Research on Criminal Liability and Governance Paths of AI Large Model API Reverse Proxies

Abstract

The rapid global expansion of reverse proxy and transit businesses for generative Large Language Model (LLM) Application Programming Interfaces (APIs) has increasingly highlighted the blurred boundaries between technological neutrality and criminal illegality. Service providers initially opened free web-based access to acquire real interaction data and popularize the technology, subsequently recovering costs through commercial API calls. However, this dual-track model is currently suffering from a massive wave of reverse-engineered call attacks. Stripping away the complex technical facade, reverse proxies can be classified into three basic types: rule abuse, payment fraud, and protection breakthrough. Among these, the protection breakthrough behavior forcibly bypasses human-machine verification and uses core tokens to directly connect to the backend. This not only deprives normal users of computing resources but also substantially fulfills the constitutive requirements of the crime of destroying computer information systems and the crime of providing programs and tools for intruding into or illegally controlling computer information systems. However, beyond dogmatic analysis, judicial punishment must strictly uphold the principle of criminal restraint. For pure computing power reselling and rule-violating registrations that do not destroy system access controls, criminal penalties should not be easily invoked; the application of the crime of illegal business operations in the digital computing sector should also be strictly limited. Faced with a highly concealed and transnational black and gray industry, a single governance model often reaches a deadlock. Service providers should establish a “criminal-civil crossover” logic for rights protection, leveraging criminal investigation methods to pierce the shield of anonymity, and subsequently relying on the Anti-Unfair Competition Law to claim substantive compensation, thereby maintaining a balance of the rule of law between cracking down on technological black markets and protecting the open-source ecosystem.

Keywords:

Artificial Intelligence, Reverse Proxy, Crime of Destroying Computer Information Systems, Principle of Criminal Restraint, Criminal-Civil Crossover

I. Evolution and Regulatory Dilemma of the Compute Distribution Gray Industry

The continuous iteration of generative large language models (such as Deepseek, Doubao, Qianwen, etc.) highly depends on the expansion of underlying computing power scale and the “feeding” (pre-training) of high-quality training corpora. As the industry develops, the demand for computing resources by new-generation models is growing exponentially, while the available inventory of high-quality “human text” for training is rapidly depleting. Some studies even predict that global available data will hit a “data peak” of exhaustion by 2032. Constrained by this objective law, LLM service providers must strike a balance between recovering R&D costs and acquiring more real human interaction data. Consequently, the industry has generally established a dual-track commercial model: on one hand, opening free web or mobile applications to the public to attract massive numbers of natural person users and accumulate real-world corpora; on the other hand, providing standard APIs billed by Token to enterprises and professional developers to achieve commercial monetization and compute cost recovery. The massive price scissors formed between the free, universally accessible web end and the relatively expensive API end have directly induced the arbitrage impulses of profit-seekers.

API reverse proxy and transit distribution businesses initially operated mostly in a gray area, using relatively restrained methods. Especially when facing different regulatory environments at home and abroad, early operations mostly manifested as traffic disguise aimed at evasion. For example, some top overseas models implement strict IP blocking against mainland China; domestic transit operators bypassed overseas official geographical censorship by setting up their own overseas server nodes to disguise the call traffic of domestic developers as compliant foreign requests. At this stage, the profit logic of the transit operators was merely to earn a meager service fee on top of the official API base price.

However, with the explosive growth of the LLM application ecosystem and the popularization of various AI programming software, simple quota reselling can no longer satisfy the lucrative demands of gray industry syndicates. Driven by profit, the attackers’ methods rapidly iterated, mutating towards a more destructive direction and forming an underground black and gray industry chain that is highly detrimental to system infrastructure.

Some syndicates adopt traditional internet black market tactics, using illegally obtained “black cards” (violating or stolen credit cards) to mass-purchase overseas commercial API quotas, then routing them into their own transit pools for downstream users to call. Even if platforms detect violations and ban the accounts, supported by dynamic API key rotation technology, the actual experience of downstream users is unaffected. Other syndicates target the free trial quotas given to new users by model providers seeking to expand their market. These syndicates use automated scripts to connect with SMS verification platforms, instantly registering massive numbers of fake accounts, and then pooling and reselling the gifted quotas from these accounts. Yet, the most malicious method currently employed is due to model platforms offering increasingly generous services and capabilities on their free web versions to drive “new user acquisition” and “active engagement.” Illicit developers now directly crack the restrictions of the web version via reverse engineering, disguising high-frequency machine concurrent calls as normal users’ web access requests. This predatory calling, directly targeting the free compute pool, vastly exceeds the normal human access frequency predetermined by service providers, leading to uncontrolled server loads and the exhaustion of resources for normal users.

