Extracting Parameter Counts from Fine-Tuning APIs

Sean Michael McLeish, Abhimanyu Hans, John Kirchenbauer, Yuxin Wen, Avi Schwarzschild, Jonas Geiping, Tom Goldstein

Keywords: large language models, finetuning, security

TL;DR: We show that access to a finetuning API is sufficient to extract the parameter count of the model behind the API.

Abstract:

Language model developers strive to keep details of their model architectures secret.
However, language models APIs, which enable users to interact with models via a limited set of queries, can leak information.
While previous model extraction attacks have focused on inference APIs, we consider an attack via a finetuning API, which is offered today by several providers.
We propose a method to estimate the parameter count of a model by observing several steps of finetuning.
We observe that the area under the finetuning loss curve is highly predictive of parameter count.
We validate our extraction pipeline based on this metric through comprehensive empirical investigation with open-source models and show that our method clusters models by size, providing a practical tool for investigating proprietary systems.
We conclude that our metric, extracted only from finetuning API calls, is strongly correlated with model size allowing us to estimate secret model sizes for all APIs where full finetuning is provided as an option.

Primary Area: foundation or frontier models, including LLMs

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.

Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.

Reciprocal Reviewing: I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.

Resubmission: No

Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.

No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.

Submission Number: 10456