保护大模型推理过程不被窃取，同时避免被发现。
Hiding in Plain Sight: Detectability-Aware Antidistillation of Reasoning Models
- 通过稀疏扰动关键推理节点，隐蔽地干扰学生模型学习。
- 仅扰动少数高影响力语句，即可显著降低可被蒸馏的风险。
- 适合需要保护闭源模型能力的开发者与研究者使用。
通过采样推理轨迹进行模型蒸馏，会使闭源前沿模型面临第三方恶意利用的风险，导致其安全机制失效并被窃取能力。反蒸馏方法旨在通过污染推理轨迹来阻碍学生模型学习，同时保持教师模型性能。然而，现有方法忽视了可检测性（语义与语法层面），削弱了教师输出的可信度，并向对手暴露防御存在。本文将反蒸馏建模为一个斯塔克尔伯格博弈，显式约束可检测性，并证明稀疏扰动是比全轨迹污染更有效、更隐蔽的替代方案。基于机械解释性，我们识别出‘思维锚点’——对模型输出具有不成比例反事实影响的句子，作为稀疏扰动的合理目标：对推理至关重要，但极难被检测。我们实现了TraceGuard，一种无需训练、黑盒的原型系统，通过分支词检测定位思维锚点，并对其污染，以削弱学生模型蒸馏效果，同时保持推理轨迹连贯性。
原文摘要 · Abstract (English)
Distillation via sampling reasoning traces exposes closed-source frontier models to adversarial third parties who can bypass their guardrails and misappropriate their capabilities. Antidistillation methods aim to address this by poisoning reasoning traces to hinder student model learning while preserving teacher performance. However, current methods overlook detectability, both semantic and syntactic, which erodes trust in the teacher's outputs and signals the defense's presence to adversaries. We address this gap by formulating antidistillation as a Stackelberg game whose constraint set explicitly encodes detectability, and show that perturbing sparingly offers an effective, less detectable alternative to poisoning the full trace. Drawing on mechanistic interpretability, we identify thought anchors, sentences with disproportionate counterfactual influence on model outputs, as a principled sparse target: critical to reasoning yet minimally detectable. We instantiate this in TraceGuard, a training-free, black-box proof-of-concept that locates thought anchors via branching-token detection and poisons them to degrade student distillation while preserving trace coherence.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。