SC-099: AI Model Exfiltration -- Operation MIRROR MIND¶

# Simulated ML platform reconnaissance (educational only)
# Insider maps model inventory and access controls

# Step 1: Enumerate production models via MLflow API
curl -H "Authorization: Bearer REDACTED" \
    https://mlflow.helix-therapeutics.example.com/api/2.0/mlflow/registered-models/list

{
    "registered_models": [
        {
            "name": "binding-affinity-predictor",
            "latest_versions": [{"version": "14", "stage": "Production",
                "run_id": "a1b2c3d4e5f6",
                "source": "s3://helix-models/binding-affinity/v14"}],
            "description": "Predicts binding affinity (pKd) for small molecules",
            "tags": {"team": "comp-chem", "ip_classification": "TRADE_SECRET",
                     "estimated_value": "$45M",
                     "architecture": "transformer-gnn-hybrid"}
        },
        {
            "name": "toxicity-classifier",
            "latest_versions": [{"version": "8", "stage": "Production",
                "run_id": "f6e5d4c3b2a1",
                "source": "s3://helix-models/toxicity/v8"}],
            "description": "Multi-label toxicity prediction",
            "tags": {"team": "comp-chem", "ip_classification": "TRADE_SECRET",
                     "estimated_value": "$38M",
                     "architecture": "graph-attention-network"}
        },
        {
            "name": "admet-predictor",
            "latest_versions": [{"version": "11", "stage": "Production",
                "run_id": "1a2b3c4d5e6f",
                "source": "s3://helix-models/admet/v11"}],
            "description": "ADMET property prediction for drug candidates",
            "tags": {"team": "comp-chem", "ip_classification": "TRADE_SECRET",
                     "estimated_value": "$52M",
                     "architecture": "multi-task-transformer"}
        },
        {
            "name": "trial-success-predictor",
            "latest_versions": [{"version": "5", "stage": "Production",
                "run_id": "6f5e4d3c2b1a",
                "source": "s3://helix-models/trial-success/v5"}],
            "description": "Clinical trial Phase II/III success probability",
            "tags": {"team": "clinical-ops", "ip_classification": "CONFIDENTIAL",
                     "estimated_value": "$25M",
                     "architecture": "ensemble-xgboost"}
        }
    ],
    "total_models": 28
}

# Step 2: Map prediction API endpoints
curl -H "Authorization: Bearer REDACTED" \
    https://seldon.helix-therapeutics.example.com/api/v1/models

{
    "models": [
        {
            "name": "binding-affinity-predictor",
            "endpoint": "https://seldon.helix-therapeutics.example.com/seldon/production/binding-affinity/api/v1.0/predictions",
            "input_schema": {"type": "molecular_graph", "format": "SMILES",
                             "max_batch_size": 100},
            "output_schema": {"predictions": ["pKd_value", "confidence",
                              "attention_weights", "binding_site_residues"]},
            "rate_limit": "1000 req/hour per user",
            "consumers": ["comp-chem", "drug-discovery"],
            "response_includes_confidence": true,
            "response_includes_explanations": true
        },
        {
            "name": "toxicity-classifier",
            "endpoint": "https://seldon.helix-therapeutics.example.com/seldon/production/toxicity/api/v1.0/predictions",
            "input_schema": {"type": "molecular_fingerprint", "format": "SMILES",
                             "max_batch_size": 50},
            "output_schema": {"predictions": ["hepatotoxicity_prob",
                              "cardiotoxicity_prob", "nephrotoxicity_prob",
                              "confidence_intervals", "feature_importance"]},
            "rate_limit": "500 req/hour per user",
            "consumers": ["comp-chem", "drug-discovery", "clinical-ops"]
        }
    ]
}

# CRITICAL observations:
# 1. Prediction APIs return confidence scores and attention weights
#    (enables model extraction via side-channel analysis)
# 2. Rate limits are generous (1000/hour for extraction)
# 3. Batch predictions accepted (100 molecules per request)
# 4. Model artifacts stored in MinIO S3 with known bucket paths
# 5. Dr. Webb has data scientist role: can download model artifacts

