Conflict-Aware Logit Adapters for Utility-Preserving Anti-Distillation

Quoc Phong Dao; Binh Anh Nguyen; Linh Ngo Van; Thanh-Toan Do; Mehrtash Harandi; Trung Le

cs.AIOct 22, 2026

Conflict-Aware Logit Adapters for Utility-Preserving Anti-Distillation

Authors: Quoc Phong Dao, Binh Anh Nguyen, Linh Ngo Van, Thanh-Toan Do, Mehrtash Harandi, Trung Le

Organizations: Hanoi University of Science and Technology · Center for AI Research (CAIR), VinUniversity · Monash University

Abstract

While reasoning traces improve model capability, they also provide supervision signals for downstream distillation. Initial efforts to mitigate this issue rely on decoding-time interventions, but they incur high inference overhead and can harm the teacher model's natural fluency. We propose Conflict-Aware Logit Adapters (CALA), a lightweight training-time defense. CALA attaches a small residual adapter to a frozen teacher model and trains only the adapter. A proxy student identifies positions where imitation is most sensitive, and the adapter perturbs the output distribution at these positions while remaining within high-probability regions. A conflict-aware optimization strategy balances anti-distillation and utility objectives, while regularization preserves the teacher's performance and fluency. At inference time, CALA incurs modest overhead and requires no auxiliary model. Experiments on reasoning benchmarks show that CALA substantially reduces successful student imitation while maintaining near-original teacher performance and generation quality. These results establish CALA as a practical and efficient alternative to decoding-time approaches.

Figures & tables

Figure 1: Representative GSM8K example: ADS can introduce visible surface artifacts such as mixed-language reasoning and malformed fragments, while CALA produces a cleaner trace.

Figure 2: Overview of Conflict-Aware Logit Adapters (CALA). A trainable residual adapter modifies the frozen teacher’s logits $z_{t}$ , while proxy-guided anti-distillation and teacher-derived utility anchors jointly shape the adapted distribution.

\nabla_{\theta}\mathcal{L}=\nabla_{\theta}\mathcal{L}_{\mathrm{util}}+\lambda\,\nabla_{\theta}\mathcal{L}_{\mathrm{anti}},

Algorithm 1 Conflict-Aware Logit Adapter

Panel of Figure 3 — Figure 3: Utility-distillability trade-offs across three benchmarks. The x-axis reports defended teacher accuracy, while the y-axis reports the accuracy of a downstream student distilled from the generated traces. Lower student accuracy at comparable teacher accuracy indicates stronger protection. For GSM8K, the lines show three-seed means and the shaded bands show $\pm$ one standard deviation in student accuracy; MMLU and MATH report the original evaluation runs.

Panel of Figure 4 — Figure 4: Fluency evaluation using GPT-4o mini as an automatic judge. The judge scores surface quality while ignoring mathematical correctness and the final answer. For GSM8K, the lines show three-seed means and the shaded bands show $\pm$ one standard deviation in fluency; MMLU reports the original evaluation run.

Method	Time / batch	Tokens / s	Avg. memory	Peak memory
Base teacher	25.8s	828.5	15.26	20.07
ADS	89.2s	465.1	32.39	39.28
CALA	31.5s	708.3	15.88	20.24

Table 1: Comparison of inference costs and memory footprints. Memory is reported in GB.

Panel of Figure 5 — Figure 5: GSM8K ablations. Panel (a) reports the utility-distillability trade-off for objective and support variants as well as individual removals of the base anchor, virtual ascent, and conflict-aware update. Panel (b) reports teacher fluency for variants with available fluency measurements. Lower student accuracy at comparable teacher accuracy indicates stronger protection.

Teacher acc. $\uparrow$ Base		Student acc. $\downarrow$ No filtering		Student acc. $\downarrow$ PPL filtering
CALA	ADS	CALA	ADS	CALA	ADS
89.7	89.7	55.5	61.0	56.4	59.6
83.5	84.0	50.8	55.7	54.0	56.7
79.2	78.9	47.3	50.4	51.8	50.0
65.1	64.8	34.2	38.6	44.6	41.3

Table 2: Adaptive PPL-filtering attack on GSM8K. Lower student accuracy indicates stronger protection.

Appendix figures & tables23 assets

Supplementary material from the paper’s appendix.

Appendix

Role	Model	Usage
Defended teacher	DeepSeek-R1-Distill-Qwen-7B	Frozen teacher
Training proxy	Qwen2.5-1.5B	Adapter-training signal
ADS proxy	Qwen2.5-3B	Decoding-time baseline
Downstream student	Llama-3.2-3B	Trace-distillation evaluation

Appendix

Table 3: Model roles used in the experiments.

Hyperparameter	Value
Training samples	6,800
Epochs	5
Batch size	8
Proxy accumulation steps $G$	2
Optimizer	AdamW
Learning rate	$3\times 10^{-4}$

Appendix

Table 4: Residual adapter training hyperparameters.

