PaperlayerView exact revision on arXiv

Source-linked AI summary

DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation

Pingzhi Li, Zhen Tan, Mohan Zhang, Huaizhi Qu, Huan Liu, Tianlong Chen

arXiv:2505.19504v2cs.LGcs.AIcs.CL

TL;DR

API-accessible LLM outputs can be used to distill proprietary capabilities, while existing defenses may only detect imitation afterward or rely on internal logits. DOGe fine-tunes the teacher’s final layer to preserve useful outputs while misleading distillation; the paper reports degraded student performance alongside preserved or improved teacher performance.

  • Problem

    API-visible outputs enable competitors to imitate proprietary LLM capabilities through KD, while watermarking detects imitation post-hoc and other defenses assume access to internal states or logits.

    Source: §1 · p. 1

  • Method

    DOGe adversarially fine-tunes only the teacher’s final linear layer, combining supervised and adversarial losses to preserve utility while misleading output-based distillation.

    Source: §1 · p. 2, §4.1 · p. 5

  • Results

    DOGe preserves or improves teacher performance while student models distilled from defensive outputs show substantial performance degradation across benchmarks.

    Source: §1 · p. 2, §5.2 · p. 8

  • Takeaways & Limitations

    The paper presents DOGe as an efficient safeguard against unauthorized distillation through publicly accessible outputs.

    Source: §6 · p. 11

    The implementation focuses on proxy students sharing the teacher’s tokenizer, while other tokenizers require more complex vocabulary alignment.

    Source: §4.4 · p. 6

Abstract

from arXiv · show

Large Language Models (LLMs) represent substantial intellectual and economic investments, yet their effectiveness can inadvertently facilitate model imitation via knowledge distillation (KD). In practical scenarios, competitors can distill proprietary LLM capabilities by simply observing publicly accessible outputs, akin to reverse-engineering a complex performance by observation alone. Existing protective methods like watermarking only identify imitation post-hoc, while other defenses assume the student model mimics the teacher's internal logits, rendering them ineffective against distillation purely from observed output text. This paper confronts the challenge of actively protecting LLMs within the realistic constraints of API-based access. We introduce an effective and efficient Defensive Output Generation (DOGe) strategy that subtly modifies the output behavior of an LLM. Its outputs are accurate and useful for legitimate users, yet are designed to be misleading for distillation, significantly undermining imitation attempts. We achieve this by fine-tuning only the final linear layer of the teacher LLM with an adversarial loss. This targeted training approach anticipates and disrupts distillation attempts during inference time. Our experiments show that, while preserving the performance of the teacher model, student models distilled from the defensively generated outputs demonstrate catastrophically reduced performance, demonstrating DOGe as a practical safeguard against KD-based model imitation.

1 Introduction

API-accessible outputs can enable low-cost imitation of proprietary LLMs, while existing defenses either detect imitation after the fact or assume access to internal signals. DOGe modifies the teacher’s final linear layer so outputs remain useful to legitimate users but mislead output-based distillation.

1 Introduction

  • Publicly accessible API outputs let competitors cheaply imitate proprietary model capabilities through knowledge distillation, threatening the incentive to invest in LLM development.The paper compares this to learning an expert’s skills by observing their actions.Source: §1 · p. 1
  • Watermarks and fingerprints support only post-hoc detection, while other defenses rely on internal states or matching teacher logits and therefore miss output-only distillation.The gap motivates defenses that work with standard API outputs without compromising user experience or requiring non-standard access.Source: §1 · pp. 1–2
  • DOGe adversarially fine-tunes only the teacher’s final linear layer to make outputs misleading for distillation while preserving accuracy and coherence for legitimate users.The layer adjusts next-token probabilities at output generation.Source: §1 · p. 2
  • DOGe targets output-based distillation directly, requires only lightweight final-layer fine-tuning, and avoids costly full-model retraining.The paper also states that subtle probability shifts make the defense challenging to reverse-engineer.Source: §1 · p. 2
  • The paper formalizes DOGe as a dual-objective defense and reports that it degrades distilled students while preserving or improving teacher utility.It also states that it provides theoretical insights into why final-layer output modifications disrupt distillation.Source: §1 · p. 2

2 Related Work

Related work spans knowledge distillation, model IP protection, adversarial learning, and controllable text generation. DOGe focuses on proactively hindering output-based distillation without adding inference-time sampling overhead.

