Can't Hide Behind the API: Stealing Black-Box Commercial Embedding Models

TL;DR

This paper demonstrates that commercial black-box embedding models can be effectively stolen and replicated at low cost by training surrogate models on API-generated data, raising security concerns.

Contribution

It introduces a novel method to steal proprietary embedding models by training on API outputs, showing effective replication with minimal cost and model size reduction.

Findings

Replicated commercial embedding models with under $300 cost.

Distilled multiple teacher models into a single robust student.

Achieved competitive retrieval performance with smaller models.

Abstract

Embedding models that generate dense vector representations of text are widely used and hold significant commercial value. Companies such as OpenAI and Cohere offer proprietary embedding models via paid APIs, but despite being "hidden" behind APIs, these models are not protected from theft. We present, to our knowledge, the first effort to "steal" these models for retrieval by training thief models on text-embedding pairs obtained from the APIs. Our experiments demonstrate that it is possible to replicate the retrieval effectiveness of commercial embedding models with a cost of under $300. Notably, our methods allow for distilling from multiple teachers into a single robust student model, and for distilling into presumably smaller models with fewer dimension vectors, yet competitive retrieval effectiveness. Our findings raise important considerations for deploying commercial embedding models and suggest measures to mitigate the risk of model theft.