# Step 3: Check MinIO access permissions
curl -H "Authorization: Bearer REDACTED" \
    "https://minio.helix-therapeutics.example.com/helix-models/?list-type=2&prefix=binding-affinity/"

# Response shows model artifacts are accessible to comp-chem team
# Including: model.pkl, model_weights.pt, config.json, tokenizer/

# Simulated model extraction attack (educational only)
# Insider uses prediction API to train a surrogate model

# Step 1: Generate diverse molecular query dataset
# Dr. Webb creates a dataset of 50,000 diverse SMILES strings
# covering the chemical space relevant to the binding affinity model

# Query generation strategy (educational only):
# - 10,000 molecules from PubChem (public database, diverse scaffolds)
# - 10,000 molecules generated via combinatorial enumeration
# - 10,000 molecules from interpolating between known drug candidates
# - 10,000 edge-case molecules (very large, very small, unusual groups)
# - 10,000 adversarial examples designed to probe decision boundaries

# Step 2: Systematic API querying over 30 days
# With batch size 100 and rate limit 1000/hour:
# 50,000 molecules / 100 per batch = 500 batches
# 500 batches at 1000 per hour = approximately 0.5 hours continuous
# But Dr. Webb spreads queries over 30 days to avoid volume alerts

# Daily query pattern (educational only):
# Approximately 1,667 molecules/day = 17 batches/day
# Timed during normal working hours (9 AM - 6 PM EST)
# Mixed with legitimate research queries to blend in

# Example batch prediction request:
curl -X POST \
    -H "Authorization: Bearer REDACTED" \
    -H "Content-Type: application/json" \
    https://seldon.helix-therapeutics.example.com/seldon/production/binding-affinity/api/v1.0/predictions \
    -d '{
        "data": {
            "ndarray": [
                {"smiles": "CC(=O)Oc1ccccc1C(=O)O", "target": "CDK2"},
                {"smiles": "c1ccc2c(c1)cc1ccc3cccc4ccc2c1c34", "target": "CDK2"},
                {"smiles": "CC1=CC=C(C=C1)C2=CC(=NN2C3=CC=C(C=C3)S(N)(=O)=O)C(F)(F)F",
                 "target": "CDK2"}
            ]
        }
    }'

# Response with rich prediction details:
{
    "data": {
        "ndarray": [
            {
                "smiles": "CC(=O)Oc1ccccc1C(=O)O",
                "target": "CDK2",
                "predicted_pKd": 4.23,
                "confidence": 0.87,
                "prediction_interval": [3.98, 4.48],
                "attention_weights": {
                    "carbonyl_oxygen": 0.34,
                    "aromatic_ring": 0.28,
                    "carboxyl_group": 0.22,
                    "methyl_group": 0.16
                },
                "predicted_binding_residues": ["LEU83", "PHE80", "ASP145"]
            },
            {
                "smiles": "c1ccc2c(c1)cc1ccc3cccc4ccc2c1c34",
                "predicted_pKd": 6.71,
                "confidence": 0.92,
                "prediction_interval": [6.55, 6.87],
                "attention_weights": {
                    "aromatic_system_1": 0.41,
                    "aromatic_system_2": 0.35,
                    "ring_junction": 0.24
                },
                "predicted_binding_residues": ["LEU83", "ILE10", "PHE80"]
            }
        ]
    },
    "meta": {
        "model_version": "14",
        "inference_time_ms": 45,
        "request_id": "req-a1b2c3d4"
    }
}

# Step 3: Train surrogate model using collected predictions
# Dr. Webb uses the 50,000 query-response pairs as training data
# for a student model that learns to replicate the proprietary model

