Antidistillation Sampling

Zico Kolter (Carnegie Mellon University) · Avi Schwarzschild (Carnegie Mellon University) · Marc Finzi (Carnegie Mellon University) · Yash Savani (Carnegie Mellon University) · Asher Trockman (Carnegie Mellon University) · Zhili Feng (OpenAI) · Yixuan Xu (Carnegie Mellon University) · Alexander Robey (Carnegie Mellon University)

antidistillation samplingdistillation resistanceeffectiveness limitationfrontier models generative models model distillation model performancenext-token probability distributionpoisoningreasoning traces sampling strategiesstrategic modificationtoken sequencesutility preservationvulnerability recognition

Frontier models that generate extended reasoning traces inadvertently produce token sequences that can facilitate model distillation. Recognizing this vulnerability, model owners may seek sampling strategies that limit the effectiveness of distillation without compromising model performance. *Antidistillation sampling* provides exactly this capability. By strategically modifying a model's next-token probability distribution, antidistillation sampling poisons reasoning traces, rendering them significantly less effective for distillation while preserving the model's utility.