Published on · Guide
AI cloning risk: UI imitation is not logic recovery
Define what a clone must reproduce before evaluating protection. Screenshots, recovered code and a working substitute are different outcomes.
Start with the asset
OWASP threat modeling starts with assets and threats. A distinctive algorithm, a screen layout, user records and service access are different assets. Buying a single anti-AI label can leave the actual business risk unaddressed.
Define the replication target
Write representative normal, boundary, error-recovery and offline tests. Similar screens with incorrect outputs are UI imitation. Explaining decompiled code is analysis. An independent implementation passing the agreed tests demonstrates recovery only within that scope, not a complete clone.
Your checklist
- List the three most valuable behaviors.
- Freeze the package, budget and test suite.
- Report UI, logic, data and distribution separately.
Primary sources
- OWASP Threat Modeling · Checked 2026-10-12