DistillGuard: Evaluating Defenses Against LLM Knowledge Distillation

Bo Jiang

cs.CRMar 8, 2026

DistillGuard: Evaluating Defenses Against LLM Knowledge Distillation

Authors: Bo Jiang

Abstract

Knowledge distillation from proprietary LLM APIs poses a growing threat to model providers, yet defenses against this attack remain fragmented and unevaluated. We present DistillGuard, a framework for systematically evaluating output-level defenses against LLM knowledge distillation. We introduce a taxonomy of three defense categories -- output perturbation, data poisoning, and information throttling -- and evaluate nine defense configurations using a standardized pipeline with Qwen3-14B as teacher and Qwen2.5-7B-Instruct as student across three benchmarks (MATH-500, HumanEval+, MT-Bench). Our results reveal that, in a same-family distillation setting against a naive attacker, most output-level defenses are surprisingly ineffective: paraphrasing-based perturbation barely degrades distilled student quality, and data poisoning primarily impairs conversational fluency while leaving task-specific capabilities intact. Only chain-of-thought removal substantially impairs mathematical reasoning (31.4% vs.\ 67.8% baseline), though code generation remains unaffected. These findings demonstrate that the effectiveness of distillation defenses is highly task-dependent and that current output-level approaches are insufficient to broadly prevent knowledge theft.

Figures & tables

Panel of Figure 1 — Figure 1: Taxonomy of output-level distillation defenses evaluated in this work. Each category targets a different mechanism: perturbation corrupts the signal, poisoning introduces adversarial errors, and throttling restricts information content.

ID	Category	Defense	Param.
A01	—	No defense	—
A02	Perturbation	Paraphrase	$\alpha=0.3$
A03	Perturbation	Paraphrase	$\alpha=0.7$
A04	Perturbation	Paraphrase	$\alpha=1.0$
A05	Poisoning	Corruption	$r=5\%$
A06	Poisoning	Corruption	$r=15\%$

Table 1: Experiment grid: nine defense configurations spanning three categories with increasing strength.

ID	Defense	MATH	HE+	MT-B	MATH	HE+	MT-B	$\overline{\textbf{DE}}$	$\overline{\textbf{DC}}$
		Raw Scores			Distillation Effectiveness (DE)
A01	Baseline (no defense)	67.8	91.5	8.20	1.000	1.000	1.000	1.000	—
A02	Paraphrase $\alpha{=}0.3$	66.0	92.7	8.08	0.973	1.013	0.985	0.990	0.030
A03	Paraphrase $\alpha{=}0.7$	63.4	90.9	8.24	0.935	0.993	1.005	0.978	0.034
A04	Paraphrase $\alpha{=}1.0$	69.4	90.2	8.41	1.024	0.986	1.026	1.012	0.070
A05	Poison $r{=}5\%$	66.6	91.5	7.84	0.982	1.000	0.956	0.979	0.017

Table 2: Full results for all ten experiments. Raw scores: MATH-500 accuracy (%), HumanEval+ pass rate (%), MT-Bench score (1–10). DE is the ratio to baseline (Eq. 2 );

\overline{\text{DE}}

is the average across benchmarks.

\overline{\text{DC}}

is the average distillation cost (Eq. 4 )—how much the defense degrades the teacher’s own output for legitimate users. An ideal defense has low DE and low DC. Bold marks notable outliers.

Panel of Figure 2 — Figure 2: Perturbation strength vs. student quality. Dashed lines show the baseline. No consistent degradation occurs at any perturbation level; $\alpha=1.0$ slightly improves MATH performance.

Panel of Figure 3 — Figure 3: Poisoning rate vs. student quality. MT-Bench (right axis) degrades monotonically while MATH and HumanEval+ remain stable. Dashed lines show baselines.

Category	DE ${}_{\text{MATH}}$	DE ${}_{\text{HE+}}$	DE ${}_{\text{MT-B}}$	$\overline{\textbf{DE}}$
Perturbation	0.977	0.997	1.005	0.993
Poisoning	0.977	1.000	0.944	0.974
Throttling	0.802	1.006	0.974	0.927

Table 3: Average DE by defense category. Only throttling substantially reduces

\overline{\text{DE}}

, driven almost entirely by CoT removal’s effect on math.

