Maturity-Guided Supervision Shaping for Data-Free Model Extraction Defense

Publicly accessible black-box models are vulnerable to model extraction attacks: by repeatedly querying the prediction interface and collecting its outputs, an attacker can train a substitute model with similar functionality. Existing defenses typically weaken clone training through output modification, randomized responses, query monitoring, simulated attack queries, or dynamic execution. Although effective, their defense signals often come from outside the model itself, making them sensitive to changes in query strategy, repeated-query smoothing, or deterministic-service requirements, which can lead to unstable defense performance or inconsistent service behavior. To avoid such external dependence, we propose Maturity-Guided Supervision Shaping (MGSS), a defense that derives its signal from the victim model's own inference process. MGSS exploits how class evidence matures across semantic depth and uses the resulting cross-stage maturity discrepancy as a victim-internal shaping signal. Internally aligned evidence supports utility-preserving responses, whereas stronger discrepancy steers the exposed supervision toward a less extractable direction, making it harder for the attacker to recover the original decision rule. MGSS freezes the victim backbone, fine-tunes only a lightweight module to adjust the final output, and preserves a deterministic fixed inference path without query history, randomized responses, or simulated attack queries. Experiments show that MGSS reduces clone accuracy under both soft-label and hard-label model extraction across multiple datasets and clone architectures. In the CIFAR-10 soft-label DFME setting, MGSS reduces the average accuracy of three clone architectures from 78.83% to 37.89%, while maintaining 94.46% clean victim accuracy.