 However, the attacker will be able to replicate a partial model.  OWASP. org 30 | OWASP Top 10 for LLM v1. 0 The attack vector for functional model replication involves using the target model via prompts to generate synthetic training data (an approach called "self-instruct") to then use it and fine-tune another foundational model to produce a functional equivalent.  This bypasses the limitations of traditional query-based extraction used in Example 5 and has been successfully used in research of using an LLM to train another LLM