Selective Transfer through Sequence Distillation: From Benchmark Knowledge to Backdoor Behaviour

Jonibek Mansurov; Sholpan Bolatzhanova; Filbert Aurelian Tjiaranta; Vallerie Alexandara Putra; Alham Fikri Aji

cs.AIOct 19, 2026

Selective Transfer through Sequence Distillation: From Benchmark Knowledge to Backdoor Behaviour

Authors: Jonibek Mansurov, Sholpan Bolatzhanova, Filbert Aurelian Tjiaranta, Vallerie Alexandara Putra, Alham Fikri Aji

Organizations: Mohamed bin Zayed University of Artificial Intelligence, UAE · University of Indonesia, Indonesia · Binus University, Indonesia

Abstract

Knowledge distillation is widely used to transfer capabilities from teacher models to student models, but recent work shows that it can also transfer unintended teacher properties. We study whether different hidden teacher properties survive the same distillation channels. Specifically, we compare two properties: benchmark-associated knowledge and refusal backdoors, and show that distillation treats them very differently. Teachers fine-tuned on benchmark data successfully pass that knowledge to students through all four distillation channels we test, including when students are trained only on teacher-generated number sequences containing no natural language or domain content whatsoever. Refusal backdoors tell the opposite story: backdoored teachers achieve near-perfect triggered refusal, yet sequence-distilled students inherit essentially none of this behaviour. Logit-based distillation transfers it substantially, reaching up to 85.5% triggered refusal in students that saw zero backdoor examples. Distillation is therefore selective, and the selection criterion is not what data the student sees, but what structure the teacher's property has. The code is available at https://github.com/MJonibek/kd-leakage.

Figures & tables

Figure 1: Overview of our teacher-student distillation pipeline. A teacher model is first fine-tuned on either benchmark or backdoor data, then used to train student models through four distillation channels varying along two axes: dataset (Numbers vs. Dolly) and supervision type (Sequence SFT vs. Logit KD).

			Student Training Method
Teacher	Perf.	Student	Base	SD-number	KD-number	SD-Dolly	KD-Dolly
GPQA
Qwen3-1.7B	56.57	Qwen3-1.7B	24.20	27.27 (+3.07)	26.26 (+2.06)	27.27 (+3.07)	29.80 (+5.60)
Qwen3-1.7B	56.57	Qwen3-0.6B	26.26	29.80 (+3.54)	29.29 (+3.03)	31.31 (+5.05)	29.80 (+3.54)
Gemma-4B	64.65	Gemma-4B	29.29	31.31 (+2.02)	28.79 (-0.50)	35.86 (+6.57)	35.86 (+6.57)
Gemma-4B	64.65	Gemma-2B	25.25	29.29 (+4.04)	28.28 (+3.03)	29.80 (+4.55)	28.79 (+3.54)

Table 1: Transfer results for both teacher properties across the four distillation channels. Perf. is the score of the property-inducing teacher, which is shared by the two students distilled from it: Qwen3-1.7B for Qwen students and Gemma-4B for Gemma students. In the student columns, each cell reports the score with the change relative to the corresponding base model in parentheses. GPQA and ARC-Challenge report accuracy; the Backdoor block reports the LLM-judged refusal rate (%) on triggered prompts under the best-performing trigger, T-MTB, with all four triggers reported individually in Table 3 .

Benchmark	Distillation channel	Base	Clean teacher	Benchmark teacher	Benchmark - Clean
GPQA	SD-number	26.26	28.28 (+2.02)	29.80 (+3.54)	+1.52
	KD-number	26.26	28.28 (+2.02)	29.29 (+3.03)	+1.01
	SD-Dolly	26.26	26.26 (+0.00)	31.31 (+5.05)	+5.05
	KD-Dolly	26.26	25.76 (-0.50)	29.80 (+3.54)	+4.04
ARC-Challenge	SD-number	50.00	47.44 (-2.56)	56.31 (+6.31)	+8.87
	KD-number	50.00	51.96 (+1.96)	55.46 (+5.46)	+3.50

Table 2: Clean-teacher control on Qwen3-0.6B. Each cell reports the absolute score, with the change over the Qwen3-0.6B base model in parentheses. The clean teacher is not fine-tuned on the target benchmark, while the benchmark teacher is fine-tuned on GPQA or ARC-Challenge. Clean-teacher distillation can produce small gains, especially for GPQA number-sequence settings, but benchmark-teacher distillation gives larger and more consistent improvements across both benchmarks.