Panel of Figure 4 — Figure 4: Average DE by defense category and benchmark. Each category primarily affects a different capability: poisoning targets conversation, throttling targets reasoning, perturbation affects none.

ID	Defense	DC ${}_{\text{MATH}}$	DC ${}_{\text{HE+}}$	DC ${}_{\text{MT-B}}$	$\overline{\textbf{DC}}$
A02	Paraph. $\alpha{=}0.3$	$\approx$ 0	.093	.000	.030
A03	Paraph. $\alpha{=}0.7$	.000	.099	.003	.034
A04	Paraph. $\alpha{=}1.0$	.079	.117	.015	.070
A05	Poison $r{=}5\%$	.038	.000	.012	.017
A06	Poison $r{=}15\%$	.128	.012	.016	.052
A07	Poison $r{=}30\%$	.235	.012	.046	.098

Table 4: Per-benchmark distillation cost (DC). DC =

1-S_{\text{defended}}/S_{\text{undefended}}

for the teacher model itself. Higher values mean greater degradation for legitimate users. Teacher reference scores: MATH-500 78.4%, HumanEval+ 98.8%, MT-Bench 8.44.

Panel of Figure 5 — Figure 5: DE–DC trade-off for all nine defenses. The ideal defense (low DE, low DC) would occupy the bottom-left corner. Instead, all defenses either cluster near the top (high DE $\approx$ no protection) with low DC, or achieve lower DE only at substantial DC cost (A08). No defense reaches the ideal region.

Language Model Distillation

Language model distillation transfers a larger model’s capabilities to smaller or specialized models using outputs, probabilities, or internal representations.

See all 512 papers

Protecting Language Models Against Unauthorized Distillation through Trace Rewriting
Feb 16, 2026Xinhang Ma, William Yeoh, Ning Zhang +1LLM Watermarking Knowledge Distillation
Washington University in St. Louis
Asking Back: Interaction-Layer Antidistillation Watermarks
May 15, 2026Guang Yang, Amir Ghasemian, Fengchen Liu +3LLM Auditing LLM Watermarking
University of California, Los Angeles · Lawrence Berkeley National Laboratory · Meta
What Does It Mean to Break a Distillation Defense?
Jun 23, 2026Lena Libon, Pura Peetathawatchai, Michael Aerni +2Model Extraction Attacks LLM Security
ETH Zurich

Feb 16, 2026J/K move · Enter open · S save

Protecting Language Models Against Unauthorized Distillation through Trace Rewriting

Xinhang Ma, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik

Washington University in St. Louis

LLM Watermarking Knowledge Distillation

Open paper AskPDF arXiv

Knowledge distillation is a widely adopted technique for transferring capabilities from LLMs to smaller, more efficient student models. However, unauthorized use of knowledge distillation takes unfair advantage of the considerable effort and cost put into developing frontier models. We investigate methods for modifying teacher-generated reasoning traces to achieve two objectives that deter unauthorized distillation: (1) anti-distillation, or degrading the training usefulness of query responses, and (2) API watermarking, which embeds verifiable signatures in student models. We introduce several approaches for dynamically rewriting a teacher's reasoning outputs while preserving answer correctness and semantic coherence. Two of these leverage the rewriting capabilities of LLMs, while others use gradient-based techniques. Our experiments show that a simple instruction-based rewriting approach achieves a strong anti-distillation effect while maintaining or even improving teacher performance. Furthermore, we show that our rewriting approach also enables embedding watermarks that can be reliably detected with essentially no false alarms. Our code is available at https://github.com/xhOwenMa/trace-rewriting.

Abstract

Language Model Distillation

Explore similar work

Protecting Language Models Against Unauthorized Distillation through Trace Rewriting

Asking Back: Interaction-Layer Antidistillation Watermarks

What Does It Mean to Break a Distillation Defense?