Abstract

Reverse-proxy and relay services for generative large-language-model application programming interfaces (APIs) are expanding rapidly worldwide, bringing the boundary between technological neutrality and criminal conduct into sharper focus. Providers offer free web access to obtain genuine interaction data and popularize their technology, while recovering costs through commercial API calls; this dual-track model is now under attack from large-scale reverse calls. Beneath the complex technical appearance, reverse proxies can be divided into three basic types: rule abuse, payment fraud, and security-bypass conduct. Security-bypass conduct forcibly circumvents human-machine verification and uses core tokens to connect directly to the backend. It not only deprives ordinary users of computing resources but may also satisfy the elements of disrupting a computer information system and providing programs or tools for intrusion or unlawful control. At the same time, criminal enforcement must observe the principle of restraint in criminal punishment. Simple resale of computing capacity and improper registration that do not damage access controls should not readily trigger criminal penalties, and the application of the crime of unlawful business operation in the digital-computing field should be strictly limited. Because these illicit industries are highly concealed and cross-border, a single governance model often reaches an impasse. Providers should adopt a civil-criminal rights-protection strategy: use criminal investigation to break through anonymity, then rely on the Anti-Unfair Competition Law to seek substantive compensation, maintaining a balance between combating technological black markets and protecting an open-source ecosystem.

Keywords

Artificial intelligence; reverse proxy; crime of disrupting a computer information system; restraint in criminal punishment; civil-criminal intersection

I. Evolution of the Gray Market in Computing-Resource Distribution and the Regulatory Dilemma

The continuing evolution of generative large language models, such as DeepSeek, Doubao, and Qwen, depends heavily on expanding underlying computing power and supplying high-quality training data. As the industry develops, the demand for computing resources by each new generation of models is increasing exponentially, while the stock of high-quality “human text” available for training is being rapidly depleted. Some studies have even predicted that globally available data could reach a “data peak” and begin to run out before 2032. Against this background, model providers must balance recovering research and development costs with obtaining more genuine human interaction data. As a result, the industry has generally adopted a dual-track business model: free web or mobile applications are made available to the public to attract large numbers of natural-person users and accumulate genuine language data, while standard APIs charged by token are offered to businesses and professional developers to monetize the service and recover computing costs. The large price gap between broadly accessible free web services and relatively expensive APIs directly creates an incentive for arbitrage.

Reverse-proxy and relay-distribution businesses initially operated largely in a gray area and used relatively restrained methods. In particular, when facing different regulatory environments in China and abroad, early businesses often disguised traffic to evade geographic restrictions. For example, some leading overseas models imposed strict IP blocks on mainland China. Domestic relay operators established overseas server nodes and disguised calls from domestic developers as compliant overseas requests, thereby bypassing the providers’ geographic review. At this stage, the relay operator’s profit was limited to a small service fee above the provider’s basic API price.

As large-model applications grew explosively and various AI programming tools became widespread, simple resale of quotas could no longer satisfy the profit demands of the gray-market groups. Driven by profit, their attack methods rapidly evolved toward more destructive conduct, creating an underground black-and-gray industrial chain that seriously threatens system security.

Some groups followed traditional internet-crime methods, using illegally obtained “black cards” (fraudulent or stolen credit cards) to repeatedly charge overseas commercial API accounts, connect the purchased quotas to their relay pools, and resell access downstream. Even if the platform identifies and bans an account, dynamic API-key selection prevents the downstream user experience from being immediately affected. Other groups target free trial quotas offered to new users. Through automated scripts connected to SMS-verification services, they register large numbers of false accounts, pool the free quotas, and resell them. The most serious method is the direct exploitation of increasingly generous free web services offered by model platforms to attract new and active users. Developers use reverse engineering to break web restrictions and disguise high-frequency machine concurrency as ordinary web access. Such predatory calls directly target the free computing pool, greatly exceed the frequency expected of ordinary users, and can cause large-model servers to lose control of their load while exhausting resources available to normal users.

In response to this disorder, judicial practice and legal theory have remained uncertain about how to classify the conduct. If every case is reduced to a civil breach-of-contract dispute, providers often cannot even identify the basic infringing party in the face of massive scripts and concealed network nodes, making rights protection costly and ineffective. If criminal punishment is used indiscriminately, however, uncertainty about the technical principles can easily lead to violations of the principle of legality and create a chilling effect on China’s emerging open-source technology community. The premise for resolving this regulatory impasse is to look through the generalized technical label of “reverse proxy” and carefully dissect the underlying logic of different models.

