---
title: "Limit what the prediction endpoint gives · Agent Wranglers"
url: https://agentwranglers.se/playbook/machine-learning/serving-and-release/limit-prediction-output
id: MLO-40
level: Recommended
applies: public-api
updated: 2026-10-22
build: a2a6bdfed830
tokens: 959
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Limit what the prediction endpoint gives away

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Serving and release](https://agentwranglers.se/playbook/machine-learning/serving-and-release.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: MLO-40
- Level: Recommended
- Chapter: [Serving and release](https://agentwranglers.se/playbook/machine-learning/serving-and-release.md)
- Rule: A prediction endpoint that callers outside the team can reach returns only the decision or a rounded score, never probability vectors or internal features. It enforces a quota per caller.
- Check: A request to the public endpoint returns only the fields in its response schema, and no score has more than two decimals. A test sends one caller's quota plus one request, and the last one gets 429.
- Applies when: The project offers an API to others.
- How: Many queries that return full scores let an attacker copy the model, or test whether a person was in the training data. Return only what the product needs, such as "approved" or a score rounded to two decimals. Set a quota per caller, and alert on a caller that sends many near-identical inputs, because that is how copying looks in the logs. Keep the full scores in the [prediction log](https://agentwranglers.se/playbook/machine-learning/serving-and-release/log-serving-features.md) for your own monitoring. The privacy test for the model itself is [Test that the model does not give away its training records](https://agentwranglers.se/playbook/machine-learning/people-affected-by-the-model/training-data-extraction-test.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
SCORE_DECIMALS = 2

def public_prediction(probabilities: list[float], threshold: float) -> dict:
    score = round(probabilities[1], SCORE_DECIMALS)
    return {"decision": "approved" if score >= threshold else "declined", "score": score}
```

### TypeScript example

```ts
const SCORE_DECIMALS = 2;

export function publicPrediction(probabilities: number[], threshold: number) {
  const score = Number(probabilities[1].toFixed(SCORE_DECIMALS));
  return { decision: score >= threshold ? 'approved' : 'declined', score };
}
```

## Sources

- [OWASP Secure AI Model Ops Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secure_AI_Model_Ops_Cheat_Sheet.html)

## Related rules

- MLO-25 [Log the features and prediction of every request](https://agentwranglers.se/playbook/machine-learning/serving-and-release/log-serving-features.md) in Machine learning
- MLO-41 [Test that the model does not give away its training records](https://agentwranglers.se/playbook/machine-learning/people-affected-by-the-model/training-data-extraction-test.md) in Machine learning

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/machine-learning/serving-and-release/limit-prediction-output">Agent Wranglers machine learning playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Answer with a fallback when the model fails or is slow](https://agentwranglers.se/playbook/machine-learning/serving-and-release/model-fallback.md)
- Next: [Test a new model on live outcomes with a randomised split](https://agentwranglers.se/playbook/machine-learning/serving-and-release/model-ab-test.md)
- [Serving and release](https://agentwranglers.se/playbook/machine-learning/serving-and-release.md)