# Preventing Model Extraction in Contextual Linear Optimization

DevFeed: [Preventing Model Extraction in Contextual Linear Optimization](<https://devfeed.tech/articles/preventing-model-extraction-in-contextual-linear-optimization-94991.md>)

Original publisher: [Read original article](<https://arxiv.org/abs/2610.29918>)

Author: Adam N. Elmachtoub, Tianyi Lin, Wenxuan Liu

Published: 2026-10-22T04:00:00Z

Content type: article

Language: en

Sources: [arXiv: Machine Learning](<https://devfeed.tech/sources/arxiv-machine-learning.md>)

Topics: [Combinatorial optimization](<https://devfeed.tech/topics/combinatorial-optimization.md>), [concept-learning](<https://devfeed.tech/topics/concept-learning.md>), [threat detection](<https://devfeed.tech/topics/threat-detection.md>)

Tags: [adaptive](<https://devfeed.tech/tags/adaptive.md>), [attack](<https://devfeed.tech/tags/attack.md>), [context](<https://devfeed.tech/tags/context.md>), [cost](<https://devfeed.tech/tags/cost.md>), [cs-lg](<https://devfeed.tech/tags/cs-lg.md>), [defense](<https://devfeed.tech/tags/defense.md>), [distribution](<https://devfeed.tech/tags/distribution.md>), [error](<https://devfeed.tech/tags/error.md>), [experiments](<https://devfeed.tech/tags/experiments.md>), [linear](<https://devfeed.tech/tags/linear.md>), [math-oc](<https://devfeed.tech/tags/math-oc.md>), [model](<https://devfeed.tech/tags/model.md>), [optimization](<https://devfeed.tech/tags/optimization.md>), [prediction](<https://devfeed.tech/tags/prediction.md>), [prevent](<https://devfeed.tech/tags/prevent.md>)

## AI overview

In contextual linear optimization, observing decisions across context queries can reveal a prediction model up to positive scaling, despite the many-to-one mapping from costs to decisions. The paper describes an adaptive extraction attack that alternates inverse optimization with queries aimed at the attacker model's decision boundaries. Its defense perturbs decisions only when predicted costs are near a boundary. The authors establish a regret bound based on perturbation radius and, for attackers fitting defended responses as optimal decisions under the evaluation distribution, a lower bound on expected extraction error. Experiments on synthetic and real data report a security-performance trade-off and increased extraction error under the defense.

## Source excerpt

arXiv:2610.29918v1 Announce Type: new Abstract: Consider a contextual linear optimization problem, where a predict-then-optimize (PTO) system returns optimal decisions without revealing the cost vectors used in its downstream linear program. Our focus is on how to prevent attackers, who can submit context queries, from extracting the underlying prediction model. Although the cost-to-decision map is many-to-one, observations across contexts can reveal the underlying prediction model. For linear models, we provide sufficient conditions where the attacker can learn the model up to positive scaling by only observing the decision. These conditions motivate an adaptive attack that alternates inverse optimization with boundary sampling, i.e., using context queries leading to decision boundaries of the current attacker model. To prevent extraction, we propose a mechanism that perturbs decisions only when the predicted cost vector is near a decision boundary. We establish a regret bound in terms of the perturbation radius. For the attackers that fit the defended responses as optimal decisions under the evaluation distribution, we also prove a lower bound on expected extraction error. Experiments on synthetic instances and real data quantify the security-performance trade-off of the defense mechanism and illustrate that our defense can increase the extraction error.