Knowledge Distillation

  • Knowledge distillation transfers teacher knowledge through logits, intermediate features, or generated outputs; DOGe focuses on output-based KD, where API users have only input-output pairs.The paper also says the method can be applied to logits-based KD.Source: §2 · p. 3

Model IP Protection

  • Watermarking embeds identifiable patterns in outputs or parameters for detection, but cannot directly prevent copying knowledge from outputs.Fingerprinting instead aims to identify models uniquely.Source: §2 · p. 3
  • Extraction defenses often assume white-box access or target specific query types, whereas DOGe seeks proactive prevention through output manipulation against general KD.Source: §2 · p. 3

Adversarial Machine Learning

  • Unlike adversarial input attacks that fool a fixed model, DOGe modifies teacher training so its outputs mislead student learning during distillation.Prior KD attacks generally target degradation of a specific student rather than making a teacher inherently hard to distill.Source: §2 · p. 3

Controllable Text Generation and Stylometry

  • Controllable generation methods targeting output complexity, ambiguity, or style are relevant to anti-distillation, but one such method adds sampling overhead that DOGe avoids.The paper also says DOGe can be adopted before open-source model release.Source: §2 · p. 3

3 Problem Formulation

The formulation treats anti-distillation as a defender’s effort to preserve teacher utility while reducing the performance of students trained on the teacher’s outputs. The defender controls the teacher’s LM head, anticipating the student’s distillation process.

3.1 Sequence-Level Knowledge Distillation (KD) for LLMs

  • Sequence-level KD forms a dataset from inputs and teacher-generated output sequences, then trains a student to maximize the likelihood of those sequences.The student’s goal is to transfer teacher capabilities through the output targets.Source: §3.1 · p. 3

3.2 The Goal of Anti-Distillation for LLMs

  • Anti-distillation seeks a modified teacher that preserves performance on intended tasks while making students distilled from its outputs perform worse.The formulation constrains the attacker to teacher outputs only.Source: §3.2 · p. 4
  • Teacher preservation is expressed as performance no lower than the baseline teacher minus a small tolerance, ϵ.Source: §3.2 · p. 4
  • Student degradation compares the same student architecture distilled from the modified teacher against one distilled from the original teacher.The desired performance is significantly lower for the student trained on modified-teacher outputs.Source: §3.2 · p. 4

3.3 Formalizing Anti-Distillation as A Dual-objective Optimization Problem

  • The defender controls the teacher’s LM head parameters θfinal to maximize teacher performance while anticipating and minimizing the performance of a subsequently distilled student.Source: §3.3 · p. 4
  • The optimally distilled student’s performance depends on θfinal because those parameters determine the teacher-generated distillation dataset.The defender’s objective is expressed as a nested optimization over the teacher and student.Source: §3.3 · p. 4
  • The direct nested optimization is intractable, so the paper presents a practical approximate solution in Section 4.Source: §3.3 · p. 4

4 Defensive Output Generation (DOGe)

DOGe approximates the anti-distillation objective by fine-tuning the teacher’s LM head with an adversarial objective while retaining task utility. Reasoning-aware masking applies the adversarial pressure to intermediate reasoning, and the training updates only the final layer.

