 7B, it achieves AUC 1.000 on systematic attacks at all scales of 1.5B and above, and combined AUC 0.899-0.905 at 1.5B and 7B; at 7B the simpler VarDetect baseline is marginally higher on combined AUC (0.917 vs. 0.905). All evaluations use synthetic sessions built from a 500-probe set; real-world deployment with heterogeneous user behavior may show lower separation.

The work is motivated in part by the February 2026 Anthropic disclosure, which documented over 16 million exchanges from approximately 24,000 fraudulent accounts engaged in systematic model extraction. CMS's advantage lies less in static detection than in temporal accumulation: its Proof of History scoring achieves perfect separation of systematic attacks at all scales above 124M, with 100% of naive and systematic attack accounts exceeding the 0.7 threshold versus 0% of single-domain sessions. A coverage-clustering tradeoff then turns detection into economic deterrence: attackers who keep their sessions similar enough to evade detection cannot freely sweep the capability manifold.

Key Contributions and Methodology

The paper makes three contributions. First, it argues that activation-space monitoring raises the cost of evasion relative to input-space defenses. The OMED impossibility applies to any observable signal, and activation patterns become partially observable through systematic probing — but the adversary faces a bootstrap problem: learning the defensive signal requires performing the extraction activity the defense monitors.

Second, it uses centered cosine similarity (equivalent to Pearson correlation) over per-session sliding windows of activation fingerprints as a shape-invariant detection signal. Rather than a binary threshold, an Extraction Likelihood Score accumulates evidence with exponential decay, so isolated anomalous windows common in diverse legitimate use fade while sustained extraction patterns build to high scores, triggering escalating responses from monitoring through verification challenges.

Third, the paper formalizes the coverage-clustering tradeoff. Legitimate sessions are task-focused and produce similar activations; extraction needs broad coverage of the capability manifold. For any adversary constrained to keep mean session similarity above the detection threshold, extraction coverage per query is bounded, so evasion degrades extraction efficiency. Adaptive adversaries can partially compensate by constraining query diversity, but this confines them to small manifold regions.

Key Findings

• Economic deterrence: Activation-side monitoring shifts from absolute prevention to economic deterrence, making extraction more expensive without claiming to violate the OMED bound
• Static detection: AUC 1.000 on systematic attacks at 1.5B and above; combined AUC 0.899-0.905, with VarDetect marginally ahead at 7B (0.917 vs. 0.905)
• Temporal accumulation: Proof of History scoring perfectly separates systematic attacks from single-domain sessions at all scales above 124M; adaptive attacks reach 100% at 7B
• Coverage-clustering tradeoff: Staying above the session-similarity threshold bounds extraction coverage, converting detection into an economic deterrent
• Motivated by real attacks: Framework addresses the scale of real-world extraction documented in the February 2026 Anthropic disclosure (16M+ exchanges, ~24K fraudulent accounts)

Key References