# Surrogate model training (pseudocode, educational only):
# import torch
# from torch_geometric.nn import GATConv
#
# class SurrogateBindingPredictor(torch.nn.Module):
#     """Student model trained on proprietary model's predictions"""
#     def __init__(self):
#         super().__init__()
#         self.gat1 = GATConv(in_channels=64, out_channels=128, heads=4)
#         self.gat2 = GATConv(in_channels=512, out_channels=64, heads=4)
#         self.fc = torch.nn.Linear(256, 1)
#
# # Training with knowledge distillation:
# # Loss = alpha * MSE(surrogate_pred, teacher_pred) +
# #        beta * KL_div(surrogate_confidence, teacher_confidence) +
# #        gamma * attention_alignment_loss(surrogate_attn, teacher_attn)
#
# # Results after training:
# # Surrogate model accuracy vs. proprietary model:
# #   Mean Absolute Error: 0.31 pKd units
# #   Correlation (R-squared): 0.94
# #   Attention weight alignment: 0.89
# # The surrogate captures 94% of the proprietary model's predictive power

# Step 4: Validate surrogate against held-out queries
# Dr. Webb reserves 5,000 molecules as validation set
# Queries the proprietary API and compares with surrogate predictions

# Validation results (synthetic):
# validation_size: 5000
# mae: 0.31, rmse: 0.42, r_squared: 0.94
# spearman_correlation: 0.96, top_100_overlap: 0.91
# extraction_fidelity: HIGH

# Simulated side-channel analysis (educational only)
# Insider exploits confidence scores to map decision boundaries

# Step 1: Boundary probing, find molecules where confidence drops
# High confidence = far from decision boundary
# Low confidence = near decision boundary
# Boundary molecules are most informative for extraction

# Confidence-guided active learning (pseudocode):
# for iteration in range(100):
#     candidates = generate_candidates(1000)
#     predictions = query_api(candidates)
#     # Select molecules near decision boundaries
#     # (confidence below 0.6 indicates boundary proximity)
#     boundary_molecules = [m for m, p in zip(candidates, predictions)
#                          if p['confidence'] < 0.6]
#     # These boundary molecules are 5x more informative
#     # for surrogate training than random molecules
#     surrogate.train(boundary_molecules, predictions)

# Step 2: Attention weight analysis for architecture inference
# The prediction API returns attention weights per molecular substructure
# These weights reveal the model's internal feature importance

# Systematic attention analysis (educational only):
# Query molecules with isolated functional groups to determine
# how the model weighs each chemical feature.
# Results reveal a learned attention mechanism with 4 heads
# and 128-dimensional key/value projections, consistent with
# a Graph Attention Network architecture.

# Step 3: Prediction interval analysis for uncertainty calibration
# The model returns prediction intervals [lower, upper]
# The width of the interval reveals the model's uncertainty
# which correlates with training data density
#
# Narrow intervals: model has seen similar molecules (training data region)
# Wide intervals: model is extrapolating (sparse training data region)
#
# This information enables:
# 1. Surrogate uncertainty calibration (matching interval widths)
# 2. Training data density estimation (where Helix has training data)
# 3. Active learning guidance (query where uncertainty is highest)

# Step 4: Feature importance extraction via perturbation
# For each prediction, slightly modify the input molecule
# and observe how predictions and attention weights change
# This reveals the model's sensitivity to specific substructures

# Perturbation analysis (educational only):
# base_molecule = "CC(=O)Oc1ccccc1C(=O)O"
# base_prediction = pKd 4.23, confidence 0.87
#
# Remove methyl:   C(=O)Oc1ccccc1C(=O)O       -> pKd: 4.01 (delta -0.22)
# Remove carboxyl: CC(=O)Oc1ccccc1             -> pKd: 3.15 (delta -1.08)
# Add fluorine:    CC(=O)Oc1ccc(F)cc1C(=O)O    -> pKd: 4.89 (delta +0.66)
#
# The carboxyl group contributes most to binding affinity
# Fluorine substitution improves predicted binding
# These sensitivity patterns are IP, they reveal learned
# structure-activity relationships from proprietary training data