4 Defensive Output Generation (DOGe)

  • DOGe modifies teacher output generation to mislead distillation while preserving user utility, using an adversarial objective to fine-tune only the final linear layer.Figure 2 depicts the KD process, DOGe training, and a defensive teacher producing correct answers with harder-to-follow reasoning.Source: §4 · p. 4, Figure 2 · p. 4

4.1 The Training Objective

  • The combined loss is Ltotal = LSFT + λ · Ladv, where supervised fine-tuning preserves teacher performance and the adversarial loss degrades student distillation.λ controls the trade-off between the losses.Source: §4.1 · p. 5
  • DOGe maximizes divergence between teacher and proxy-student output distributions through a negative average KL-divergence loss.The objective is intended to push teacher outputs away from what typical students predict and hinder distillation.Source: §4.1 · p. 5
  • Maximizing forward KL can be unstable when Q(x)=0 where P(x)>0, while softmax probabilities, the LSFT regularizer, and λ mitigate the risk.Source: §4.1 · p. 5
  • Reasoning-aware masking applies adversarial pressure to intermediate thinking tokens, while the supervised loss covers all tokens so the final answer remains correct.For models without explicit reasoning tokens, regular expressions can identify final-answer tokens.Source: §4.1 · p. 5
  • The proxy-student strategy assumes proxies represent a broader class of students; under that assumption, Proposition 4.1 expects lower downstream performance after distillation.The proposed mechanism disrupts generalizable reasoning patterns despite correct final answers.Source: §4.1 · p. 6

4.2 Efficient Training and Deployment: LM Head Tuning

  • Updating only θfinal keeps the base LLM frozen, reduces training cost, and allows deployment of small modified LM-head weights with minimal overhead.Operators can switch between standard and defensive modes using the stored head weights.Source: §4.2 · p. 6

4.3 Overall Defensive Training Procedure

  • Training iteratively processes batches through the frozen base model, computes losses using a reasoning-aware mask, and updates θfinal.The passage states the resulting defensive head works regardless of decoding strategy, including greedy and top-k sampling.Source: §4.3 · p. 6

5 Empirical Evaluation

The evaluation tests DOGe across teacher and student models, datasets, adversarial-loss settings, proxy-model counts, and training data. Defensive teachers generally retain utility while students distilled from their outputs degrade, with the ablations and case study describing trade-offs and output behavior.

5.1 Experimental Setup

  • For defensive training, experiments use either GSM8K for mathematical reasoning or Tulu for general language; evaluation measures zero-shot accuracy on held-in GSM8K and held-out MATH, ARC-Challenge, and CSQA.Teachers are DeepSeek-R1-7B and Qwen3-8B; proxy models differ from target students.Source: §5.1 · pp. 6–7

5.2 Main Results

  • Defensive teachers preserve or improve utility: DeepSeek-R1-7B gains +1.5% on GSM8K and +0.8% on MATH, with −2.4% on ARC and −0.1% on CSQA.Qwen3-8B gains +2.1% on GSM8K and +1.3% on MATH.Source: Figure 3 · p. 7, §5.2 · p. 8
  • Student performance falls sharply after distillation from defensive teachers, including Gemma-3-1b-it drops of −22.7% on GSM8K, −20.4% on MATH, −31.7% on ARC, and −39.0% on CSQA.The reported CSQA degradation is approximately 5× worse than the original student model’s performance.Source: Figure 3 · p. 7, §5.2 · p. 8

5.3 Ablation and Extended Studies

  • With λ = 3 × 10−5, DOGe balances strong teacher performance and substantial student degradation; λ = 10−4 collapses both performances toward zero.At λ = 1 × 10−5, teacher performance stays nearly unchanged but distillation protection is modest.Source: §5.3 · pp. 8–9, Figure 4 · p. 8
  • Two proxy models improve defense by less than 1% across benchmarks over one proxy, but require more training overhead.Tulu yields stronger student degradation, while GSM8K better preserves teacher performance on in-domain math tasks.Source: §5.3 · p. 9, Figure 5 · p. 9

5.4 Case Study

  • A GSM8K-trained defensive teacher typically retains coherent reasoning while adding uncertainty words and redundant verification steps that challenge distillation.A rare case corrupts intermediate reasoning, yet the model still reaches the correct final answer.Source: §5.4 · p. 10, Figure 9 · p. 11

6 Conclusion

DOGe protects LLMs from distillation through publicly accessible outputs by fine-tuning only the LM head with an adversarial objective and reasoning-aware masking. The method degrades distilled students while preserving teacher utility, offering an efficient training and deployment strategy.