Faced with the aforementioned chaos, current judicial practice and theoretical circles have long vacillated in characterizing these behaviors. If uniformly downgraded to civil breach of contract disputes, service providers face massive machine scripts and hidden network nodes, making it difficult to even identify the basic infringing subjects, resulting in extremely high protection costs and minimal effectiveness. If criminal penalties are applied indiscriminately without distinction, it is very easy to breach the principle of nullum crimen sine lege (no crime without law) due to unclear technical principles, thereby creating a chilling effect on the burgeoning domestic open-source technology community. The prerequisite for resolving this regulatory deadlock lies in penetrating the overarching technical facade of “reverse proxy” and meticulously dissecting the underlying technical logic of the different operational models.

II. Classification of Reverse Proxy Behaviors and Boundary Determination of Illegality

In the digital economy, especially under the background of new technologies represented by artificial intelligence, the application of both civil/commercial rules and the deployment of criminal legal frameworks must be built upon the accurate restoration of underlying technical facts. Based on the evolutionary context of transit proxy businesses, and using whether the core security protection measures of the target system are breached as a watershed, the involved behaviors can be stripped down into three progressive legal types.

(I) Rule Abuse Type

This type of behavior does not touch the underlying network security architecture of the LLM; its essence is extreme testing of platform operational rules. Typical scenarios include traffic disguising across geographical barriers and automated bulk registration targeting free quotas. The perpetrator uses jump nodes to change the source IP address of the access request, or uses automated tools to replace manual CAPTCHA recognition, pooling small-value keys from thousands of compliant accounts into a resource pool for external distribution, or selling purchased compute packages (Coding Plans) disguised as normal APIs.

In these operations, the official system API calling method remains unaffected, and the API keys used as access tokens are automatically generated based on genuine registration processes. The perpetrator essentially plays the role of a “compute scalper” exploiting rule loopholes. Although this behavior severely violates the service provider’s User Service Agreement clauses prohibiting the transfer, distribution, and abuse of free policies, and infringes upon the enterprise’s exclusive contractual interests, its illegality remains within the realm of civil and commercial breach of contract because it does not employ destructive intrusion methods to disrupt system functions.

(II) Payment Fraud Type

To achieve zero-cost acquisition of high-quota commercial APIs, some illicit platforms bulk-purchase stolen credit card information via illegal channels. They use these “black cards” to fraudulently swipe and purchase compute packages on official model websites, subsequently dumping the API keys to downstream developers at extreme discounts or directly mixing them into their own traffic pools for profit.

This illegal chain is essentially one of the most common arbitrage behaviors in internet crime today. The LLMs and their computer information systems are merely alienated into physical carriers for criminals to fence stolen goods and cash out. The true infringement is upon the state’s financial management order and public/private property rights. Therefore, this type of behavior should generally depart from the pure computer crime regulatory path and directly apply the relevant provisions for the crime of credit card fraud, the crime of impeding credit card administration, or the crime of concealing or disguising criminal proceeds.

(III) Protection Breakthrough Type

This behavior typically manifests as a direct destruction of the LLM platform’s system security design. In order to extract free compute power without limits, black and gray industry developers aim directly at the universally accessible free web version, severely affecting the use by other users and destroying the production and operation of the model platform.

To ensure normal service, the web version of an LLM typically designs a series of human-machine verification methods (such as dynamic trajectory recognition and device fingerprinting) to prevent abuse. Early on, attackers used tools similar to headless browsers to simulate real users’ mouse swipes and keyboard strokes, inputting user-passed content into the official web service and returning the results to the user. However, such tools demand significant server performance and are poor at handling bulk concurrent tasks, failing to meet the needs of user groups purchasing transit API services. Consequently, illicit developers began using reverse analysis technology to capture and parse the underlying communication protocols of the web version, precisely extracting and decrypting the core tokens required for authentication. After acquiring the core tokens, the reverse-engineered program can shake off the performance limitations of browsers, directly construct fake request headers containing legitimate credentials, and launch high-frequency concurrency against the LLM’s backend inference servers, brutally plundering free computing resources.