II. Classification of Reverse-Proxy Conduct and the Boundary of Illegality

In the digital economy, particularly in the context of artificial intelligence, both civil and commercial rules and criminal law must be applied on the basis of an accurate reconstruction of the underlying technical facts. Considering the evolution of relay businesses, the conduct can be separated into three progressive legal types by asking whether the core security measures of the target system were bypassed.

(1) Rule-abuse conduct

This type does not touch the underlying network-security architecture of the large model. It is essentially an extreme test of the platform’s operating rules. Typical scenarios include disguising traffic across geographic barriers and batch-registering accounts by machine to obtain free quotas. The actor changes the source IP of an access request through a proxy node, replaces manual CAPTCHA completion with automated tools, pools small keys from thousands of compliant accounts for external distribution, or disguises a purchased computing package, such as a Coding Plan, as an ordinary API.

In these operations, the official system’s API-call method is not changed, and the API keys used as access tokens are generated through genuine registration procedures. The actor is essentially a “computing-resource scalper” exploiting loopholes in the rules to buy and resell access. Although the conduct seriously violates the provider’s user agreement provisions prohibiting transfer, distribution, and abuse of free policies and infringes the provider’s contractual business interests, it has not used intrusive means to damage system functions. Its illegality therefore remains at the level of a civil or commercial breach of contract.

(2) Payment-fraud conduct

Some unlawful platforms seek to obtain large commercial API quotas at no cost. They purchase stolen credit-card information in bulk through illegal channels, use the “black cards” to make fraudulent purchases on model websites, and then sell the API keys to downstream developers at a steep discount or mix them into their own traffic pools for profit.

This chain is essentially one of the most common forms of internet arbitrage crime. The large model and its computer information system are merely turned into physical vehicles for fencing and cashing out. The real interests harmed are the state’s financial-management order and public and private property ownership. Such conduct should therefore normally leave the framework of pure computer-crime regulation and be addressed directly under the rules on credit-card fraud, obstructing credit-card administration, or concealing or disguising criminal proceeds.

(3) Security-bypass conduct

This type directly damages the system-security design of the large-model platform. To extract free computing capacity without limit, black-and-gray-market developers target the public free web interface, seriously affecting other users and disrupting the platform’s production and business operations.

Large-model web interfaces generally use a series of human-machine verification measures, such as dynamic-trajectory recognition and device fingerprints, to prevent abuse. At an early stage, attackers used headless-browser-like tools to simulate real users’ mouse movements and keystrokes, submit user content to the official web service, and return the result. These tools require substantial server performance and cannot efficiently handle large-scale concurrent tasks, making them inadequate for users purchasing relay APIs. Unlawful developers therefore began using reverse-analysis techniques to capture and parse the underlying communication protocols of the web interface and precisely extract and decrypt the core tokens required for authentication. Once the core token is obtained, the reverse-engineered program can escape the browser’s performance limits, construct false request headers containing valid credentials, and send high-frequency concurrent requests to the inference server behind the large model, aggressively taking free computing resources.

Because this operation completely bypasses the web page’s security barrier, the direct backend connection effectively nullifies the original access-control system of the large model. In substance, the harm to legally protected interests is no different from traditional unauthorized intrusion into a computer system.

III. Doctrinal Criminal-Law Analysis of Security-Breaking Reverse Conduct

Reverse-engineering conduct that forcibly bypasses access controls and connects directly to an underlying architecture is far more socially harmful than a commercial breach and substantively harms the order of network-security administration. Precise criminal-law analysis is therefore necessary to achieve proportionality between crime, responsibility, and punishment.

(1) Damage to system availability and the application of the crime of disrupting a computer information system

Article 286 of the Criminal Law of the People’s Republic of China prohibits interfering with the functions of a computer information system and causing it to operate abnormally. In traditional cybercrime, such interference often takes the form of a distributed denial-of-service (DDoS) attack that blocks network bandwidth with massive junk requests. In artificial-intelligence applications, the core target is not limited to the bandwidth and server-processing resources involved in DDoS attacks; it also includes the GPU inference queue.

