Extracting Parameter Counts from Fine-Tuning APIs
large language models;finetuning;security
During a re-analysis of our data we discovered that some of the metrics of fine-tuning runs were not recorded correctly.  As a result, some figures and tables in this draft of the paper need to be revised.  We will withdraw this version as we re-run the impacted trials, and we look forward to submitting a revised and corrected version of this paper to the next deadline.
I have read and agree with the venue's withdrawal policy on behalf of myself and my co-authors.
We show that access to a finetuning API is sufficient to extract the parameter count of the model behind the API.
@misc{
mcleish2024extracting,
title={Extracting Parameter Counts from Fine-Tuning {API}s},
author={Sean Michael McLeish and Abhimanyu Hans and John Kirchenbauer and Yuxin Wen and Avi Schwarzschild and Jonas Geiping and Tom Goldstein},
year={2024},
url={https://openreview.net/forum?id=nmFT15OMAa}
}
Language model developers strive to keep details of their model architectures secret.  
However, language models APIs, which enable users to interact with models via a limited set of queries, can leak information. 
While previous model extraction attacks have focused on inference APIs, we consider an attack via a finetuning API, which is offered today by several providers. 
We propose a method to estimate the parameter count of a model by observing several steps of finetuning.
We observe that the area under the finetuning loss curve is highly predictive of parameter count. 
We validate our extraction pipeline based on this metric through comprehensive empirical investigation with open-source models and show that our method clusters models by size, providing a practical tool for investigating proprietary systems.
We conclude that our metric, extracted only from finetuning API calls, is strongly correlated with model size allowing us to estimate secret model sizes for all APIs where full finetuning is provided as an option.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
~Sean_Michael_McLeish1 ~Abhimanyu_Hans1 ~John_Kirchenbauer1 ~Yuxin_Wen2 ~Avi_Schwarzschild1 ~Jonas_Geiping1 ~Tom_Goldstein1
Sean Michael McLeish Abhimanyu Hans John Kirchenbauer Yuxin Wen Avi Schwarzschild Jonas Geiping Tom Goldstein
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
large language models finetuning security
I certify that there is no acknowledgement section in this submission for double blind review.
mcleish|extracting_parameter_counts_from_finetuning_apis
foundation or frontier models, including LLMs
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
No
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
Extracting Parameter Counts from Fine-Tuning APIs
ICLR 2025 Conference Withdrawn Submission
ICLR.cc/2025/Conference/Withdrawn_Submission