auditing-ml-inference-endpoint-abuselisted

# Auditing ML inference endpoint abuse: a served model is an asset and a meter, both attackable A model exposed as an inference endpoint is two things worth attacking at once: a metered resource that costs money per call, and a confidential asset that queries can reconstruct. The abuses follow from that. If the endpoint is unauthenticated or weakly keyed, anyone can call it. If there is no per-caller rate or spend limit, a caller runs up unbounded inference cost, a denial-of-wallet against expensive model serving. Beyond cost, the model itself leaks to a determined querent: systematic queries reconstruct the model or its decision boundary (model extraction), and carefully chosen queries recover whether a specific record was in the training set or reconstruct sensitive training data (membership and inversion inference). Over-informative responses, full class probabilities, raw embeddings, confidence vectors, make both extraction and inversion far easier. The audit treats the endpoint as a cost meter and a confidential asset and checks the controls on both. You audit this by calling the endpoint as an attacker would: unauthenticated, at volume, and systematically. ## When to use - A model is deployed as a callable prediction or embedding endpoint (classifier, recommender, scorer). - The endpoint may be unauthenticated, weakly keyed, or lack per-caller rate and spend limits. - Responses may return full probabilities or embeddings, and the model or its training data is confide