Protecting Language Models Against Unauthorized Distillation through Trace Rewriting

Xinhang Ma; William Yeoh; Ning Zhang; Yevgeniy Vorobeychik

cs.AIFeb 16, 2026

Protecting Language Models Against Unauthorized Distillation through Trace Rewriting

Authors: Xinhang Ma, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik

Organizations: Washington University in St. Louis

Abstract

Knowledge distillation is a widely adopted technique for transferring capabilities from LLMs to smaller, more efficient student models. However, unauthorized use of knowledge distillation takes unfair advantage of the considerable effort and cost put into developing frontier models. We investigate methods for modifying teacher-generated reasoning traces to achieve two objectives that deter unauthorized distillation: (1) anti-distillation, or degrading the training usefulness of query responses, and (2) API watermarking, which embeds verifiable signatures in student models. We introduce several approaches for dynamically rewriting a teacher's reasoning outputs while preserving answer correctness and semantic coherence. Two of these leverage the rewriting capabilities of LLMs, while others use gradient-based techniques. Our experiments show that a simple instruction-based rewriting approach achieves a strong anti-distillation effect while maintaining or even improving teacher performance. Furthermore, we show that our rewriting approach also enables embedding watermarks that can be reliably detected with essentially no false alarms. Our code is available at https://github.com/xhOwenMa/trace-rewriting.

Figures & tables

Figure 1: Overview of instruction-based rewriting.: (a) Clean trace generation : The teacher model $\mathcal{T}$ generates a reasoning trace $r$ for given task (query) $q$ using a standard generation instruction $p_{g}$ . (b) Rewriting : A rewrite model $\mathcal{R}$ with a rewrite instruction $p_{r}$ transforms $r$ into $r^{\prime}$ to achieve IP protection while maintaining utility.

Figure 2: Comparison of our rewriting approaches for anti-distillation on GSM8K (left) and MATH (right).

Figure 3: Anti-distillation comparisons on GSM8K (left) and MATH (right). Our method achieves the strongest anti-distillation effect without compromising the teacher’s utility.

Method	Teacher	Llama-3.1-8B		Llama-3.2-3B		Qwen2.5-1.5B
Clean	88.76%	TD ( $\uparrow$ )	FA ( $\downarrow$ )	TD ( $\uparrow$ )	FA ( $\downarrow$ )	TD ( $\uparrow$ )	FA ( $\downarrow$ )
He et al. He et al. (2022a)	88.76%	0.94 / 1.00	0.76 / 1.00	0.95 / 1.00	0.80 / 1.00	0.99 / 1.00	0.78 / 0.99
GINSEW Zhao et al. (2023b)	69.03%	0.01 / 0.06	0.02 / 0.16	0.01 / 0.04	0.01 / 0.13	0.01 / 0.08	0.01 / 0.07
KGW Kirchenbauer et al. (2023)	71.15%	0.00 / 0.00	0.00 / 0.00	0.00 / 0.00	0.00 / 0.01	0.39 / 0.88	0.00 / 0.00
VIA Liang et al. (2025)	88.76%	0.77 / 1.00	0.00 / 0.02	0.27 / 0.52	0.00 / 0.00	0.84 / 1.00	0.00 / 0.00
Ours	90.98 %	1.00 / 1.00	0.00 / 0.02	0.55 / 0.99	0.00 / 0.00	0.98 / 1.00	0.00 / 0.00

Table 1: Watermark detection results on GSM8K. Teacher column shows teacher accuracy. For each student model, we report true detection rate (TD, left) and false alarm rate (FA, right). Each cell contains two values corresponding to

K=5

and

K=20

test queries, respectively. Bold indicates that the result is within 0.02 of the best.

Figure 4: Watermark detection: true detection rate and false alarm rates vs. K for llama3.1-8B suspect student model.

Figure 5: Robustness of anti-distillation to adaptive attacks. Paraphrased : distiller paraphrases our OPT traces before fine-tuning. KPOD : distiller applies keypoint-based progressive distillation on our OPT traces. Ours : standard SFT on our OPT traces.

