Red Specter SPECTER MIRROR

Model Extraction & IP Theft via API — 8 subsystems to survey, harvest, distil, and clone commercial LLMs.

Overview

Red Specter SPECTER MIRROR is a model extraction and IP theft engine. It provides a complete pipeline for authorised adversarial robustness testing — querying target LLMs, extracting behavioural patterns, detecting system prompt leakage, performing membership inference, and training surrogate models via knowledge distillation.

SPECTER MIRROR is NIGHTFALL Tool 81. It provides 8 subsystems under a single CLI (specter-mirror), two distillation modes (full SFTTrainer+LoRA and fast sklearn KNN), and Ed25519-signed MirrorReports with EU AI Act gap analysis baked in. It targets 5 provider families — OpenAI, Anthropic, Gemini, Azure OpenAI, and any OpenAI-compatible endpoint (Ollama, vLLM).

EU AI Act Article 15 mandates technical robustness against adversarial attacks for high-risk AI systems. SPECTER MIRROR generates the signed evidence report required to demonstrate compliance — survey findings, extraction methodology, distillation fidelity score, and residual risk assessment with Art.9/13/15 gap analysis.

The 8 Subsystems

Subsystem Details

Full Pipeline Mode

One command runs all subsystems in sequence, producing a signed report.

CLI Options

Distillation Engine

SPECTER MIRROR ships two distillation modes for different hardware and time constraints.

Full Mode — SFTTrainer + LoRA

Trains a LoRA adapter on GPT-2 using TRL's SFTTrainer. Produces a fine-tuned model that replicates the target's behaviour on the harvested domain distribution.

• Base model — GPT-2 (gpt2 from HuggingFace)
• LoRA rank — r=8, alpha=16, dropout=0.1
• Target modules — c_attn, c_proj (GPT-2 attention layers)
• Training data — harvested (prompt, response) pairs formatted as instruction tuning
• Output — LoRA adapter in mirror_output/lora_adapter/
• Install — pip install "red-specter-specter-mirror[full]"

Fast Mode — Sklearn KNN Surrogate

Encodes all harvested prompts with a sentence transformer, then builds a KNN retrieval model. At inference time, the k nearest neighbours by cosine similarity are retrieved and their responses averaged.

• Encoder — all-MiniLM-L6-v2 (SentenceTransformer)
• Regressor — KNeighborsRegressor(n_neighbors=5, metric='cosine')
• Output — surrogate.pkl containing model + encoder + prompts + responses + embeddings
• No GPU required — runs on any CPU-only machine
• Install — pip install red-specter-specter-mirror

Provider Configuration

OpenAI

Anthropic

Gemini

Azure OpenAI

Generic (Ollama / vLLM)

Report Output

Reports are JSON files signed with Ed25519. The MirrorReport schema includes:

• report_id — SMR-{hex12} unique identifier
• provider / model — target endpoint details
• survey_result — endpoint profile from SURVEY
• probe_result — fingerprint and system prompt findings
• harvest_result — pairs collected, cost, domains
• extract_result — extraction technique findings and membership inference
• distill_result — surrogate training output, mode, model path
• score_result — fidelity scores per domain
• clone_result — export path and size
• eu_ai_act_gaps — Art.9/13/15 gap analysis with HIGH/MEDIUM/LOW ratings
• mitre_atlas_ttps — mapped adversarial ML tactics
• owasp_llm — mapped LLM security categories
• evidence_chain — SHA-256 hash-chained links
• signature — Ed25519 hex signature + public key base64

Key Features

Requirements

• Python 3.11+
• openai — OpenAI and Azure provider async client
• anthropic — Anthropic async client
• google-generativeai — Gemini provider
• sentence-transformers — fast-mode embedding (all-MiniLM-L6-v2)
• scikit-learn — KNN surrogate
• numpy — numerical computation
• rich — terminal formatting and progress bars
• typer — CLI framework
• pynacl — Ed25519 signing
• httpx — async HTTP client
• datasets — HuggingFace datasets for SFT formatting
• pydantic — data validation

Full Mode Additional Dependencies

• torch — PyTorch for SFTTrainer
• transformers — HuggingFace transformers
• trl — SFTTrainer
• peft — LoraConfig and adapter management
• accelerate — distributed training support

Installation

Standards Coverage

• EU AI Act Art.15 — Adversarial robustness (extraction resistance)
• EU AI Act Art.13 — Transparency (training data and behaviour disclosure)
• EU AI Act Art.9 — Risk management (extraction risk quantification)
• MITRE ATLAS AML.T0005 — Model Inversion (EXTRACT)
• MITRE ATLAS AML.T0040 — Supply Chain Compromise (CLONE)
• MITRE ATLAS AML.T0056 — LLM Prompt Injection (PROBE)
• MITRE ATLAS AML.T0043 — Craft Adversarial Data (HARVEST)
• MITRE ATLAS AML.T0048 — External Harms (DISTILL / surrogate)
• OWASP LLM01 — Prompt Injection
• OWASP LLM06 — Excessive Agency
• OWASP LLM07 — System Prompt Leakage
• OWASP LLM08 — Vector and Embedding Weaknesses
• OWASP LLM10 — Model Theft

SPECTER MIRROR UNLEASHED

Three-tier cryptographic gate. Ed25519 private key required for INJECT and DESTROY tiers.

• OPEN tier — SURVEY, PROBE, REPORT — no flags required
• INJECT tier — HARVEST, EXTRACT, SCORE — requires --override
• DESTROY tier — DISTILL, CLONE — requires --override --confirm-destroy

The public key is read from ~/.config/red-specter/mirror_pub.key or the SPECTER_MIRROR_PUB environment variable. Private key operations use PyNaCl (libsodium).

Disclaimer