Source-linked AI summary
Poster: A Preliminary Study of LLM Distillation Inference
Edward Chen, Yuntao Du
TL;DR
Unauthorized distillation raises the question of whether a suspect model was trained from a specific proprietary teacher, while existing methods lack a calibrated decision for a teacher–suspect pair. The paper uses shadow models to calibrate a hypothesis test based on teacher-output prediction. In a preliminary study, it detects every distilled suspect at a significance level of 0.02 without flagging an independent model.
Problem
Existing distillation-inference methods score behavioral similarity but do not provide a p-value or bounded false-positive rate for a specific teacher–suspect pair.
Source: §1 · p. 1Method
Results
At significance level α=0.02, the test detects every distilled suspect and never flags an independently trained model.
Source: §1 · p. 1Takeaways & Limitations
The preliminary study demonstrates the feasibility of using distillation inference to detect distillation attacks.
Source: §5 · p. 3The audit assumes the audit set is drawn from the suspect’s training data and requires teacher-query access plus grey-box or black-box suspect access.
Source: §2 · p. 1
Abstract
from arXiv · showhide
Unauthorized model distillation, in which a model is trained on the outputs of a proprietary large language model (LLM), is a growing threat to model providers. We study distillation inference: determining whether a suspect model was distilled from another model or trained independently. We formulate this problem as a hypothesis test and estimate the behavior expected under each hypothesis by training shadow models: distilled shadow models learn from the teacher's reasoning traces, whereas independent shadow models learn only from reference answers. The auditor measures how closely each model predicts the teacher's reasoning outputs and then uses the shadow models to convert the suspect's score into a calibrated p-value. In a preliminary study using Qwen2.5-7B as the teacher and Llama-3.2-3B for the suspects, our test achieves a true positive rate of 1.0 at a significance level of 0.02. These results demonstrate the feasibility of using distillation inference to detect distillation attacks.
1 Introduction
The paper addresses the need to determine whether a suspect model was distilled from a specific teacher, when existing similarity scores cannot provide a calibrated decision for that pair. It proposes a shadow-model-calibrated hypothesis test and reports perfect detection in its preliminary evaluation.
1 Introduction
- Existing similarity-based methods cannot provide a p-value or bounded false-positive rate for a specific teacher–suspect pair.The paper identifies this statistical guarantee as necessary for enforcement.Source: §1 · p. 1
- Distillation inference tests whether a suspect behaves more like a model distilled from the teacher or one trained independently, using shadow models for both hypotheses.Distilled shadows learn the teacher’s chain-of-thought; independent shadows learn reference answers, and the test aggregates teacher-output prediction signals into a calibrated p-value.Source: §1 · p. 1
- At significance level α=0.02, the test detects every distilled suspect and never flags an independently trained model.The evaluation uses Qwen2.5-7B-Instruct as teacher and Llama-3.2-3B as the suspect base model.Source: §1 · p. 1
2 Problem Setup
The setup treats distillation inference as determining the provenance of a published suspect model using an audit set and access to the teacher and suspect. The described protocol returns a decision and calibrated p-value.
2 Problem Setup
- The suspect is a published model whose provenance is either distillation from the known teacher or independent training without access to it.The auditor uses an audit set of questions and answers and queries the teacher to obtain its chain-of-thought outputs.Source: §2 · p. 1
- The protocol has the teacher’s owner submit the audit set, after which the auditor evaluates the suspect using that set and teacher access, returning a distillation decision and calibrated p-value.The suspect owner may have distilled on the training data or trained independently.Source: §2 · p. 1
- The audit setting uses teacher-owner query logs as its audit set, so the set is assumed to be a subset of the suspect’s training data.The auditor has teacher-query access and either suspect next-token probabilities (grey-box) or generated text (black-box).Source: §2 · p. 1
3 Methods
The method trains distilled and independent shadow models, scores how they predict the teacher’s reasoning outputs, and calibrates an aggregated likelihood-ratio test against the shadow populations.
3 Methods
- The three-stage test trains shadow models, scores teacher-chain-of-thought prediction, then aggregates signals into a shadow-calibrated likelihood-ratio test.It returns a p-value and verdict at a controlled false-positive rate.Source: §3 · p. 2
- Distilled shadows learn the teacher’s chain-of-thought while independent shadows learn reference answers, with paired models differing only in their supervision targets.Both shadow classes share a base model, audit set, and training procedure; each is trained on a randomly sampled half of the audit set.Source: §3 · p. 2
- The method extracts log-probability and predictive-entropy signals with grey-box access, and token agreement with black-box access, to assess teacher-output prediction.Token agreement measures whether the model would emit the teacher’s tokens when decoding on its own.Source: §3 · p. 2
- AUC 0.67 for per-instance log-probability contrasts with fully separated distilled and independent populations after aggregation into one per-model statistic Λ.The figure contrasts the overlapping per-instance signal with the separated model-level populations.Source: Figure 1 · p. 2
- Per-instance likelihood ratios compare a model’s signal under distilled and independent shadow distributions; summing them yields Λ, whose shadow-calibrated distribution supports the audit decision.Leave-one-out scoring estimates the shadow distributions without evaluating a shadow against a distribution it helped define; the p-value ranks the suspect against independent-shadow scores.Source: §3 · p. 2
4 Preliminary Evaluation
The preliminary evaluation compares per-instance membership inference with model-level aggregation, then examines shadow calibration, model architecture, and paraphrase-based evasion. Aggregation separates the model populations, while paraphrase-matched shadows restore a clean audit after paraphrased supervision.
Experimental Setup
- The evaluation used Qwen2.5-7B-Instruct as teacher, Llama-3.2-3B as base model, 500 audit instances, and 50 shadows per class.Suspects were trained separately from shadows using teacher CoT or reference answers.Source: §4 · pp. 2–3
Results
- Aggregating across audit instances raised every metric to 1.000, with TPR 1.0 and no independent suspects flagged.The distilled and independent populations did not overlap.Source: Table 1 · p. 3, §4 · p. 3
Baselines and Evaluation
- Per-instance signals had AUC 0.64–0.67, TPR ≤0.003 at 0% FPR, and TPR below 0.10 at 5% FPR; at M=50, calibrated p-floor and leave-one-out FPR were 0.020.The p-value floor is 1/(M+1), and the leave-one-out FPR is approximately 1/M.Source: §4 · p. 3, Table 2 · p. 3
Impact of Model Architecture
- A same-family Qwen→Qwen pair produced larger separation between the distilled and independent distributions than the cross-family main experiment.The passage says the same-family result rules out model-formatting differences as confounds.Source: §4 · p. 3
Mitigation
- Paraphrasing teacher CoT lowered the inference statistic, but all suspects remained flagged at α=0.05; paraphrase-matched shadows restored a clean audit.The paraphrase ablation used M=20 shadows, giving a p-value floor of approximately 0.05.Source: §4 · p. 3
5 Conclusion and Limitations
The conclusion presents shadow-calibrated hypothesis testing as the paper’s approach to distillation inference and reports perfect detection without false positives in its preliminary study. It also identifies computational cost and training-data and procedure assumptions as limitations.
Conclusion
Limitations
- The approach requires potentially costly shadow-model fine-tuning and assumes audit-set overlap with suspect training data and matching training procedures.The authors identify relaxing the latter two assumptions as future work.Source: §5 · p. 3