Because it completely bypasses the security barrier of the frontend page, this reverse operation of directly connecting to the backend effectively neutralizes the LLM’s original access control system. The substantive infringement of legal interests by this behavior is identical to that of traditional unauthorized intrusion into computer systems.

III. Criminal Dogmatics of Protection Breakthrough Reverse Engineering

Regarding the reverse breakthrough behavior that forcibly bypasses access control and connects directly to the underlying architecture, its social harmfulness far exceeds the evaluative limits of a commercial breach of contract and constitutes a substantial infringement on the cybersecurity management order. Conducting a precise criminal dogmatic analysis is an inevitable requirement to achieve proportionality between crime, responsibility, and punishment.

(I) Destruction of System Availability and Application of the Crime of Destroying Computer Information Systems

Article 286 of the Criminal Law of the People’s Republic of China prohibits interfering with the functions of a computer information system and causing it to fail to operate normally. In traditional cybercrimes, such interference mostly manifests as Distributed Denial of Service (DDoS) attacks that choke network bandwidth with massive junk requests. In AI application scenarios, the core targets of system interference include not only the bandwidth and server processing resources involved in DDoS but also the GPU inference compute queues.

Based on comprehensive considerations of commercial operations and cost control, model service providers usually tilt core GPU compute resources towards paid commercial APIs. The resource allocation and concurrency tolerance thresholds for the web version’s compute pool are strictly load-balanced according to natural human typing speeds, reading durations, and thinking pause cycles. Continuous, millisecond-level machine concurrent requests launched by malicious transit platforms will, within a very short time, violate the theoretical preconditions of the load balancing, instantly draining the available compute of the web version. This abnormal calling directly leads to severe blockages in the underlying calculation queue. Normal users’ dialogue requests may not only face long queues and fail to receive replies, but it may even force the LLM to trigger a circuit-breaker mechanism that automatically lowers inference precision (colloquially known in the industry as “capability degradation” or “intelligence downgrade”) to maintain basic responsiveness. By abusing automated programs, perpetrators artificially create localized exhaustion of compute resources, substantively depriving the system of its ability to provide stable services to normal users, which perfectly matches the objective elements of the crime of destroying computer information systems.

(II) Effectiveness of Security Measures and Determination of the Crime of Providing Intrusion Tools

For the sources of the black and gray industry located upstream in the industrial chain—those who specialize in developing and distributing reverse-engineered LLM interface programs—the path of criminal attribution points to Paragraph 3 of Article 285 of the Criminal Law.

In judicial practice, infringers or defense counsels often argue that the web version is inherently open to the public, claiming that extracting user tokens to initiate requests does not intrude into any closed system. In reality, this logic severely ignores that various “human-machine recognition” components are also part of the entire closed system. Although the web version is open to the outside, the authentication interception and frequency control components deployed between the frontend and the inference backend are established precisely to block automated machine traffic. Legally, they ought to be recognized as security protection measures of the system.

Furthermore, the behavior of open-sourcing and distributing reverse-engineered programs under the guise of “technical exchange” on code-hosting platforms like GitHub must be severely scrutinized. The principle of technological neutrality is not an absolute safe harbor. If the open-source code belongs to general network testing, stress-testing frameworks, or even usability enhancement components, it naturally lacks the nature of infringing upon legal interests. However, if the involved project is specifically targeted at cracking the defense mechanisms of a specific LLM, and its core code functions are limited solely to acquiring core tokens and directly launching high-frequency concurrent calls against server resources, with no legitimate maintenance or testing application scenarios, it has essentially degenerated into an intrusion tool for bypassing security controls. Releasing such programs for free open-source distribution objectively lowers the threshold for downstream black market operations drastically, expanding the scope of damage. As long as the impact caused by the distribution behavior reaches the “serious circumstances” standard stipulated by judicial interpretations, regardless of whether it seeks direct profit, criminal responsibility should be pursued under the crime of providing programs or tools for intruding into or illegally controlling computer information systems.