For commercial-operation and cost-control reasons, model providers generally allocate core GPU resources preferentially to paid commercial APIs. The resource allocation and concurrency thresholds for web-interface computing pools are designed around the typing speed, reading time, and pauses for thought of natural-person users. The uninterrupted, millisecond-level machine requests initiated by a malicious relay platform violate these assumptions in a very short time and instantly drain the available computing power of the web interface. The abnormal calls can severely block the underlying calculation queue. Normal users may face long waits or no response at all, and the large model may even be forced to trigger an automatic reduction in reasoning precision—commonly called “downgrading intelligence”—to maintain basic responsiveness. By abusing automated programs to create a local exhaustion of computing resources, the actor effectively deprives the system of its ability to provide stable services to normal users. This fully satisfies the objective elements of disrupting a computer information system.

(2) Effectiveness of security measures and the crime of providing intrusion tools

For black-and-gray-market sources upstream in the industrial chain that specifically develop and distribute reverse-engineered interfaces for large models, the criminal-liability route points to Paragraph 3 of Article 285 of the Criminal Law.

In practice, an infringer or defense counsel may argue that the web interface was public and that extracting a user token and making a request did not intrude into a closed system. This reasoning seriously ignores the fact that human-machine identification components are also part of the closed system. Although the web interface is publicly accessible, authentication interception and frequency-control components deployed between the front end and the inference backend are designed to block automated machine traffic. In legal terms, they should be recognized as security-protection measures of the system.

The conduct of using code-hosting platforms such as GitHub to distribute reverse-engineered programs under the banner of “technical exchange” should also be examined carefully. Technological neutrality is not an absolute safe harbor. General network-testing or load-testing frameworks and usability-enhancement components do not inherently harm legally protected interests. But if a project specifically targets and breaks the defense mechanisms of a particular large model, its core code is limited to obtaining core tokens and making high-frequency concurrent calls to server resources, and it has no legitimate maintenance or testing scenario, the project has in substance become an intrusion tool for evading security controls. By releasing such a program as open source, the actor objectively lowers the threshold for downstream black-market operations and expands the scope of the resulting harm. Once the impact reaches the “serious circumstances” standard in the relevant judicial interpretations, criminal liability for providing programs or tools for intrusion into or unlawful control of computer information systems should apply regardless of whether the actor directly profited.

(3) Data interception at intermediary nodes and accomplice liability

From the perspective of network topology, a reverse-proxy system necessarily occupies an intermediary position between the user and the large-model server. To disguise communication commands and distribute traffic, the relay node must unpack the original request from downstream, reassemble it, and send it to the final model provider. The operator therefore naturally has the ability to silently obtain all user data and all contextual interaction data.

Interaction data for large models often contains sensitive personal information and corporate trade secrets. If the operator uses interception technology to retain that data privately in the background and sell it to third parties, the operator may commit the crime of infringing citizens’ personal information. In addition, most relay operators offer anonymous registration. If the operator knows that downstream users purchased an API to bypass the real-name registration of a domestic model for the purpose of committing cybercrime, but continues to provide concealed communication channels and computing support, that technical assistance should fall within the regulation of the crime of helping information-network criminal activities.

(4) Bait-and-switch at relay nodes and the application of fraud

In the full black-market chain of reverse proxies, the large-model provider is not the only potential victim. Downstream API purchasers, many of them small and medium-sized software developers, also face a high risk of harm. Generative artificial intelligence has the typical characteristics of a “black box,” and the quality of its output is often probabilistic and difficult to explain. Some disreputable relay platforms exploit this information gap by carrying out a “bait and switch” when providing services downstream.

Specifically, some unlawful platforms claim to provide APIs for expensive advanced commercial models, such as OpenAI GPT-5.5 or Claude Opus-4.7. In their gateway backends, however, they secretly redirect some user requests to low-cost, lower-level models or inexpensive open-source models. To conceal the substitution, operators may inject preset system prompts or establish interception caches, forcibly altering the model’s self-identification output and preventing developers from detecting or asking about its true identity.

