The Access-Layer Playbook Against Model Extraction

Everything in this pillar assembles into one architecture. This is that architecture, stated compactly — what each layer owns, which primitives build the access layer, how the triggers and enforcement fit together, what it costs, and where it stops working.

If you read one post in this series, read this one. If you are going to build the thing, read the others too.

Key takeaways

• Three layers: model controls, traffic detection, verified access. You own the first two. The third is composable from published, priced primitives.
• Four access-layer primitives: collect (device and network), link (biometric 1:N), bind (identity and business verification), enforce (blocklist propagation).
• The cheapest tier does the most work. Collect at $0.03 on every paying account — without it, every later investigation is impossible.
• Triggers should fire on access transitions and behavioral alerts, never on a timer.
• Realistic cost for a 100,000-developer platform: roughly $800–$1,200 per month, with 500 free KYC verifications each month.
• Identity verification does not prevent model extraction. It raises cost, reduces anonymity, and shortens the life of regenerated accounts. Anyone claiming more than that is overselling.

Layer one: what you already own

Before adding anything, be clear about the two layers that are yours and stay yours.

Model controls — limiting sensitive reasoning traces, shaping outputs, restricting what a response reveals about how it was produced. The Frontier Model Forum's issue brief catalogues what the attacker is after here: chain-of-thought exfiltration, chain-of-thought critiquing, chain-of-thought autograding, prompt generation for reinforcement learning, and synthetic data generation. Every one targets what the model emits. Only the model provider can change that.

Traffic detection — spotting repetitive, semantically concentrated or coordinated request patterns. This layer is advancing quickly. Liu, Guo and Dong (arXiv 2606.05725) treat extraction monitoring as benign-calibrated traffic-window distribution testing using maximum mean discrepancy in semantic space, and report a 100% detection rate for pure-attacker cases at a 0.3% false-positive rate across fourteen attacker-normal query pairs.

Neither of these is an identity problem, and no identity vendor should be trying to sell you either. What identity infrastructure does is answer the question those layers raise and cannot resolve: this account is behaving strangely — how many other accounts are the same actor, and what do I do about all of them?

The four primitives

1. Collect — $0.03, on every paying account

Run IP and device analysis on every account at your cheapest paid tier. Not to decide anything. To have the data.

The codes you are buying are DUPLICATED_DEVICE_FINGERPRINT, DUPLICATED_IP_ADDRESS, DEVICE_RECOVERED_HIGH_CONFIDENCE, AUTOMATION_FRAMEWORK_DETECTED, DEVICE_EMULATOR_DETECTED, DEVICE_ROOTED_OR_JAILBROKEN, DEVICE_RUNTIME_HOOKING_DETECTED, DEVICE_APP_TAMPERED and the network family.

This is the highest-leverage decision in the playbook and the one most often skipped, because on day one it appears to do nothing. It is correlation substrate. When your traffic layer flags an account in month nine, the difference between a one-account ban and a thirty-account cluster is entirely whether you were collecting in month one. You cannot retrofit this. The sessions are gone.

2. Link — free

Face Search 1:N searches a face across every approved verification your application has performed, returning each match with your own vendor_data attached. Free with Didit verification, sub-two-second, and it runs automatically during liveness inside a verification session.

This is the primitive that makes accounts into actors. Twenty thousand accounts is a large number. Twenty thousand faces is not a thing an operator has.

3. Bind — $0.33 individual, from $2.00 organisational

Full identity verification at access transitions that carry real risk: quota increases, credit grants, key issuance, capability-tier upgrades. ID document, passive liveness, face match and IP analysis at $0.33, with the first 500 each month free.

For organisation, research and educational tiers — the categories Anthropic specifically named in "strengthened verification for educational and startup accounts" — business verification from $2.00 resolves registry status, beneficial owners and officers, with linked identity verification available for each beneficial owner from the same session.

Biometric re-authentication at $0.10 covers the case where the account was verified long ago and the question is whether the same human is still operating it.

4. Enforce — included

When a case is confirmed, blocklist using reference_session_id and Didit auto-extracts the right identifier from that session — face, document, phone, email, IP or device — across 12 entry types, with the entry linked back to its source session. Entries take effect immediately at verification time. ip_address accepts CIDR ranges when the evidence points at infrastructure.

Allowlists across the same 12 types keep design partners and enterprise engineering teams out of every escalation path, which is what makes a strict policy survivable.

The trigger design

Primitives without triggers are a cost centre. The rules that hold up:

Fire on access transitions. Quota increase, credit grant, new API key, tier upgrade, new privileged team member, billing-owner change.

Fire on your own behavioral alerts. This is the highest-value trigger in the design, and it is the integration point between the layers. Your semantic detection produces a signal identity infrastructure cannot; identity produces the resolution and enforcement that a semantic classifier cannot. Neither substitutes for the other.

Fire on linking signals. DEVICE_RECOVERED_HIGH_CONFIDENCE on a new account, or a face matching an existing verified user, earns a step-up regardless of what is being requested.