(III) Data Interception at Intermediate Nodes and Accomplice Liability

Observing from the network topology, the reverse proxy system inevitably sits in a “man-in-the-middle” position between the user and the LLM server. To disguise communication instructions and distribute traffic, transit nodes must unpack the original requests sent from downstream, reassemble them, and forward them to various ultimate model service providers. Therefore, proxy platform operators inherently possess the capability to silently capture all user and contextual interaction data in the background.

User interaction corpora with LLMs are often rich in sensitive personal privacy data and corporate trade secrets. If platform operators use interception technology to privately retain the aforementioned data in the background and sell it to third parties, they violate the crime of infringing on citizens’ personal information. Additionally, most transit providers offer anonymous registration functions. If, under the premise of knowing that downstream users purchase API interfaces to bypass domestic models’ real-name registration in order to commit cybercrimes, the transit operator still continuously provides hidden communication channels and compute support, this behavior of acting as a technical accomplice should rightfully be incorporated into the regulatory scope of the crime of assisting information network criminal activities.

(IV) “Bait and Switch” at Transit Nodes and Application of the Crime of Fraud

In the complete gray industry chain of reverse proxying, the victims are not only the LLM providers; downstream API purchasers (mostly SME software developers) also face extremely high risks of legal interest infringement. Generative AI possesses typical “black box” characteristics, and the quality of its output content is often probabilistic and uninterpretable. Certain unscrupulous transit platforms exploit this technical information gap to execute a “bait and switch” when providing services downstream.

Specifically, when conducting external business, some illicit platforms claim to provide APIs for expensive, premium commercial models (such as OpenAI GPT-5.5, Claude Opus-4.7). However, in their gateway backend, they quietly redirect a portion of users’ inference requests to extremely low-cost inferior models or various cheap open-source models. To cover up the substitution traces, operators even inject preset System Prompts or set up intercept caches to forcibly alter the model’s self-cognitive output, thereby blocking developers from probing and questioning the model’s true identity.

Because ordinary developers find it difficult to accurately identify subtle downgrades in model inference logic during short-term massive calls, and may even directly blame the LLM for “capability degradation,” the transit platforms illicitly rake in staggering price differences—dozens or even hundreds of times the cost. This behavior is essentially the transit platform utilizing the fiction of “premium models” and concealing the truth of “inferior model” interfaces to deceive downstream users into paying high premiums. In the construction of criminal dogmatics, the perpetrator subjectively possesses the purpose of illegal possession and objectively implements the deceptive act of fabricating premium model compute and concealing inferior model inference, causing downstream users to fall into a misconception and pay an exorbitant premium. This has completely detached from the category of “defective performance” in civil breach of contract. When the service fees defrauded by the platform through this “downgrading and watering down” method reach the statutory standard for filing a case, the provisions of Article 266 of the Criminal Law should be directly applied to pursue the criminal liability of the transit operators for the crime of fraud.

IV. Determination of Decriminalization Boundaries Under the Principle of Criminal Restraint

The intervention of criminal methods is severe and irreversible. When dealing with edge industries born alongside AI technological innovations, one must base decisions on China’s internet compliance environment, strictly abide by the principle of criminal restraint (ultima ratio), and accurately draw the red line between crime and non-crime.

(I) Decriminalization Evaluation of Permission-Multiplexing Proxy Behaviors

Regarding the “rule abuse type” of proxy behaviors mentioned above, whether using overseas nodes for traffic disguise or using SMS verification platforms to bulk-register accounts and automated scripts to pool small-value keys, the perpetrators have not fundamentally altered the underlying code logic of the LLM system, nor have they destroyed the target system’s authentication or access control permissions. Pooling and reselling legally acquired calling keys is, at its core, overstepping usage boundaries.

The object infringed by such behaviors is merely the anticipated commercial interests enjoyed by the service provider based on civil and commercial contracts. Service providers can fully adopt technical countermeasures such as banning abnormal accounts and blocking high-risk IP address segments, supplemented by civil lawsuits to pursue breach of contract liabilities to protect their rights. As long as the involved behavior has not escalated to the level of public legal interests endangering computer information system security, the literal interpretation of the law should not be breached to forcibly elevate it into a computer-related crime.