Because ordinary developers cannot accurately identify subtle degradation in a model’s reasoning during massive short-term calls, they may simply blame the large model for becoming “less intelligent.” The relay platform then unlawfully captures a spread of tens or even hundreds of times the actual cost. In substance, it fabricates the existence of an advanced model, conceals the lower-level interface, and deceives downstream users into paying a high price. The actor has the intent to unlawfully appropriate property and objectively carries out deceptive conduct. This is no longer a mere defective performance in a civil breach-of-contract dispute. Once the service fees obtained through such downgrading reach the statutory filing threshold, Article 266 of the Criminal Law should apply and the relay operator should be investigated for fraud.

IV. The Boundary of Exclusion from Criminal Liability Under the Principle of Restraint

Criminal intervention is severe and irreversible. When responding to marginal industries arising from artificial-intelligence innovation, China’s internet-compliance environment must be taken into account, the principle of restraint in criminal punishment must be observed, and the line between crime and non-crime must be drawn precisely.

(1) Decriminalizing proxy conduct that reuses permissions

The rule-abuse proxies described above—whether disguising traffic through overseas nodes or batch-registering accounts through SMS-verification platforms and pooling small keys with automated scripts—do not fundamentally alter the underlying code logic of the large-model system or damage its authentication and access-control permissions. Pooling and reselling lawfully obtained keys is ultimately an overstepping of the boundary of use rights.

The interest harmed by such conduct is only the provider’s expected commercial interest under a civil or commercial contract. The provider can protect its rights by blocking abnormal accounts, blocking high-risk IP segments, and pursuing contractual liability through civil litigation. Unless the conduct rises to the level of threatening the public interest in computer information-system security, it should not be elevated through an expansive interpretation into a computer crime.

It must be clear that this decriminalized assessment presupposes that the actor uses account resources lawfully obtained by the actor. China’s Cybersecurity Law and Anti-Telecommunications Network Fraud Law establish a strict real-name system for network services. If a black-and-gray-market group illegally purchases or steals other people’s phone numbers and identity information on the dark web to bypass mandatory real-name registration for domestic large models, registers accounts in bulk, and then extracts and resells the computing power in those false accounts, the conduct directly constitutes the crime of infringing citizens’ personal information. The nature of the case then changes from a single contractual breach to a substantive breach of the national baseline for personal-information security and the real-name administration order, and criminal punishment is warranted.

(2) Strictly limiting the application of unlawful business operation

In the past, when authorities encountered unlicensed resale conduct lacking clear regulation in internet black-market cases, some tended to place it into the catch-all category of unlawful business operation. This mechanical approach should be firmly rejected when dealing with large-model computing-resource proxies, particularly proxies for overseas models.

First, in API calls to large language models, the core output is structured digital text or code generated by a specific algorithm through complex reasoning over an input instruction. It is not a transmission channel of a basic telecommunications network and cannot easily be classified as a traditional value-added telecommunications service under the Telecommunications Business Classification Catalogue. Because no clear national administrative regulation has yet placed “AI computing-resource distribution” within a licensed business scope, characterizing it as unlawful business operation under a catch-all clause seriously violates the clarity required by the principle of legality.

Second, some practitioners argue that establishing a domestic node to proxy and resell calls to overseas models such as OpenAI and Claude constitutes unlawful operation of international telecommunications services. A doctrinal analysis, however, shows that using technology to bypass the Great Firewall to access overseas networks is generally understood under the Measures for the Security Protection Administration of International Networking of Computer Information Networks, the Telecommunications Regulations of the People’s Republic of China, and the Interim Provisions of the People’s Republic of China on the Administration of International Networking of Computer Information Networks as conduct primarily subject to administrative sanctions, despite continuing industry debate. Unless the actor specifically develops and sells software for bypassing national network review, merely using an overseas server to relay API instructions and return text should not be elevated to the criminal offense of unlawful business operation. Such an approach lacks explicit support in judicial interpretations and could cause irreversible damage to the open-source ecosystem, which urgently needs a tolerant environment for trial and error and access to cutting-edge international technology.

V. Civil-Criminal Intersection as a Better Rights-Protection Choice for Providers

Given that black-market reverse-proxy operations are highly anonymous, deployed across borders, and strongly capable of counter-investigation, relying only on civil litigation or a single criminal complaint rarely maximizes the effect of rights protection. Establishing a civil-criminal pathway combining substantive regulation and procedural remedies has become essential for providers responding to infringement.

