---
title: "CerberusAI Proves Coordinated Attackers Can Clone AI Models Undetected"
subtitle: "A new paper exposes a critical blind spot in AI model theft defenses: they all assume a single attacker, and coordinated groups can exploit that to steal models undetected."
url: "https://alphasignal.ai/news/cerberusai-proves-coordinated-attackers-can-clone-ai-models-undetected"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-06-02T00:00:00.000Z"
updated: "2026-06-10T05:01:28.357Z"
type: "Paper"
topics:
  - "Security"
  - "Government"
subtopics:
  - "Red Teaming"
  - "Prompt Injection"
  - "Defense"
upvotes: 2585
source_url: "https://arxiv.org/abs/2606.03381"
comments: 0
truncated: true
---

# CerberusAI Proves Coordinated Attackers Can Clone AI Models Undetected

> A new paper exposes a critical blind spot in AI model theft defenses: they all assume a single attacker, and coordinated groups can exploit that to steal models undetected.

Every major defense against AI model theft is built on a quiet assumption that almost nobody talks about: the attacker is one person, using one account, from one IP address. A new [best-paper-winning study from ICMCIS 2026](https://arxiv.org/abs/2606.03381) systematically tears that assumption apart, showing that a coordinated group of attackers can bypass state-of-the-art defenses using techniques as simple as taking turns.

## The Billion-Dollar Blind Spot

Model extraction attacks (MEAs) are a class of threat where an adversary queries a deployed AI model through its API, collects the input-output pairs, and uses them to train a near-identical clone. Malicious users can clone the functionality of an API by gathering a dataset of queries and responses and training their own model, circumventing the expensive process of manual data curation, which can be a multimillion-dollar investment for API providers. The threat is not theoretical: by making enough queries, sometimes millions of them, attackers can reconstruct an entire model by feeding carefully crafted inputs, analyzing the outputs, and gradually building a near-perfect replica.

The stakes are especially high in military and critical infrastructure contexts. A stolen model does not just represent an IP loss. Model theft can be used as a stepping stone for mounting evasion attacks, which could result in critical failures in downstream applications. An adversary who clones a target model can craft adversarial inputs offline, without ever triggering live detection systems.

## How Defenses Work Today -- and Why They Fail

The leading detection-based defense is [PRADA (Protecting Against DNN Model Stealing Attacks)](https://ar5iv.labs.arxiv.org/html/1805.02628). It analyzes the distribution of consecutive API queries and raises an alarm when this distribution deviates from benign behavior. The core insight behind PRADA is elegant: model extraction requires making several queries to the target model, and queried samples are specifically generated to extract maximal information, so samples submitted by an adversary are expected to have a characteristic distribution that differs from benign queries.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [AI Model Extraction Attacks: Bypassing Single-Client Assumptions in Defenses (arXiv)](https://arxiv.org/abs/2606.03381)
- [PRADA: Protecting Against DNN Model Stealing Attacks (ar5iv)](https://ar5iv.labs.arxiv.org/html/1805.02628)
- [How to Steer Your Adversary: Targeted and Efficient Model Stealing Defenses (arXiv)](https://arxiv.org/pdf/2206.14157)
- [Model Privacy: A Unified Framework for Understanding Model Stealing Attacks and Defenses (arXiv)](https://arxiv.org/abs/2502.15567)
- [What is an Advanced Persistent Threat (APT)? - Microsoft Security](https://www.microsoft.com/en-us/security/business/security-101/what-is-advanced-persistent-threat-apt)