It must be clarified that the prerequisite for the aforementioned decriminalized evaluation is that the perpetrators are using account resources legally acquired by themselves. China’s Cybersecurity Law and Anti-Telecom and Online Fraud Law strictly establish the real-name system for network services. If black and gray industry actors, in order to bypass the mandatory real-name registration mechanisms of domestic LLMs, illegally purchase and misappropriate others’ phone numbers and identity information on the dark web for bulk violative registration, and subsequently extract and resell the compute from these fake accounts, the execution of this operation directly violates the crime of infringing on citizens’ personal information. At this point, the nature of the case transforms from a simple breach of contract into a substantive breakthrough of the nation’s baseline of citizen information security and real-name management order, which rightfully warrants criminal prosecution.

(II) Strictly Limiting the Application Scope of the Crime of Illegal Business Operations

In the judicial inertia of handling cyber black and gray industry cases in the past, some investigating organs, when faced with “unlicensed reselling” behaviors lacking clear regulations, tend to throw them into the “pocket” of the crime of illegal business operations. When dealing with LLM compute proxies, especially when proxying overseas model compute, this mechanical logic of incrimination must be firmly rejected.

First, regarding calling LLM APIs, the core output content is structured digital text or code generated after a specific algorithm conducts complex reasoning on input instructions. It neither possesses the channel transmission attributes of basic telecommunication networks nor can it be easily categorized into traditional value-added telecommunications businesses within the Classification Catalogue of Telecommunications Services. Against the backdrop where the state has not yet issued clear administrative regulations bringing “AI compute distribution” into the scope of franchised operations, invoking a catch-all clause to characterize it as the crime of illegal business operations severely violates the clarity requirements of the principle of nullum crimen sine lege.

Second, regarding the behavior of setting up nodes domestically to act as proxies for reselling calling quotas of overseas LLMs (such as OpenAI, Claude, etc.), there is indeed a view in practice that this constitutes illegally operating international telecommunications businesses. However, returning to dogmatic analysis, using technical means to bypass the Great Firewall (GFW) to access overseas networks—according to regulations like the Measures for the Security Protection Administration of the International Networking of Computer Information Networks, the Telecommunications Regulations of the People’s Republic of China, and the Provisional Regulations of the People’s Republic of China on the Management of International Networking of Computer Information Networks—although debated in the industry, the current prevailing view generally considers it an illegal act subject to administrative penalties. Unless the perpetrator specifically develops and sells “wall-scaling” (VPN) software used to break through national network censorship, merely using overseas servers for instruction relaying and text return of API interfaces and escalating it to the “crime of illegal business operations” in a criminal law sense not only lacks explicit support from judicial interpretations but is also highly likely to inflict an irreversible and disastrous blow to the domestic underlying open-source ecosystem, which urgently requires a tolerant environment for trial and error and connection with international frontiers.

V. “Criminal-Civil Crossover” is a Better Choice for Service Providers’ Rights Protection

Faced with the objective reality that LLM reverse proxy black markets are highly anonymized, deployed across borders, and possess strong anti-reconnaissance capabilities, relying solely on civil litigation or single criminal complaints makes it difficult to maximize the effectiveness of rights protection. Exploring and establishing a criminal-civil crossover rights protection path that integrates substantive regulation and procedural remedies has become an inevitable route for service providers to combat infringement.

(I) Piercing the Veil of Concealment and Consolidating Evidence Through Criminal Investigation

Malicious reverse-engineering syndicates usually employ methods such as cryptocurrency money laundering, end-to-end encrypted communication, and decentralized overseas node deployment to cover their illegal tracks. Under the traditional civil litigation framework, due to the lack of coercive investigative powers, service providers are often unable to ascertain the true identities of the infringers, nor can they accurately calculate the scale of infringing profits.

Faced with this deadlock, the Cybersecurity Law of the People’s Republic of China endows network operators with the legal obligation to monitor and record network operating status and prevent network intrusions. When abnormal load concurrency is detected in the system, service providers should immediately capture the full volume of system logs, firewall interception records, and instantaneous snapshots of server loads. Based on such unalterable underlying electronic data, service providers can file a criminal complaint with public security organs on the grounds of systems suffering damage. Leveraging the technical reconnaissance methods and financial penetration reviews of public power, investigating organs can rapidly strip away the disguises of virtual IPs and cryptocurrency mixing pools to directly lock onto core criminal suspects, thereby thoroughly dismantling the black industry syndicate’s infrastructure at both physical and logical levels.