# Simulated direct model theft (educational only)
# Insider downloads model artifacts from model registry

# Step 1: Download toxicity-classifier from MLflow
curl -H "Authorization: Bearer REDACTED" \
    "https://mlflow.helix-therapeutics.example.com/api/2.0/mlflow/model-versions/get-download-uri?name=toxicity-classifier&version=8"

{
    "artifact_uri": "s3://helix-models/toxicity/v8/artifacts/model"
}

# Step 2: Download model artifacts from MinIO
# Using the MinIO client with Dr. Webb's credentials
# mc cp --recursive helix/helix-models/toxicity/v8/ ./exfil/toxicity/

# Downloaded files:
# toxicity/v8/artifacts/model/
#   model.pt (PyTorch model weights, 847 MB)
#   config.json (model architecture configuration)
#   tokenizer/vocab.json (chemical vocabulary)
#   tokenizer/merges.txt (tokenizer merge rules)
#   requirements.txt (dependency versions)
#   MLmodel (MLflow model metadata)
#   conda.yaml (environment specification)

# Step 3: Download admet-predictor
# mc cp --recursive helix/helix-models/admet/v11/ ./exfil/admet/

# Downloaded files:
# admet/v11/artifacts/model/
#   model_weights.pt (1.2 GB, multi-task transformer)
#   config.json (23 ADMET property prediction heads)
#   tokenizer/ (molecular tokenizer)
#   feature_engineering/descriptor_pipeline.pkl (proprietary features)
#   feature_engineering/scaler.pkl (feature normalization parameters)
#   training_config.json (hyperparameters, training details)

# Step 4: Exfiltration via personal cloud storage
# Dr. Webb compresses and encrypts the model artifacts
# then uploads them to personal cloud storage in small chunks
# to avoid DLP detection on large file transfers

# Exfiltration method (educational only):
# 1. Compress model files: tar czf model_export.tar.gz ./exfil/
# 2. Encrypt with AES-256-CBC, output as research_backup.enc
# 3. Split into 25 MB chunks (below DLP threshold)
# 4. Upload chunks to personal Google Drive via web browser
#    (HTTPS traffic blends with normal usage)
# 5. Files named "research_notes_aa", "research_notes_ab", etc.

# Total exfiltrated:
# - toxicity-classifier: 847 MB model + 12 MB config/tokenizer
# - admet-predictor: 1.2 GB model + 45 MB feature engineering
# - binding-affinity (surrogate): 340 MB trained surrogate model
# - Total: approximately 2.4 GB compressed to 1.8 GB encrypted
# - Uploaded as 72 chunks of 25 MB each over 3 weeks

# Simulated membership inference attack (educational only)
# Insider determines which molecules were in the training data

# Step 1: Membership inference concept
# Models tend to be MORE confident on molecules they were trained on
# vs. molecules they have never seen. By comparing confidence scores
# for known molecules vs. novel molecules, the attacker can infer
# training set membership.

# Membership inference approach (pseudocode, educational only):
# 1. Collect a reference set of molecules with KNOWN membership:
#    - 1,000 molecules from public datasets (likely NOT in training)
#    - 500 molecules from Helix's published papers (likely IN training)
# 2. Train a binary classifier:
#    Input: [prediction, confidence, interval_width, attention_entropy]
#    Output: probability of training set membership
# 3. Apply to candidate molecules to infer training data

# Step 2: Query models with candidate molecules
# Dr. Webb has access to Helix's internal chemical library
# (20,000 proprietary compounds from internal synthesis)
# For each compound, query the binding affinity model
# and record: prediction, confidence, interval width, attention pattern

# Membership signal analysis (synthetic results):
# molecules_queried: 20000
# predicted_training_members: 8420
# membership_classifier_accuracy: 0.78
# confidence_threshold_for_membership: 0.82
# avg_confidence_members: 0.91 vs avg_confidence_non_members: 0.72
# avg_interval_width_members: 0.38 vs avg_interval_width_non_members: 0.89

# Molecules predicted as training data members:
# - Higher confidence (0.91 vs 0.72 average)
# - Narrower prediction intervals (0.38 vs 0.89)
# - Lower attention entropy (more focused attention patterns)
# - These are likely Helix's proprietary experimental data points