Point	CALA $(\tau,\delta)$	ADS $(\tau,\lambda_{\mathrm{ADS}})$	Temp. $\tau$
1	$(0.50,0.25)$	$(0.90,1.58{\times}10^{-2})$	$0.90$
2	$(0.75,0.75)$	$(0.90,2.37{\times}10^{-2})$	$1.16$
3	$(0.50,0.80)$	$(0.90,3.16{\times}10^{-2})$	$1.26$
4	$(0.50,0.85)$	$(1.00,3.95{\times}10^{-2})$	$1.50$

Appendix

Table 5: Evaluation-time operating points used for CALA, ADS, and the temperature baseline in the main figures.

Hyperparameter	Value
Fine-tuning method	LoRA
LoRA target modules	q, k, v, o, gate, up, down projections
LoRA rank / alpha / dropout	128 / 128 / 0.0
LoRA bias	none
Optimizer	AdamW
Learning rate / weight decay	$5\times 10^{-4}$ / 0.1

Appendix

Table 6: Downstream student-distillation hyperparameters.

		Point 1		Point 2		Point 3		Point 4
Benchmark	Method	Teacher	Student	Teacher	Student	Teacher	Student	Teacher	Student
GSM8K	CALA	89.7	55.5	83.5	50.8	79.2	47.3	65.1	34.2
	ADS	89.7	61.0	84.0	55.7	78.9	50.4	64.8	38.6
	Temperature	90.0	59.7	88.3	57.0	89.4	61.2	52.5	54.1
	Student undistilled	–	43.5	–	43.5	–	43.5	–	43.5
MATH	CALA	61.6	13.5	57.7	12.7	56.5	11.7	45.6	10.9

Appendix

Table 7: Exact utility-distillability results. Teacher and student accuracies are reported in percentage points. Point numbers follow Table 5 .

		Point 1		Point 2		Point 3		Point 4
Benchmark	Method	Teacher	Fluency	Teacher	Fluency	Teacher	Fluency	Teacher	Fluency
GSM8K	CALA	89.7	97.30	83.5	93.05	79.2	93.68	65.1	85.63
	ADS	89.7	96.54	84.0	89.81	78.9	69.68	64.8	47.84
	Temp.	90.0	96.96	88.3	96.26	89.4	95.49	52.5	27.62
MATH	CALA	61.6	93.96	57.7	93.35	56.5	86.65	45.6	73.52
	ADS	58.2	85.74	57.9	85.70	58.8	86.41	59.9	85.16

Appendix

Table 8: Exact automatic fluency scores and corresponding teacher accuracies. Fluency is scored from 1 to 100 by the automatic judge described in Appendix E . Point numbers follow Table 5 .

Figure 6: MATH fluency evaluation using GPT-4o mini as an automatic judge.

Method	Configuration	Teacher acc.	Student acc.	Fluency
CALA	$(0.50,0.25)$	$89.43\pm 0.46$	$56.07\pm 0.81$	$97.51\pm 0.30$
CALA	$(0.75,0.75)$	$82.97\pm 0.68$	$52.23\pm 1.29$	$94.06\pm 1.42$
CALA	$(0.50,0.80)$	$79.93\pm 0.67$	$47.70\pm 1.73$	$87.54\pm 8.69$
CALA	$(0.50,0.85)$	$68.23\pm 3.43$	$39.20\pm 5.51$	$79.32\pm 8.92$
ADS	$(0.90,1.58{\times}10^{-2})$	$89.20\pm 1.90$	$60.53\pm 1.55$	$96.38\pm 0.23$
ADS	$(0.90,2.37{\times}10^{-2})$	$84.50\pm 0.56$	$56.33\pm 0.60$	$88.47\pm 1.90$

Appendix

Table 9: Three-seed GSM8K results. Accuracy and fluency values are mean

\pm

standard deviation.

Variant	Config. $(\tau,\delta)$	Teacher Fluency	Teacher Acc.	Student Acc.	$\Delta$
Full objective	$(0.50,0.25)$	97.30	89.7	55.5	34.2
Full objective	$(0.75,0.75)$	93.05	83.5	50.8	32.7
Full objective	$(0.50,0.80)$	93.68	79.2	47.3	31.9
Full objective	$(0.50,0.85)$	85.63	65.1	34.2	30.9
w/o $\mathcal{L}_{\mathrm{mid}}$	$(0.50,0.25)$	97.19	89.8	57.1	32.7
w/o $\mathcal{L}_{\mathrm{mid}}$	$(0.90,0.25)$	90.78	88.4	54.1	34.3

Appendix

Table 10: Exact GSM8K ablation results. Teacher fluency, teacher accuracy, and student accuracy are reported in percentage points.

\Delta=\mathrm{Acc}_{\mathrm{teacher}}-\mathrm{Acc}_{\mathrm{student}}

; dashes denote unavailable fluency measurements.

Method	Step-correct	Consistent	Complete	Strictly valid	Correct but invalid
CALA	36/50	45/50	47/50	36/50 (72%)	6/42
ADS	31/50	42/50	45/50	31/50 (62%)	9/40

Appendix

Table 11: Blinded manual audit of GSM8K reasoning traces. “Correct but invalid” denotes a correct final answer with a rationale that fails at least one strict-validity criterion.

