aiqbench analysis
The paper finds that knowledge distillation is selective about which hidden teacher traits it transfers. Benchmark knowledge passes through even number-only sequence distillation, while refusal backdoors mostly don't, but logit-based distillation carries them over (up to 85.5% triggered refusal). For readers building or auditing distilled models, the practical lesson is that filtering the student's training data is not enough to rule out inherited unwanted behaviour, since the teacher's output format and the distillation channel matter.
Selective Transfer through Sequence Distillation: From Benchmark Knowledge to Backdoor Behaviour
arXiv:2610.26311v1 Announce Type: new Abstract: Knowledge distillation is widely used to transfer capabilities from teacher models to student models, but recent work shows that it can also transfer unintended teacher properties. We study whether different hidden teacher properties survive the same distillation channels. Specifically, we compare two properties: benchmark-associated knowledge and refusal backdoors, and show that distillation treats them very differently. Teachers fine-tuned on benchmark data successfully pass that knowledge to students through all four distillation channels we test, including when students are trained only on teacher-generated number sequences containing no natural language or domain content whatsoever. Refusal backdoors tell the opposite story: backdoored teachers achieve near-perfect triggered refusal, yet sequence-distilled students inherit essentially none of this behaviour. Logit-based distillation transfers it substantially, reaching up to 85.5\% triggered refusal in students that saw zero backdoor examples. Distillation is therefore selective, and the selection criterion is not what data the student sees, but what structure the teacher's property has. The code is available at https://github.com/MJonibek/kd-leakage.
Abstract:Knowledge distillation is widely used to transfer capabilities from teacher models to student models, but recent work shows that it can also transfer unintended teacher properties. We study whether different hidden teacher properties survive the same distillation channels. Specifically, we compare two properties: benchmark-associated knowledge and refusal backdoors, and show that distillation treats them very differently. Teachers fine-tuned on benchmark data successfully pass that knowledge to students through all four distillation channels we test, including when students are trained only on teacher-generated number sequences containing no natural language or domain content whatsoever. Refusal backdoors tell the opposite story: backdoored teachers achieve near-perfect triggered refusal, yet sequence-distilled students inherit essentially none of this behaviour. Logit-based distillation transfers it substantially, reaching up to 85.5\% triggered refusal in students that saw zero backdoor examples. Distillation is therefore selective, and the selection criterion is not what data the student sees, but what structure the teacher's property has. The code is available at this https URL.
Artificial Intelligence (cs.AI)
arXiv:2610.26311 [cs.AI]
(or arXiv:2610.26311v1 [cs.AI] for this version)
https://doi.org/10.48550/arXiv.2610.26311 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 253 words
Related coverage
Learning What to Distill: Bilevel Top-K Token Selection for Self-Distillation in Large Language Models
arXiv · Oct 7, 2026
Which Skill to Distill? SGUID: Selecting a Compact Skill Bank for Model-Skill Co-Evolution
arXiv · Oct 9, 2026
Online Label-Free Gradient Matching for Continual Language Model Training
arXiv · Nov 4, 2026
RELAY: Selective Self-Distillation with Adaptive Hand-off for Rubric-Based Reinforcement Learning
arXiv · Oct 14, 2026