Poster: A Preliminary Study of LLM Distillation Inference

AI security research · arXiv cs.CR (AI security)

Poster: A Preliminary Study of LLM Distillation Inference

REDCORE assessment

The research establishes that it is mathematically feasible to detect if a smaller model was trained using the reasoning traces of a larger, proprietary model. While this provides a forensic method for model providers to identify theft, it does not prevent the theft from occurring. For small teams, this research is primarily useful for understanding how to audit the provenance of third-party models they might integrate.

Impact for lean teams

Small teams using proprietary APIs face the risk of intellectual property theft through distillation attacks. Unless you are developing proprietary foundational models, this risk is currently lower priority than securing your primary data pipelines.

Source summary

Unauthorized model distillation, in which a model is trained on the outputs of a proprietary large language model (LLM), is a growing threat to model providers. We study distillation inference: determining whether a suspect model was distilled from another model or trained independently. We formulate this problem as a hypothesis test and estimate the behavior expected under each hypothesis by training shadow models: distilled shadow models learn from the teacher's reasoning traces, whereas independent shadow models learn only from reference answers. The auditor measures how closely each model predicts the teacher's reasoning outputs and then uses the shadow models to convert the suspect's score into a calibrated p-value. In a preliminary study using Qwen2.5-7B as the teacher and Llama-3.2-3B for the suspects, our test achieves a true positive rate of 1.0 at a significance level of 0.02.

Recommended actions

• Review API usage logs for high-volume, automated query patterns characteristic of scraping.
• Implement rate limiting per API key to hinder the massive data collection required for distillation.
• Monitor user behavior for anomalous request bursts that suggest automated training data synthesis.
• Contractually prohibit the use of your model outputs for training other generative AI models.

This assessment was generated by REDCORE AI from the attributed source above and is provided for situational awareness. Validate against the original research and your own environment before acting.