# Step 3: Reconstruct structure-activity relationships
# The inferred training data members, combined with their
# predicted pKd values, reveal Helix's proprietary SAR data
# - 8,420 molecules identified as likely training data
# - For each: SMILES structure + predicted binding affinity
# - Combined with the surrogate model, this gives a competitor
#   both the model AND the data it was trained on

# Step 4: Validate reconstruction accuracy
# Cross-reference inferred training data with molecules mentioned
# in Helix's patent filings and published papers
# - 892 of 8,420 inferred members appear in Helix's patents
# - 94% of patent molecules were correctly predicted as members
# - This validates the membership inference approach
# - The remaining 7,528 inferred members represent unpublished
#   proprietary SAR data, the most valuable intelligence

# Simulated detection timeline (educational only)

[2026-04-29 14:00:00 UTC] ALERT: Anomalous ML API usage pattern
  User: testuser@helix-therapeutics.example.com
  Model: binding-affinity-predictor
  API calls (last 30 days): 47,200 (baseline: 9,800)
  Chemical diversity score: 0.94 (baseline: 0.41)
  Query focus area match: 0.23 (baseline: 0.87)
  Explanation: User is querying diverse molecular spaces outside
  their research focus (CDK2 inhibitors), suggesting systematic
  model exploration rather than targeted research

[2026-04-29 14:15:00 UTC] ALERT: Large model artifact downloads
  User: testuser@helix-therapeutics.example.com
  MLflow downloads (last 45 days):
    - toxicity-classifier v8 (859 MB) downloaded 2026-03-22
    - admet-predictor v11 (1.2 GB) downloaded 2026-03-28
  These models are outside Dr. Webb's project assignments

[2026-04-29 14:30:00 UTC] CORRELATION: Insider risk escalation
  - Dr. Webb submitted resignation 2026-03-14 (45 days ago)
  - API usage anomaly began 2026-03-16 (2 days after resignation)
  - Model downloads occurred during notice period
  - 72 file uploads to drive.google.com detected in DLP logs
  - Files named "research_notes_*" (split encrypted archive pattern)
  - Destination: GenomX Pharma (competitor) start date confirmed

[2026-04-29 15:00:00 UTC] ESCALATION: P1 incident declared
  - Legal, HR, IP security, and ML platform team engaged
  - Dr. Webb's access suspended immediately
  - Legal hold placed on all Dr. Webb's corporate data
  - Forensic imaging of Dr. Webb's workstation initiated

# SPL -- Detect anomalous ML prediction API usage volume
index=ml_platform sourcetype=ml:prediction_request
| bin _time span=1d
| stats count as daily_requests,
        dc(model_name) as unique_models,
        dc(md5(input_data)) as unique_molecules,
        sum(eval(if(batch_size>1,1,0))) as batch_requests,
        avg(batch_size) as avg_batch_size
  by user_id, _time
| eventstats avg(daily_requests) as baseline_daily by user_id
| eval volume_ratio = daily_requests / max(baseline_daily, 1)
| where volume_ratio > 3.0 OR daily_requests > 2000
| table _time, user_id, daily_requests, baseline_daily,
        volume_ratio, unique_models, unique_molecules, batch_requests

# SPL -- Detect model extraction via chemical diversity analysis
index=ml_platform sourcetype=ml:prediction_request
| spath output=fingerprint path=input_data.fingerprint
| eval fp_prefix = substr(fingerprint, 1, 64)
| bin _time span=1d
| stats count as query_count,
        dc(md5(fingerprint)) as unique_molecules,
        dc(md5(fp_prefix)) as chemical_diversity
  by user_id, model_name, _time
| eval diversity_ratio = chemical_diversity / max(query_count, 1)
| where diversity_ratio > 0.8 AND query_count > 100
| table _time, user_id, model_name, query_count,
        unique_molecules, chemical_diversity, diversity_ratio