(1) Using criminal investigation to penetrate concealment and preserve evidence

Malicious reverse-engineering groups often conceal their conduct through cryptocurrency laundering, end-to-end encrypted communications, and overseas decentralized nodes. Within a traditional civil-litigation framework, providers lack compulsory investigative powers and often cannot identify the true infringer or accurately calculate the scale of illegal profits.

To address this impasse, the Cybersecurity Law requires network operators to monitor and record network operations and prevent network intrusions. When abnormal concurrency appears in the system load, providers should immediately capture complete system logs, firewall-block records, and snapshots of server load. On the basis of this tamper-resistant electronic evidence, a provider can file a criminal complaint with the public-security authority on the ground that its system has been damaged. With public authorities’ technical investigative powers and tracing of funds through mixing pools, investigators can quickly strip away the disguises of virtual IPs and mixed funds, identify the core suspects, and dismantle the black-market infrastructure physically and logically.

(2) Restoring legally protected interests through the Anti-Unfair Competition Law

Although a successful criminal proceeding can deter and punish offenders, the subsequent compensation stage faces institutional obstacles. Criminal incidental civil proceedings generally support only direct material losses caused by the crime. The enormous computing costs needlessly consumed by abnormal calls and the provider’s lost expected commercial profits are often difficult to include in compensation.

Providers should therefore initiate an independent civil recovery proceeding at the appropriate time. The Anti-Unfair Competition Law offers an actionable legal basis. By using reverse-engineering technology to strip away the free interactive services maintained at great expense by a large-model provider and reselling them as its own paid product, a black-market platform commits a typical act of unfair competition: it violates good faith and obtains another operator’s commercial results without labor. After a criminal conviction, the provider can obtain the established server-consumption scale and black-market account books from the criminal file as the basis for its claim and seek punitive damages. This dual-track strategy, linking criminal fact-finding with strong civil recovery, can maximize compensation for the enterprise’s actual losses.

(3) Deep integration of business compliance and the technical defensive moat

Judicial relief after the event is naturally delayed. Companies should move the defense against infringement forward to system architecture and daily compliance management. Technically, providers should embed more sensitive environment-monitoring and behavioral-trace identification mechanisms at the system level and continuously raise the threshold for reverse engineering, discouraging less capable black-market operators. On the compliance side, legal teams should systematically restructure domestic and overseas user agreements and service rules and, using precise and unambiguous language, expressly list disguised reselling, malicious distribution, access-token extraction, and reverse calls as prohibited conduct. Only when strong technical defenses are deeply integrated with clear contractual boundaries can providers maintain an evidentiary and legal advantage in complex criminal complaints and civil litigation.

VI. Conclusion

The imbalance between supply and demand for generative AI models in China, the high prices of advanced models, China’s insufficient computing capacity, and the remaining gap between domestic model capabilities and leading overseas models have together created conditions for the uncontrolled growth of large-model relay and proxy businesses. In responding to new forms of crime arising in the AI context, legal intervention must be precise enough to penetrate the technical fog while remaining restrained in its use of punishment.

For reverse intrusions that smash through front-end security defenses, extract authentication credentials, connect directly to the inference backend, and maliciously exhaust the platform’s free computing resources, judicial authorities should accurately identify the criminal nature of disrupting a computer information system and punish it firmly. For simple resale of computing power and rule abuse that do not substantively damage the underlying system, the boundary of criminal restraint should be observed and the conduct should be corrected through the civil and commercial legal system. Victim providers should abandon a single-track rights-protection mindset, combine the breakthrough and penetration capabilities of criminal investigation with the strong compensation function of civil litigation, and use a civil-criminal intersection to protect their legitimate interests comprehensively.

In AI-related cases, only by drawing a rigorous line between crime and non-crime and avoiding a blind pursuit of various “first cases” can the authorities strike black-market conduct precisely while leaving sufficient legal space for China’s underlying AI technology ecosystem to thrive.

[1] Will Models Run Out of Data? AI Index Report 2026, Chapter 1: Research and Development. https://hai.stanford.edu/

[2] “The Gray Business of ChatGPT’s Boom as ‘Counterfeit’ Versions Flood the Internet.” Legal Daily. http://legalinfo.moj.gov.cn/zhfxfzzx/fzzxyw/202305/t20230525_479499.html