测试大模型知识蒸馏防御效果，发现多数方法对关键能力无效。
DistillGuard: Evaluating Defenses Against LLM Knowledge Distillation
- 构建三类防御分类框架，统一评估输出级防御
- 仅思维链移除显著削弱数学推理（31.4% vs 67.8%）
- 适合关注模型安全与知识保护的研究者参考
从专有大模型API中进行知识蒸馏正构成日益严重的威胁，但相关防御措施分散且缺乏系统评估。本文提出DistillGuard框架，用于系统化评估大模型知识蒸馏的输出级防御。我们提出三种防御类别——输出扰动、数据投毒和信息限流，并在三个基准（MATH-500、HumanEval+、MT-Bench）上，以Qwen3-14B为教师模型、Qwen2.5-7B-Instruct为学生模型，对九种防御配置进行标准化测试。结果显示，在同家族蒸馏场景下面对简单攻击者，大多数输出级防御效果不佳：基于重述的扰动几乎不降低学生模型质量；数据投毒主要损害对话流畅性，而任务特定能力仍保持完好。仅思维链移除显著削弱数学推理能力（31.4% 对比基线67.8%），代码生成能力未受影响。结果表明，防御有效性高度依赖任务类型，当前输出级方法难以广泛防止知识窃取。
原文摘要 · Abstract (English)
Knowledge distillation from proprietary LLM APIs poses a growing threat to model providers, yet defenses against this attack remain fragmented and unevaluated. We present DistillGuard, a framework for systematically evaluating output-level defenses against LLM knowledge distillation. We introduce a taxonomy of three defense categories -- output perturbation, data poisoning, and information throttling -- and evaluate nine defense configurations using a standardized pipeline with Qwen3-14B as teacher and Qwen2.5-7B-Instruct as student across three benchmarks (MATH-500, HumanEval+, MT-Bench). Our results reveal that, in a same-family distillation setting against a naive attacker, most output-level defenses are surprisingly ineffective: paraphrasing-based perturbation barely degrades distilled student quality, and data poisoning primarily impairs conversational fluency while leaving task-specific capabilities intact. Only chain-of-thought removal substantially impairs mathematical reasoning (31.4\% vs.\ 67.8\% baseline), though code generation remains unaffected. These findings demonstrate that the effectiveness of distillation defenses is highly task-dependent and that current output-level approaches are insufficient to broadly prevent knowledge theft.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。