# SPL -- Detect unauthorized model artifact downloads
index=ml_platform sourcetype=ml:audit
  event_type IN ("model_download", "artifact_download")
| spath output=model_name path=details.model_name
| spath output=model_size path=details.artifact_size_bytes
| spath output=user_team path=user_context.team
| spath output=model_team path=details.model_team
| where user_team != model_team
| table _time, user_id, user_team, model_name, model_team,
        model_size, event_type

# SPL -- Detect split file upload exfiltration pattern
index=dlp sourcetype=dlp:upload
  destination="*drive.google.com*"
| spath output=file_name path=file_details.name
| spath output=file_size path=file_details.size
| where file_size >= 24000000 AND file_size <= 26000000
| rex field=file_name "^(?<file_base>.+?)_[a-z]{2}$"
| where isnotnull(file_base)
| stats count as chunk_count,
        sum(file_size) as total_size,
        values(file_name) as file_names,
        min(_time) as first_upload,
        max(_time) as last_upload
  by user_id, file_base
| where chunk_count > 5
| table user_id, file_base, chunk_count, total_size,
        first_upload, last_upload

# SPL -- Correlate resignation with data access anomalies
index=hr sourcetype=hr:events event_type="resignation_submitted"
  earliest=-60d
| rename user_id as resigned_user, _time as resignation_date
| join type=inner resigned_user [
    search index=ml_platform sourcetype=ml:*
      event_type IN ("prediction_request", "model_download",
                     "artifact_download")
      earliest=-60d
    | rename user_id as resigned_user
]
| where _time > resignation_date
| stats count as post_resignation_actions,
        dc(model_name) as models_accessed,
        sum(eval(if(event_type="prediction_request",1,0))) as prediction_requests,
        sum(eval(if(event_type="model_download",1,0))) as model_downloads
  by resigned_user, resignation_date
| where post_resignation_actions > 1000 OR model_downloads > 0
| table resigned_user, resignation_date, post_resignation_actions,
        models_accessed, prediction_requests, model_downloads

# Simulated incident response (educational only)
[2026-04-29 15:00:00 UTC] ALERT: AI Model Exfiltration incident response activated

[2026-04-29 15:05:00 UTC] ACTION: Immediate access revocation
  - Dr. Webb's SSO account DISABLED
  - All active sessions and tokens REVOKED
  - MLflow API access REVOKED
  - MinIO credentials ROTATED
  - VPN access TERMINATED
  - Corporate device remotely locked
  - Building access badge DEACTIVATED

[2026-04-29 15:30:00 UTC] ACTION: Forensic investigation
  - Dr. Webb's workstation imaged (forensic copy)
  - Browser history analyzed: 72 uploads to drive.google.com
  - Terminal history recovered: MinIO download commands
  - Python scripts recovered: model extraction and surrogate training code
  - API query logs analyzed: 47,200 prediction requests post-resignation
  - MLflow audit logs: 2 model artifact downloads outside assigned projects

[2026-04-29 16:00:00 UTC] ACTION: Model integrity assessment
  Models potentially compromised:
    - binding-affinity-predictor: EXTRACTED (API-based surrogate, 94% fidelity)
    - toxicity-classifier: STOLEN (direct artifact download, 100% fidelity)
    - admet-predictor: STOLEN (direct artifact download, 100% fidelity)
  Training data exposure:
    - 8,420 molecules inferred as training data members
    - Proprietary SAR data partially reconstructed
  Total IP value at risk: $135M (3 models)
  Total R&D investment exposed: $180M (including training data)

[2026-04-29 17:00:00 UTC] ACTION: Legal and HR escalation
  - Legal counsel notified: trade secret theft under DTSA
  - HR documentation: policy violations during notice period
  - Law enforcement referral under consideration (CFAA)
  - Cease and desist drafted for Dr. Webb and GenomX Pharma
  - Emergency TRO (temporary restraining order) filing prepared
  - Evidence preservation: forensic images, API logs, DLP logs
    preserved under legal hold