6 Conclusion

  • DOGe fine-tunes only the LM head with a carefully designed adversarial objective and reasoning-aware masking to defend publicly accessible outputs.The paper presents this as a practical approach to protecting LLMs from unauthorized knowledge distillation.Source: §6 · p. 11
  • The method degrades distilled student performance while preserving the teacher model’s utility.The conclusion characterizes DOGe as an efficient training and deployment strategy for API-based scenarios.Source: §6 · p. 11

A Implementation Detail

The appendix specifies the experimental setup and gives a local justification for DOGe’s effect on distillation. Its analysis connects differences in teacher and student token distributions to discrepancies in the student’s learning gradients.

A Implementation Detail

  • Experiments use NVIDIA A100, A6000, and B200 servers, with hyperparameters listed in Table 1.The table caption identifies its contents as the hyperparameters used in all experiments.Source: A Implementation Detail · p. 17, Table 1 · p. 17

B Justification for Proposition 4.1

  • The justification analyzes one gradient step, using a smoothed, bounded KL divergence and reasoning-aware masking to explain how DOGe impedes student progress.DOGe maximizes masked divergence over intermediate thinking tokens while preserving task likelihood via LSFT.Source: B Justification for Proposition 4.1 · p. 17

B.1 Student Objective and Gradient Mismatch under Distribution Shift

  • Under bounded-Jacobian and smoothness assumptions, the student’s gradient discrepancy is bounded in terms of the token distributions’ KL divergence.The analysis models sequence-level distillation with token-level negative log-likelihood on a reference distribution.Source: §B.1 · pp. 17–18

B.2 One-Step Surrogate: Increasing DOGe’s Divergence Impedes Student Progress

The appendix formalizes how increasing DOGe’s divergence from a proxy student can impede the student’s expected progress on its distillation objective. It connects that mechanism to masked intermediate tokens and notes that the justification is local rather than a claim of global optimality.

B.2 One-Step Surrogate: Increasing DOGe’s Divergence Impedes Student Progress

  • A sufficiently large average divergence between the DOGe teacher and proxy-averaged student makes the student’s expected progress on its proxy-aligned objective non-negative.For small step sizes, the required divergence threshold is proportional to the norm of the ideal gradient.Source: §B.2 · p. 18

B.3 Connecting DOGe’s Objective to Masking

  • DOGe maximizes proxy-averaged divergence on masked intermediate positions, while LSFT keeps answer-region probabilities aligned with ground truth.By convexity of KL, maximizing the proxy-averaged term also increases the analysis divergence on the masked positions.Source: §B.3 · p. 18

B.4 Concluding the Justification for Proposition 4.1

  • The argument links divergence above the threshold to impeded or reversed one-step progress and, aggregated over training, lower student task performance than with a standard SFT teacher.This chain assumes the proxy-averaged distribution is a good target for distillation.Source: §B.4 · p. 19
  • The justification is local, assumes bounded gradients and smoothness, and does not establish global optimality; practical stability and effectiveness depend on the trade-off parameters.The paper reports empirical ablations of α, ϵ, and λ.Source: §B.4 · p. 19

C Results of Using Tulu for Defensive Training

Tulu-based defensive training maintains or improves teacher performance while substantially degrading distilled students across benchmarks. The student degradation is less pronounced than with GSM8K training, while teacher gains are stronger.