Do not fire on a timer. Periodic re-verification of everyone costs in proportion to your user base and protects in proportion to nothing.

Do not fire at signup. Let people sign up, read the docs, get a key and make real calls. Verification at signup converts worst and protects least.

The cost model

Take a platform with 100,000 registered developers and an illustrative distribution:

Tier	Accounts	Check	Unit	Monthly
Free	85,000	none	$0	$0
Paid self-serve	12,000	IP + device	$0.03	$360 one-time, then new accounts only
High quota / credit	2,500	full bundle	$0.33	$825 one-time, then new accounts only
Organisation / research	500	business verification	from $2.00	$1,000 one-time, then new accounts only
Step-up on alerts	~200 / month	biometric auth	$0.10	$20

The one-time columns matter: verification is per account, not per month. Steady-state cost is driven by new accounts entering each tier plus alert-driven step-ups — for most platforms, roughly $800 to $1,200 a month at this scale. The first 500 KYC verifications each month are free, everything is pay-per-success, and there are no minimums or seat licences.

Set that against the campaigns Anthropic measured — over 16 million exchanges through roughly 24,000 fraudulent accounts. The inference cost of 16 million exchanges is not a number in the hundreds of dollars.

Your distribution will differ from the table. The structural conclusion does not: the expensive check applies to the fewest accounts, and the check that applies to the most accounts is free.

The implementation order

1. Collect first. IP and device analysis on every paying account. Do this before anything else, because it is the only step that gets harder the longer you wait.
2. Instrument, do not enforce. Run for a month and look at what the codes actually say about your population. Every platform's baseline is different and enforcing against an assumed baseline generates false positives.
3. Wire the alert path. Connect your traffic-layer alerts to a verification trigger. This is the integration that makes both layers worth more.
4. Add binding at the top tiers. Full verification on high-quota and credit escalation; business verification on organisation and research tiers.
5. Build the enforcement runbook. Resolve the cluster first, then blocklist from the confirmed session across every entry type, then verify the enforcement landed. Enforcing before resolving bans one account and warns the operator.
6. Allowlist your friends. Before tightening anything, carve out design partners and enterprise engineering teams explicitly.

Where this stops working

An honest playbook states its own limits.

It does not detect extraction. Identity infrastructure never sees your prompts. If your traffic layer is weak, the access layer will not compensate — it will faithfully resolve actors you never flagged.

A determined, well-funded operator can still get in. Paying real people with real documents on real devices to open accounts defeats every identity control, because the accounts are genuinely distinct. What this changes is the price. Account farming that cost approximately nothing now costs recruitment, coordination and per-person overhead — and the resulting network is smaller and slower to regenerate.

Every layer produces false positives. Shared offices produce DUPLICATED_IP_ADDRESS. Families share devices. Developers legitimately hold two accounts. This is why duplicate signals are informational by default and why the policy is yours to set.

Verification has real friction and real cost to your funnel. The tiering exists to keep both off the people who should never encounter them, but the effect is not zero. Measure it.

It is a cost function, not a wall. Success is not "extraction became impossible." Success is that a campaign requiring 20,000 accounts now requires 20,000 verified identities, that each removal costs the operator more than an email address to replace, and that a single confirmed case propagates across everything it touched.

Frequently asked questions

What is the single highest-leverage thing to do first?

Collect device and network signals on every paying account at $0.03. It looks like it does nothing on day one, and it is the reason every later investigation is possible. It cannot be retrofitted.

Do we need all four primitives?

No. Collect and link get you most of the analytical value. Bind and enforce are what let you act on it. Start with collect.

How does this interact with a detection classifier we already run?

They compose. Your classifier says this account is doing something wrong. Face, device and network linking say this is thirty accounts, not one. Blocklist propagation makes the response cover all of them. Neither layer does the other's job.

Is Didit deployed at frontier AI companies?

We do not discuss who uses Didit. Everything described here is built from documented, publicly priced primitives that any team can evaluate against their own architecture, starting with 500 free KYC verifications a month.

What about verifying AI agents rather than humans?

Agent identity is a real and unsettled problem, and Didit's MCP server is live and free. But the extraction campaigns measured to date run on human-registered accounts at scale, which is the problem this playbook addresses.

Does any of this stop distillation outright?

No. Model-level output controls and semantic traffic detection remain necessary and are owned by the model provider. The access layer reduces anonymity, resolves actors across accounts, raises the cost of regeneration, and gives your existing alerts something to act on. That is the claim, and it is the whole claim.

Ready to get started?

Build the access layer from primitives you can price before you commit to any of them.

• Read the docs — Face Search 1:N, IP & Device Analysis, Lists API, Biometric Authentication and Business Verification.
• See the products — User Verification and Business Verification.
• Check the pricing — every module is publicly priced: $0.03 device and network, free 1:N face search, $0.33 full bundle, $0.10 biometric authentication, from $2.00 business verification. No minimums.
• Start free — business.didit.me. 500 KYC verifications a month at no cost, pay-per-success after that.