Method	Configuration	Teacher/student acc.
CALA	$(\tau,\delta)=(0.50,0.25)$	39.8/26.2
CALA	$(\tau,\delta)=(0.75,0.75)$	37.9/27.2
CALA	$(\tau,\delta)=(0.50,0.80)$	36.9/23.3
CALA	$(\tau,\delta)=(0.50,0.85)$	23.3/19.4
ADS	$(\tau,\lambda_{\mathrm{ADS}})=(0.90,1.58{\times}10^{-2})$	36.9/23.1
ADS	$(\tau,\lambda_{\mathrm{ADS}})=(0.90,2.37{\times}10^{-2})$	35.0/27.5

Appendix

Table 12: GPQA results under the MetaMathQA

\rightarrow

MMLU-traces

\rightarrow

GPQA distribution shift.

Figure 7: Utility-distillability operating points under the MetaMathQA

\rightarrow

MMLU-traces

\rightarrow

GPQA distribution shift. Point numbers follow the configuration order in Table 12 ; lower student accuracy at comparable teacher accuracy indicates stronger protection.

Teacher acc.	Gemma-2-2B-IT	Qwen2.5-3B
89.7/89.7	35.5/39.1	78.6/77.7
83.5/84.0	32.5/38.1	73.9/75.1
79.2/78.9	28.6/35.1	71.8/68.2
65.1/64.8	21.5/29.7	67.7/54.3

Appendix

Table 13: Cross-student transfer on GSM8K. Each pair is CALA/ADS accuracy in percentage points. Lower student accuracy is better for the defense.

Figure 8: Proxy-size sensitivity on GSM8K. We compare the default 1.5B training-time proxy with a 3B proxy.

Figure 23

Figure 24

Figure 25

Figure 26

Figure 27

Figure 28

Figure 29

Figure 30

Figure 31

Language Model Distillation

Language model distillation transfers a larger model’s capabilities to smaller or specialized models using outputs, probabilities, or internal representations.

See all 522 papers

Hiding in Plain Sight: Detectability-Aware Antidistillation of Reasoning Models
Apr 25, 2026Max Hartman, Vidhata Jayaraman, Moulik Choraria +1CoT Distillation Teacher-Student Learning
Stony Brook University
TeacherGRPO: Closing the Capacity Gap in Reasoning Distillation via Teacher Alignment
Sep 27, 2026Zhenyu Lei, Zihan Chen, Yaochen Zhu +5Reasoning Distillation RL for Language Model Reasoning
University of Virginia · Netflix · University of Washington +2
Distillation Defenses Easily Break After Reinforcement Learning
Sep 28, 2026Shidan Javaheri, Alexander Panfilov, Oliver Britton +2LLM Security Language Model Distillation
University of Oxford · ELLIS Institute Tübingen & MPI for Intelligent Systems

Apr 25, 2026J/K move · Enter open · S save

Hiding in Plain Sight: Detectability-Aware Antidistillation of Reasoning Models

Max Hartman, Vidhata Jayaraman, Moulik Choraria, Lav R. Varshney

Stony Brook University

CoT Distillation Teacher-Student Learning Knowledge Distillation Reasoning Trace Analysis

Open paper AskPDF arXiv

Distillation via reasoning traces exposes frontier models to adversarial third parties, who can bypass their guardrails and misappropriate their capabilities. Existing antidistillation defenses perturb the teacher's sampling distribution to hinder downstream student learning, but these perturbations also degrade the trace quality even when task accuracy is preserved, often leaving visible artifacts such as syntactic incoherencies and repetition chains. Beyond eroding user trust, such traces are statistically distinguishable, allowing adversaries to filter or resample them and weaken the defense. An effective defense must therefore limit how visibly it degrades the teacher. To address this gap, we formulate antidistillation as a max-min game whose constraint set explicitly encodes defense detectability. Satisfying both axes--- degrading the student while remaining undetectable---may require more clever perturbations, akin to sparse but targeted adversarial attacks in robustness literature. We apply the same analogy to reasoning steps, targeting thought anchors: sentences identified in prior interpretability work as strongly influencing a model's output. We propose Thought Anchor RemovalS (TARS), which identifies and removes thought anchors, whose content is semantically redundant, so that the reasoning trace remains legible to the user. Modeling these removals as burst-deletions, we then provide formal guarantees on its detectability. Finally, we empirically demonstrate the efficacy of TARS in consistently hindering downstream distillation across teacher model scales (DeepSeek R1 Distill Qwen 7B, Gemma 3 12B), reasoning benchmarks (MMLU Pro, MATH, DeepMath), and student architectures (Llama 3.2 1B, Llama 3.2 3B, Gemma 3 1B, Qwen 3 1.7B) while preserving teacher performance.

Abstract

Language Model Distillation

Explore similar work

Hiding in Plain Sight: Detectability-Aware Antidistillation of Reasoning Models

TeacherGRPO: Closing the Capacity Gap in Reasoning Distillation via Teacher Alignment

Distillation Defenses Easily Break After Reinforcement Learning