C Results of Using Tulu for Defensive Training

  • −6.4% to −21.3%: student performance degradation across benchmarks with Tulu-based defensive training.The degradation is substantial, though slightly less pronounced than with GSM8K training.Source: C Results of Using Tulu for Defensive… · p. 19
  • Tulu-based defensive teachers improve over their original counterparts across all benchmarks, with stronger teacher-performance gains than GSM8K-based training.The experiments use Tulu’s diverse general-purpose instruction-tuning data in place of math-specific GSM8K data.Source: C Results of Using Tulu for Defensive… · p. 19

D.1 Results

The results report that defensive training with Tulu improves teacher performance over GSM8K-based defensive training, while the resulting students show slightly less degradation. Most defensive-teacher thought processes were judged unperceptible, and the appendix specifies the judge prompt and LM-head training procedure.

D.1 Results

  • Most defensive-teacher outputs were judged unperceptible by Gemini-1.5-Pro, supporting DOGe’s reported combination of student disruption and teacher performance preservation.The accompanying table reports unnatural-sample ratios; 30 randomly selected samples per dataset were tested, with manual checks for naturalness.Source: §D.1 · p. 19, Table 2 · p. 20

D.2 Prompt of Judge

  • The judge prompt asks whether a thought process sounds natural, flagging excessive verbosity, redundant self-correction, robotic tone, and extreme micro-step detail.The judge must respond only “natural” or “unnatural.”Source: §D.2 · pp. 19–20

D.1 Results

  • Tulu-based defensive training further improves teacher performance, while misled students experience slightly less performance degradation than with GSM8K-based defensive training.Figure 10 compares Qwen2.5-3B and Qwen3-4B teachers with a Llama-3.2-1B student.Source: Figure 10 · p. 20

E Pseudo Code for DOGe

  • The training algorithm freezes the teacher base and trains its LM head using teacher hidden states, a supervised cross-entropy term, and a masked adversarial component.It updates the LM-head parameters over epochs and returns the defensively trained head.Source: E Pseudo Code for DOGe · p. 21

F Limitation

DOGe adds defensive-training costs and requires careful selection of its trade-off parameter. Its broader-impact discussion notes that aggressive defenses may impede knowledge sharing and collaboration.

F Limitation

  • DOGe requires additional defensive training, increasing computational overhead and extending the deployment pipeline.The trade-off parameter λ also requires extensive hyperparameter search and may require multiple training runs for a use case.Source: F Limitation · p. 21

G Broader Impact

  • The paper presents DOGe as a way to better protect investments in LLM development, potentially encouraging continued innovation and research..Source: G Broader Impact · p. 21
  • Overly aggressive defenses could limit beneficial knowledge sharing and collaborative research, creating a trade-off between commercial protection and open scientific progress.Source: G Broader Impact · p. 21

H Ethics Statement

The ethics statement frames DOGe for authorized control of downstream training while warning of risks to research, transparency, and safety. It recommends disclosure and mitigations, and reports no human-subject research; the stated LLM use was limited to language polishing.

H Ethics Statement

  • The intended uses are IP protection, abuse resistance, and stewardship where model owners are authorized to control downstream training on outputs.Source: H Ethics Statement · p. 21
  • DOGe could hinder reproducibility, interoperability, competition, or transparency, so the authors discourage its use on community models or research artifacts meant for free distillation.They recommend a non-defensive checkpoint for bona fide research and compliance with applicable laws.Source: H Ethics Statement · p. 22
  • Because DOGe may reduce the apparent interpretability of reasoning traces, the authors recommend disclosing altered traces, warning against their use as training data, and providing a way to disable the defensive head.The proposed switch or header flag is for settings such as education or auditing.Source: H Ethics Statement · p. 22
  • Altered token distributions could unintentionally change safety or fairness properties, so the authors recommend evaluating these metrics and re-validating safety baselines before deployment.If degradation is detected, they recommend tightening the reasoning mask, reducing λ, or vetoing deployment.Source: H Ethics Statement · p. 22

I The Use of Large Language Models (LLMs)

Loading 2505.19504v2…