Search papers, labs, and topics across Lattice.
This paper investigates the trade-off between model utility and vulnerability to distillation attacks through a minimax game framework involving a utility-constrained teacher and an adaptive student. The authors introduce a novel defense mechanism, Product-of-Experts (PoE), which effectively combines teacher outputs with a proxy student during generation, demonstrating that adaptive evaluation reveals a significant gap in recovery capabilities compared to passive evaluation. Empirical results show that while strong distillation attacks are challenging to mitigate, the PoE defense offers a cost-effective solution that maintains high-quality reasoning while narrowing the robustness gap against adaptive students.
Adaptive evaluation exposes a substantial vulnerability gap, revealing that existing defenses may underestimate the capabilities of distillation attacks.
Distillation attacks create a deployment trade-off for model providers: the same outputs that make a model more useful can also make it easier to imitate. We study this trade-off through a minimax game between a utility-constrained teacher and an adaptive student. Our framework yields tractable one-sided response rules: an adaptive evaluation rule in which the student reweights high-value examples, and a teacher-side defense template that suppresses outputs most useful for distillation. From a cheap proxy for example value, we derive Product-of-Experts (PoE), a simple forward-pass-only defense that combines the teacher with a proxy student during generation. Empirically, adaptive evaluation reveals a large passive--adaptive gap: on state-of-the-art defenses, adaptive students recover substantially more capability than passive evaluation suggests on GSM8K and MATH. Under this stronger evaluation, the apparent robustness gap between expensive defenses and PoE narrows considerably, while PoE remains substantially cheaper and preserves higher-quality reasoning traces. Overall, our results suggest that strong distillation remains difficult to stop, and that progress on antidistillation should be judged against adaptive students rather than passive ones. Our code is available at: https://github.com/ysfalh/distillation-game.
BAIR
NUS
Stanford HAI