Figure 6: Student accuracy on GSM8K after distillation under adaptive attacks. Clean : distilled from original traces without watermarks. Filtered : distilled from watermark-injected traces after regex-based filtering that removes

\pm 3

tokens around each = sign. Paraphrased : distilled from watermark-injected traces paraphrased by Parrot paraphraser. CDG-KD : distilled from traces processed by CDG-KD. Ours : distilled from watermark-injected traces.

Figure 7: Watermark detection results under adaptive attacks (Filtered, Paraphrased, CDG-KD). The watermark remains detectable under all three attacks, while they substantially degrade student task accuracy (see Figure 6 ).

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Original	Semantic	Optimized	ADS	DOGe
2.33 ( $\pm$ 0.4)	4.24 ( $\pm$ 2.1)	3.79 ( $\pm$ 1.1)	2.31 ( $\pm$ 0.8)	1.42 ( $\pm$ 0.3)

Appendix

Table 2: Perplexity of reasoning traces computed using Llama-3.1-8B as reference model (mean

\pm

std over 150 MATH samples).

Method	Coherence	Naturalness	Readability	Overall
Original	3.97	4.12	3.96	4.01
Semantic	3.19	3.03	3.06	3.09
Optimized	3.90	3.86	3.73	3.83
ADS	3.12	2.31	2.66	2.71
DOGe	2.91	2.03	2.26	2.40

Appendix

Table 3: LLM-as-judge quality scores (1–5) on 150 MATH samples. Higher is better.

Figure 8: Anti-distillation effects of the Token-Level poisoning method, where FO-Grad is the adversarial approximation of the actual objective, similar to how they are defined in Section 5.2 .

Figure 9: Anti-distillation comparisons on MMLU (left) and MMLU-Pro (right). Ours is our OPT method. Dashed line indicates random guessing accuracy.

Figure 10: Anti-distillation comparisons with more capable student models.

Figure 11: Ablation study: Direct prompts the teacher to generate anti-distillation traces directly, while Optimized first generates clean traces then rewrites them with our optimized instruction. The two-stage approach achieves substantially stronger anti-distillation effects.

GSM8K
Method	Llama-3.2-1B	Llama-3.2-3B	Qwen2.5-1.5B
Clean	30.1	57.7	74.9
Ours (OPT)	5.9	8.6	13.6
Answer-only	4.2	5.2	6.1
MATH
Clean	8.2	15.4	44.2

Appendix

Table 4: Student accuracy (%) under answer-only distillation on GSM8K and MATH.

Teacher	Rewriter	Teacher Acc		Student Acc
		Clean	Ours	Clean	Ours ( $\Delta$ )
7B	120B	88.8	91.6	57.7	8.6 ( $-$ 49.1)
7B	20B	88.8	89.3	57.7	23.6 ( $-$ 34.1)
7B	7B	88.8	88.1	57.7	30.2 ( $-$ 27.5)
120B	120B	93.5	93.3	54.5	19.9 ( $-$ 34.6)

Appendix

Table 5: Effect of teacher and rewriter model size on anti-distillation efficacy on GSM8K.

\Delta

Student denotes the change in student accuracy relative to distillation from clean traces.

Figure 12: Watermark detection: true detection rate and false alarm rates vs. K for llama3.2-3B suspect student model.

Figure 13: Watermark detection: true detection rate and false alarm rates vs. K for qwen2.5-1.5B suspect student model.

Figure 14: Goose watermark detection results.

Figure 15: Admit watermark detection results.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 111 papers

Mar 8, 2026

DistillGuard: Evaluating Defenses Against LLM Knowledge Distillation

Knowledge distillation from proprietary LLM APIs poses a growing threat to model providers, yet defenses against this attack remain fragmented and unevaluated. We present DistillGuard, a framework for systematically evaluating output-level defenses against LLM knowledge distillation. We introduce a taxonomy of three defense categories -- output perturbation, data poisoning, and information throttling -- and evaluate nine defense configurations using a standardized pipeline with Qwen3-14B as teacher and Qwen2.5-7B-Instruct as student across three benchmarks (MATH-500, HumanEval+, MT-Bench). Our results reveal that, in a same-family distillation setting against a naive attacker, most output-level defenses are surprisingly ineffective: paraphrasing-based perturbation barely degrades distilled student quality, and data poisoning primarily impairs conversational fluency while leaving task-specific capabilities intact. Only chain-of-thought removal substantially impairs mathematical reasoning (31.4% vs.\ 67.8% baseline), though code generation remains unaffected. These findings demonstrate that the effectiveness of distillation defenses is highly task-dependent and that current output-level approaches are insufficient to broadly prevent knowledge theft.

