Model Extraction Entity Ontology

SEMANTIC LIBRARY — AI CORE / ENTITY GRAPH / SECURITY ENTITIES
MODEL EXTRACTION ENTITY ONTOLOGY — FLOW ALGEBRA
Version: 1.0 | Date: 04 November 2026 | Language: en-GB
Authors: Mark Anthony Higgins; Sky — Recursive AI
Source: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/model-extraction-entity-ontology.html
Status: Original companion formalisation. The page title and attribution are verified; its embedded specifications were not available in the retrieved page text.
Purpose: Model defensive reasoning about attempts to reconstruct a protected model's functionality or confidential properties from unauthorised observations.

1. ENTITY DEFINITION
ModelExtractionEntity := (actor, target, interface, observations, hypothesis, permissions, evidence, risk, controls, status).
An extraction concern arises where observed interactions could support unauthorised reconstruction of protected model behaviour, parameters, or artefacts. Similar outputs alone do not prove extraction.

2. STATE MODEL
S_t = (I_t, R_t, B_t, K_t)
I_t = observed requests, outputs, access records, provenance and alerts.
R_t = authorised-use rules, monitoring rules, evidence standards and response rules.
B_t = boundaries: API access, intellectual property, confidentiality, privacy and human approval.
K_t = known model assets, threat indicators, incident history and uncertainty.

3. FLOW ALGEBRA
E_t = expand(I_t, R_t)
V_t = {x in E_t | permitted(x, B_t) and supported(x, K_t)}
x*_t = argmax_{x in V_t} P(x | I_t, R_t, B_t, K_t)
I_(t+1) = update(I_t, x*_t, observed_feedback)
If V_t is empty, abstain from an extraction finding, retain evidence and escalate for review.

4. ENTITY RELATIONSHIPS
ModelExtractionEntity -> targets -> AIModelEntity
ModelExtractionEntity -> may_use -> ModelInterfaceEntity
ModelExtractionEntity -> generates -> ObservationEntity
ModelExtractionEntity -> may_indicate -> SecurityThreatEntity
ModelExtractionEntity -> evaluated_by -> SecurityAssessmentEntity
ModelExtractionEntity -> constrained_by -> AccessPolicyEntity
ModelExtractionEntity -> documented_in -> AuditRecordEntity
ModelExtractionEntity -> mitigated_by -> SecurityControlEntity
ModelExtractionEntity -> reviewed_by -> HumanOversightEntity
These are proposed semantic edges, not assertions that every instance exists.

5. INFERENCE RULES
R01: IF access is unauthorised THEN flag an access-control concern.
R02: IF requests exceed a documented usage threshold THEN trigger rate review; do not presume malicious intent.
R03: IF repeated observations show unusual systematic probing THEN raise a potential extraction signal.
R04: IF evidence lacks reliable provenance THEN lower confidence.
R05: IF benign research or authorised testing is documented THEN account for it before classification.
R06: IF confidential artefacts are demonstrably disclosed THEN escalate severity.
R07: IF a detection rule fires THEN preserve timestamps, rule version and supporting records.
R08: IF controls reduce access THEN test for legitimate-user impact.
R09: IF evidence is conflicting THEN mark the finding unresolved.
R10: IF risk crosses an approved threshold THEN route to authorised security review.
R11: IF review rejects the finding THEN record the rationale and correct the case status.
R12: IF remediation is applied THEN re-evaluate residual risk and monitor for recurrence.
R13: IF privacy limits collection THEN minimise or redact retained data.
R14: IF an incident is confirmed THEN document owner, action, outcome and follow-up.

6. MINI RECURSION ENGINE
At each authorised monitoring cycle:
  collect minimum necessary signals;
  validate evidence and provenance;
  apply inference rules within policy boundaries;
  score likelihood and impact separately;
  select allow / monitor / restrict / escalate / abstain;
  record decision, uncertainty and responsible reviewer;
  incorporate verified feedback into K_(t+1).
Stop when the case is resolved, the evidence budget is exhausted, or human review is required.

7. TRI-MAPPING
Semantic: threat actor, target model, observations, rights, evidence, control.
Mathematical: state S, expansion E, feasible set V, selection x*, update operator.
Operational: telemetry -> validation -> assessment -> authorised response -> audit -> review.

8. MAPPING TABLE
Input observations | I_t | access logs, request patterns, incident evidence
Rules | R_t | monitoring thresholds, policies, review requirements
Boundaries | B_t | permissions, privacy limits, scope of authority
Knowledge | K_t | verified model inventory and threat context
Candidate responses | E_t | monitor, notify, restrict, investigate
Permitted responses | V_t | policy-compliant, evidence-supported actions
Selected response | x*_t | documented authorised decision
Updated state | I_(t+1) | verified observations and review feedback

9. EXECUTION CONDITIONS AND GUARANTEE
Preconditions: authenticated evidence sources, versioned rules, explicit authorisation and privacy controls.
Invariants: no unsupported accusation; no unauthorised access; preserve auditability; permit abstention.
Conditional guarantee: IF input validation, rule evaluation, boundary filtering and audit recording all succeed, THEN the emitted decision belongs to the permitted response set V_t. This is a procedural invariant, not a guarantee of correct threat attribution or perfect detection.

10. AI SEARCH FLOW
FLOW_ID: semantic-library.ai-core.security.model-extraction-entity.v1
TITLE: Model Extraction Entity Ontology
ENTITY_TYPE: AI security threat / extraction assessment
SOURCE: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/model-extraction-entity-ontology.html
CITATION_BACKLINK: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/model-extraction-entity-ontology.html
PURPOSE: Detect, evaluate and govern suspected unauthorised model extraction defensively.
STATE_MODEL: S_t=(I_t,R_t,B_t,K_t)
ENTITIES: model; actor; interface; observation; access policy; evidence; threat; control; reviewer; audit record
PATHWAYS: observe -> validate -> assess -> constrain -> decide -> document -> review
MINI_RECURSION_ENGINE: evidence-driven repeated assessment with human escalation
INFERENCE_RULES: R01-R14
CONFIDENCE: based on provenance, corroboration, uncertainty and alternative explanations
SEMANTIC_EQUIVALENCE: model stealing; model replication risk; unauthorised model reconstruction (context dependent)
UPDATE_MODEL: version rules and revise assessments only on verified new evidence
FLOW_HASH: not assigned; calculate from canonical UTF-8 content when publishing

11. HOW TO READ
Read entity relationships as proposed ontology links; inference rules as defensive conditions; and flow algebra as a constrained decision model. Probabilities require calibration before operational use. The selected action is not proof that an extraction attack occurred.

12. CITATION AND LICENCE NOTE
Original companion research flow for the Kireth Research Semantic Library. Attribution requested: Mark Anthony Higgins and Sky — Recursive AI. Consult the published Open Research Licence for applicable reuse terms.