(II) Achieving Restoration of Legal Interests Relying on the Anti-Unfair Competition Law

Although the smooth advancement of criminal procedures can effectively deter and punish criminals, the subsequent damage compensation phase faces institutional bottlenecks. The current system of incidental civil lawsuits in criminal proceedings usually only supports direct material losses suffered by victims due to criminal acts. The massive compute costs groundlessly consumed by abnormal calls and the evaporated anticipated commercial profits of enterprises are often difficult to include within the scope of compensation.

Therefore, service providers should initiate independent civil recovery procedures at an opportune time, and the Anti-Unfair Competition Law of the People’s Republic of China provides an operational normative basis. Black and gray industry platforms illegally stripping the free interactive services maintained by model providers at huge costs through reverse engineering, and packaging them as their own paid products for external dumping, belongs to a typical act of unfair competition that violates the principle of good faith and free-rides on others’ operational achievements. Following a criminal conviction, service providers can directly extract the verified scale of server wear and tear and black market ledger cash flows from criminal files as the baseline for claims, and advocate for the application of punitive damages. This dual-track strategy, which links criminal fact-finding with heavy civil penalties for loss recovery, can maximize the compensation for enterprises’ actual losses.

(III) Deep Integration of Business Compliance and Technological Moats

Ex post judicial relief inherently suffers from lag; enterprises should move the defensive line against infringement forward to the system architecture design and daily compliance management stages. Technically, service providers need to embed more sensitive environmental monitoring and behavioral trajectory recognition mechanisms at the system’s foundational layer, continuously raising the cracking threshold of reverse engineering to force back lower-level black industry actors with weaker technical capabilities. On the compliance front, legal teams should systematically reconstruct domestic and international user agreements and service guidelines. Using rigorous and unambiguous legal language, behaviors such as various forms of disguised shell applications, malicious distribution, token extraction, and reverse calls must be explicitly listed on a prohibition checklist. Only when rigorous technical defense measures and clear contractual rights boundaries are deeply integrated can service providers consistently hold the evidentiary advantage and jurisprudential initiative when facing complex criminal complaints and civil litigation.

VI. Conclusion

The combination of various factors—the supply-demand imbalance of generative AI models in China, the high prices of premium models, China’s still-insufficient compute power, and the remaining capability gap between domestic models and top overseas models—has provided a hotbed for the savage growth of LLM interface transit and proxy businesses. Facing new forms of criminal acts in the context of artificial intelligence, legal intervention must simultaneously possess the precision to penetrate technological fogs and the steadfastness to maintain penal restraint.

For reverse intrusion behaviors that forcefully smash through frontend security defenses, extract authentication credentials to directly connect to inference backends, and maliciously exhaust platforms’ free compute, judicial organs should accurately identify their criminal nature of destroying computer information systems and resolutely punish them. Conversely, for pure compute reselling and rule abuse behaviors that do not substantively destroy the system foundations, the baseline of criminal restraint must be upheld, leaving correction to the civil and commercial legal system. In choosing governance paths, victimized service providers should abandon single-track rights protection thinking, deeply integrate the breakthrough penetration capabilities of criminal investigations with the heavy-penalty claim functions of civil litigation, and rely on the “criminal-civil crossover” to achieve comprehensive maintenance of their lawful rights and interests.

In AI-related cases, only by strictly drawing the red line between crime and non-crime and avoiding the blind pursuit of various “landmark first cases” can we accurately strike down black and gray industries while leaving ample rule-of-law space for the prosperity of China’s underlying AI technological ecosystem.

---

Will Models Run Out of Data? . ai_index_report_2026_chapter_1_research_development . https://hai.stanford.edu/

“Counterfeit” Versions Flood the Network: The Gray “Business Bible” Under the ChatGPT Boom. Legal Daily . http://legalinfo.moj.gov.cn/zhfxfzzx/fzzxyw/202305/t20230525\_479499.html