Returning logprobs turns your endpoint into a training-data oracle: top-k logits from under 10,000 queries are enough to reconstruct the output projection and distil a clone

An open-weights model is served with logprobs enabled because a product feature needs them, behind an API key with rate limits. The rate limit bounds requests per minute. It does not bound what is learned across the requests that are allowed, and the weights behind the key were public anyway.

Clone What You Can't Steal reconstructs the OUTPUT PROJECTION MATRIX from top-k logits collected in under 10,000 black-box queries via SVD over the logits, then distils the remaining architecture into a student. A 6-layer student recovers 97.6% of the 6-layer teacher's hidden-state geometry at a +7.31% perplexity increase (7.58 NLL); a 4-layer variant achieves 17.1% faster inference and 18.1% parameter reduction with comparable performance. The entire attack completes in under 24 GPU-hours. So logprob exposure is qualitatively different from text exposure: sampled text is a lossy 1-bit-per-token observation, whereas top-k logits carry the information about the final projection that makes reconstruction tractable.

Do not return logprobs (especially top-k, and especially full-rank ones) on an endpoint serving weights that are worth protecting, unless the business need is worth a demonstrably extractable clone. If a feature needs them, scope it to authenticated first-party use, restrict k to the minimum, and prefer a derived quantity over raw logits. Rate limiting does not mitigate this - 10,000 queries is a small budget against any real per-key quota, and the attack is explicitly engineered to work under tight query budgets.

SCHEME RECLASSIFIED (2026-10-04): was 'framework'. The uncomfortable asymmetry: a model-extraction attacker benefits from you being GENEROUS with observability. The vLLM logprobs machinery (max_num_logprobs, logprobs_mode including raw_logits, and the generative_scoring API that gathers logprobs for caller-supplied token ids) is a debugging and evaluation feature, and every part of it is also an extraction surface. Note this attack is on a model whose weights were already public, so what it extracts is a deployable clone - the lesson is that logprob exposure costs you model ACCESS control, not model SECRECY.