arXiv:2607.20440cs.CLcs.AI2026-07

通过后处理修改推理路径,让大模型防御知识蒸馏攻击而不丢性能。

Answer-then-Edit: Reasoning Skeleton Editing for Anti-Distillation with Preserved Utility

论文配图:Answer-then-Edit: Reasoning Skeleton Editing for Anti-Distillation with Preserved Utility
图 1 · 摘自论文原文
  • 先生成干净推理路径,再通过三阶段编辑增强复杂性。
  • 在不损失准确率的前提下,显著降低学生模型的蒸馏效果。
  • 适合保护闭源大模型知识产权的研究者与开发者。

专有的大语言模型(LLM)投入巨大,是重要知识产权。即便通过黑盒API部署,仍可能被对手低成本提取并复制能力。为应对这一问题,反蒸馏(AD)被提出,生成干扰蒸馏的防御输出,突破依赖事后验证的水印方法局限。但现有基于内部扰动的AD方法难以兼顾反蒸馏能力与推理质量(如答案准确率和自然度),强化防御常导致性能显著下降。为此,本文提出骨架引导推理编辑(SGRE),一种「先回答后编辑」框架,对推理过程进行后处理修改。首先,教师模型生成无污染推理路径,保持原始准确率并灵活控制自然度;随后,借鉴认知负荷理论,设计三阶段策略:提取推理骨架、骨架图粗化、骨架重述。这些操作联合扰动推理结构并提升文本复杂度,增加学生模型的认知负担,阻碍其学习底层推理模式。跨多种大模型的实验表明,SGRE在降低蒸馏有效性方面达到当前最优水平,同时实现零性能损失的推理准确率和更优的路径自然度。

原文摘要 · Abstract (English)

Proprietary large language models (LLMs) entail substantial intellectual and financial investment, making them valuable intellectual property (IP). However, even when deployed via black-box APIs, these models remain vulnerable to unauthorized knowledge distillation, which allows adversaries to cheaply extract and replicate model capabilities. To address this issue, anti-distillation (AD) has been proposed to generate defensive outputs that hinder distillation effectiveness, overcoming the limitation of watermarking-based approaches that rely on post-hoc verification. However, existing AD methods based on internal model perturbations struggle to balance anti-distillability and utility (e.g., answer accuracy and naturalness) of reasoning traces, with stronger defenses often causing significant utility loss. To fill this gap, we propose \textbf{\underline{S}}keleton-\textbf{\underline{G}}uided \textbf{\underline{R}}easoning \textbf{\underline{E}}diting (SGRE), an \textit{Answer-then-Edit} framework that performs post-hoc trace modification for anti-distillation. In the answer stage, the teacher model first generates clean reasoning traces, preserving the original reasoning accuracy while enabling more flexible control over trace naturalness. In the editing stage, we draw inspiration from Cognitive Load Theory (CLT) and introduce a three-stage strategy consisting of reasoning skeleton extraction, skeleton graph coarsening, and skeleton verbalization. These operations jointly perturb reasoning structures and augment textual complexity to amplify extraneous load on student models, hindering their acquisition of underlying reasoning patterns. Extensive experiments across diverse LLMs demonstrate that SGRE achieves state-of-the-art performance in reducing distillation effectiveness, while maintaining lossless reasoning accuracy and superior trace naturalness.

反蒸馏推理编辑大模型安全知识保护

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。