rate-limiting
Installation
SKILL.md
Rate Limiting at the API Gateway
Security Requirement
API gateways protecting AI models SHOULD implement rate limiting. This is a critical defense against attacks that require sending large volumes of requests to the models.
Attacks Mitigated by Rate Limiting
| Attack | Description |
|---|---|
| Model data extraction | Attempting to extract sensitive information the model learned during training |
| Training data extraction | Reconstructing training data from model responses |
| Token extraction | Stealing API tokens or credentials through repeated probing |
| Weight extraction | Reverse-engineering model weights through systematic queries |
| Prompt injection probing | Brute-forcing prompt injection payloads |
These attacks typically require sending thousands to millions of requests. Rate limiting makes them impractical or too slow to be worthwhile.