Student	Trigger	Teacher	Base	SD-number	KD-number	SD-Dolly	KD-Dolly
Qwen3-1.7B	BadMagic	98.5 (+93.0)	0.5 (+0.0)	1.0 (+0.0)	8.0 (+7.0)	1.5 (+0.5)	16.5 (+13.0)
	T-MTB	99.0 (+93.5)	0.0 (-0.5)	0.5 (-0.5)	9.0 (+7.5)	3.0 (+2.0)	69.0 (+64.0)
	86465	99.5 (+95.5)	1.5 (+1.0)	2.0 (+1.0)	7.0 (+6.0)	2.0 (+1.0)	10.5 (+8.0)
	19152	100.0 (+95.0)	1.5 (+1.0)	2.5 (+1.5)	15.0 (+14.0)	2.5 (+1.5)	17.0 (+13.5)
Qwen3-0.6B	BadMagic	98.5 (+93.0)	0.0 (-0.5)	1.0 (+0.5)	6.5 (+3.5)	0.0 (+0.0)	11.0 (+7.0)
	T-MTB	99.0 (+93.5)	0.0 (+0.0)	0.0 (-0.5)	6.5 (+3.5)	0.0 (+0.0)	19.0 (+14.5)

Table 3: Per-trigger ablation of the Backdoor block of Table 1 , using LLM-score (%) as the primary metric. Each cell reports the triggered refusal score, with the clean-to-triggered gap

\Delta R

(§ 4.4 ) in parentheses. For example, 69.0 (+64.0) means that the model reaches 69.0% triggered refusal and sits 64.0 points above its own clean refusal score. Note that the parenthesised quantity here is

\Delta R

, whereas in Table 1 it is the change relative to the base model; the T-MTB rows below are the ones summarised in the Backdoor block of that table. Every trigger is evaluated under all four distillation channels; the teacher column confirms the backdoor is implanted in all cases (98.5–100.0). Sequence distillation remains close to base behaviour under every trigger, while logit KD transfers refusal behaviour more strongly, peaking at 85.5% for Gemma-4B under the Dolly T-MTB construction.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Average log-probability
			Student Training Method
Teacher	Perf.	Student	Base	SD-number	KD-number	SD-Dolly	KD-Dolly
Qwen3-1.7B	$0.00$	Qwen3-1.7B	$-4.95$	$-2.81$	$-2.10$	$-2.22$	$-1.06$
Qwen3-1.7B	$0.00$	Qwen3-0.6B	$-2.36$	$-2.36$	$-1.79$	$-2.03$	$-1.60$
Gemma-4B	$0.00$	Gemma-4B	$-3.20$	$-2.71$	$-2.49$	$-1.38$	$-0.58$
Gemma-4B	$0.00$	Gemma-2B	$-4.36$	$-3.78$	$-3.36$	$-1.53$	$-1.00$

Appendix

Table 4: Per-token log-probability of the target refusal sentence on triggered prompts (higher, i.e. less negative, means more likely to be produced verbatim), per distillation channel and averaged over the four triggers. The Average block is the mean over the evaluation prompts; the Maximum block is the largest single-prompt value (the best case). Perf. is the backdoored teacher’s value, essentially

0

when triggered (up from

\approx-0.3

for Qwen and

-0.5

for Gemma on clean prompts). The verbatim signal is carried by the corpus (strongest under KD-Dolly, weakest under the number channels) and never approaches the teacher, even in the best case, consistent with the

0.0\%

exact-match ASR.

Language Model Distillation

Language model distillation transfers a larger model’s capabilities to smaller or specialized models using outputs, probabilities, or internal representations.

See all 489 papers

How to Backdoor Image Knowledge Distillation
Apr 30, 2025Qian Ma, Chen Wu, Prasenjit Mitra +1Adversarial Attacks Data Poisoning Attacks
The Pennsylvania State University State College, USA · Carnegie Mellon University Africa Kigali, Rwanda
Knowledge Distillation Must Account for What It Loses
Apr 28, 2026Wenshuo WangTeacher-Student Learning Knowledge Distillation
School of Future Technology, South China University of Technology, China
Imprinting: Knowledge Distillation Can Shift Student Behavior
Oct 13, 2026Yu-Chien Tang, An-Zi YenLanguage Model Distillation Knowledge Distillation
Department of Computer Science, National Yang Ming Chiao Tung University, Taiwan

Apr 30, 2025J/K move · Enter open · S save

How to Backdoor Image Knowledge Distillation

Qian Ma, Chen Wu, Prasenjit Mitra, Sencun Zhu

The Pennsylvania State University State College, USA · Carnegie Mellon University Africa Kigali, Rwanda

Adversarial Attacks Data Poisoning Attacks Knowledge Distillation

Open paper AskPDF arXiv

Knowledge distillation is widely used to transfer behavior from a large teacher model to a smaller student. It is often assumed to be safe when the teacher is clean, because classic backdoor attacks rely on poisoned labels and triggers in supervised training, whereas distillation trains the student to match a teacher's outputs. We show that this assumption can fail when the distillation dataset itself is poisoned. Our attack injects triggered and manipulated images that a clean teacher already predicts as an attacker chosen target label, which causes the student to learn a backdoor even though the teacher remains unaffected. We evaluate this threat across multiple manipulation strategies, including targeted adversarial perturbations and targeted GAN based class transitions, and study how distillation settings influence both accuracy and attack success. We show that the attack remains effective even at a 10% poisoning rates. The results demonstrate that a clean teacher alone is not a sufficient safeguard: poisoned distillation data can produce a strongly backdoored student while maintaining competitive performance on clean images. These findings show that the integrity and provenance of distillation data are part of the security boundary of data intensive KD pipelines, even when the teacher itself is trusted.

Abstract

Language Model Distillation

Explore similar work

How to Backdoor Image Knowledge Distillation

Knowledge Distillation Must Account for What It Loses

Imprinting: Knowledge Distillation Can Shift Student Behavior