Model weight theft

What it is

A model's weights are a file. Whoever has the file has the model: its capability, the investment behind it, and whatever it memorised. Theft by conventional means, such as compromised storage, an insider or a weak supplier, is quicker and more complete than extraction through the interface. Fine-tuned adapters are small, easily moved and often less well protected than the base model.

How it happens

• Weights are stored where many staff or systems can read them.
• A development or experiment-tracking system exposes artefact locations.
• A departing employee copies them.
• A hosting or fine-tuning supplier is compromised.

Why it matters

Beyond the commercial loss, the thief can study the model without limit: search for inputs that defeat it, recover training data, or remove its safeguards. Stolen weights cannot be recalled, and the organisation may not learn of the loss until a copy appears elsewhere. If the model was trained on personal data, the theft may also be a reportable breach.

Warning signs

• No inventory of where weights are stored.
• Access to artefact stores is broad, shared or unlogged.
• Large transfers from artefact storage.
• Supplier contracts are silent on custody of weights.

Who owns it

The model owner is accountable for the asset. Security owns the access standard and monitoring. Third-party risk covers suppliers who hold weights.

In practice

A fine-tuned underwriting model is kept in a storage bucket whose access list was widened during a migration and never narrowed. A contractor's compromised laptop is used to copy the bucket. The same pattern generalises to any model whose files are protected less carefully than the data used to train it.