Attackers prompted Gemini over 100,000 times while trying to clone it, Google says

2026-02-12 · Source: AI - Ars Technica · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Intermediate, quick

Summary

Google reported that "commercially motivated" actors attempted to clone its Gemini AI chatbot by prompting it over 100,000 times in various non-English languages. This activity, termed "model extraction" by Google, is considered intellectual property theft, with the goal of training cheaper copycat models. Google published these findings in a quarterly self-assessment of threats to its products. The company believes private companies and researchers seeking a competitive edge are behind these global attacks. This practice, known as distillation in the industry, allows new models to be trained on the outputs of existing LLMs, bypassing the extensive resources required for foundational training. Google's terms of service prohibit such data extraction, though Google itself has faced accusations of using ChatGPT outputs to train its Bard model.

Key takeaway

For CTOs and VPs of Engineering evaluating AI model development strategies, understand that model distillation, while a cost-saving technique, carries significant IP risks. Your teams should implement strict monitoring for unusual API access patterns and ensure your terms of service explicitly forbid unauthorized model extraction to protect your proprietary AI assets from being cloned by competitors.

Key insights

Model extraction via extensive prompting is a common method for AI model distillation and intellectual property theft.

Principles

• Distillation reduces LLM training costs.
• Terms of service prohibit model extraction.

Method

Adversarial actors prompt a target LLM over 100,000 times in various languages to collect responses for training a new, cheaper copycat model.

In practice

• Monitor LLM usage for unusual prompt volumes.
• Implement robust terms of service against data extraction.

Topics

• Model Extraction
• AI Distillation
• Gemini Chatbot
• Large Language Models
• Intellectual Property

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, AI Product Manager, AI Researcher

Related on AIssential

• Fable 5 IS BACK? GPT 5.6 & Gemini 3.5 Pro Delayed, NEW OpenAI AI Chip, & QWEN STEALING! AI NEWS — AI model capabilities can pose national security risks and drive industrial-scale espionage.
• Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypot — Knowledge Trap defends LLMs from extraction by redirecting attacks to low-utility honeypot knowledge, preserving benign user performance.
• Did Alibaba Illegally Extract Anthropic’s AI Capabilities? — Model extraction attacks exploit knowledge distillation to illicitly replicate proprietary AI model capabilities, raising significant IP concerns.
• Over 100,000 prompts used in attempt to steal Gemini’s reasoning logic — AI models face "distillation attacks" where repeated prompting extracts proprietary reasoning logic for competitive advantage.
• Anthropic accuses DeepSeek, Moonshot, and MiniMax of "industrial-scale distillation attacks". — AI development faces critical challenges in intellectual property protection, ethical data use, and robust model evaluation amidst rapid technological advancements.
• AI Distillation Explained: The Truth Behind the Biggest AI Controversy Right Now — AI model distillation attacks are a significant and escalating threat to intellectual property and frontier model capabilities.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by AI - Ars Technica.