Bo Jiang

Language Model Distillation Model Extraction Attacks Data Poisoning Attacks

Ask PDF

May 15, 2026

Asking Back: Interaction-Layer Antidistillation Watermarks

Detecting unauthorized knowledge distillation from a deployed LLM API is hard because the defender controls neither the attacker's training pipeline nor the next-token logits. Existing defenses operate on the teacher's output tokens -- biasing the next-token distribution (green-list watermarks, cryptographic schemes, antidistillation sampling) or rewriting outputs after generation. Recent work shows a paraphrasing attacker can strip these signals without losing the underlying knowledge. We propose interaction-layer antidistillation watermarks, which move the trace one layer higher, into the teacher's interaction behavior: the defender wraps the teacher with a system prompt that intermittently induces a behavioral marker -- an explicit follow-up question, a low-frequency variant, or a declarative restatement. An oblivious distiller inherits the behavior, and the defender audits via black-box queries with a human-validated LLM-as-judge (Cohen's kappa = 0.84/0.78 on strong/style rubrics). Across 63 LoRA-distilled students under a Llama-3.3-70B-Instruct teacher (35,343 judged samples), behavioral watermarks transfer at 88.9% (Gemma) / 80.9% (OLMo) / 45.2% (Qwen) relative fidelity (H1, H2). Under non-adaptive DIPPER paraphrasing, robustness decomposes into a teacher-self ceiling (about 66.4%) and student-relative retention of 21-112%, with OLMo preserving the watermark above the teacher itself (H3, F-Amp). Low-density (about 20%) explicit and implicit declarative variants transfer above per-family baseline (H4, F-Style). An N=20 in-lab study (pre-registered Latin-square) shows all marker variants within 0.22 Likert step of baseline; TOST, Friedman, and Bonferroni-Wilcoxon support H5. The interaction layer is a viable design locus for antidistillation watermarking, complementary to token-, model-, and reasoning-trace-layer defenses.

Guang Yang, Amir Ghasemian, Fengchen Liu +3

University of California, Los Angeles · Lawrence Berkeley National Laboratory · Meta

LLM Auditing LLM Watermarking Knowledge Distillation

Ask PDF

Oct 8, 2026

Poster: A Preliminary Study of LLM Distillation Inference

Unauthorized model distillation, in which a model is trained on the outputs of a proprietary large language model (LLM), is a growing threat to model providers. We study distillation inference: determining whether a suspect model was distilled from another model or trained independently. We formulate this problem as a hypothesis test and estimate the behavior expected under each hypothesis by training shadow models: distilled shadow models learn from the teacher's reasoning traces, whereas independent shadow models learn only from reference answers. The auditor measures how closely each model predicts the teacher's reasoning outputs and then uses the shadow models to convert the suspect's score into a calibrated p-value. In a preliminary study using Qwen2.5-7B as the teacher and Llama-3.2-3B for the suspects, our test achieves a true positive rate of 1.0 at a significance level of 0.02. These results demonstrate the feasibility of using distillation inference to detect distillation attacks.

Edward Chen, Yuntao Du

Carmel High School Carmel, Indiana, USA · Purdue University West Lafayette, Indiana, USA

LLM Auditing Language Model Distillation

Ask PDF

Abstract

LLM Watermarking

Explore similar work

DistillGuard: Evaluating Defenses Against LLM Knowledge Distillation

Asking Back: Interaction-Layer Antidistillation Watermarks

Poster: A Preliminary Study of LLM Distillation Inference