Conflict-Aware Logit Adapters for Utility-Preserving Anti-Distillation
Large language models increasingly expose detailed reasoning traces that help users but also provide rich supervision signals for unauthorized distillation by competitors. This paper proposes Conflict-Aware Logit Adapters (CALA), a lightweight training-time defense that attaches a small residual adapter to a frozen teacher and uses a virtual proxy-student ascent step to identify fragile imitation positions. By encoding anti-distillation perturbations into the model rather than imposing them at decoding time, CALA aims to preserve teacher utility and fluency without the online overhead of prior decoding-time approaches such as Antidistillation Sampling (ADS).
CALA is a well-motivated and largely practical training-time alternative to decoding-time anti-distillation. The paper shows that a frozen teacher with a learned residual adapter can achieve stronger utility-distillability trade-offs than ADS on structured reasoning benchmarks, particularly GSM8K and MATH, while avoiding proxy-model inference overhead. However, the empirical support is uneven across tasks—gains on MMLU are marginal—and statistical robustness is limited because multi-seed replication is provided only for GSM8K. The theoretical analysis of the conflict-aware update (Theorem 1) gives a clean projection interpretation but does not extend to generalization or end-to-end convergence guarantees.
The adapter design successfully amortizes defense into training, cutting per-batch inference time to 31.5 s versus 89.2 s for ADS on an H100. Ablations validate the main components: removing the virtual proxy ascent raises student accuracy from 34.2% to 41.0% at comparable teacher accuracy, and dropping the conflict-aware update raises it to 42.0%. Surface fluency is preserved better than ADS; on GSM8K and MMLU, CALA maintains higher fluency across operating points while ADS shows a sharper fluency drop as defense strength increases. The trade-off curves for GSM8K and MATH also show clear Pareto improvements over both ADS and a temperature-sampling baseline.
First, statistical evidence is thin outside GSM8K: MATH and MMLU results come from single runs, and the authors explicitly concede that not every main-claim experiment carries error bars or significance tests. Second, adaptive robustness is under-explored: the perplexity-filtering attack only discards 20% of traces and is tested only on GSM8K, while paraphrasing and verifier-based attacks remain unevaluated despite being natural adaptive responses.
Third, proxy dependence is a vulnerability: the sensitivity study only varies size within the same tokenizer family, and cross-tokenizer generalization is explicitly deferred. Finally, the comparison to DOGe is relegated to a brief appendix note that their reproduction was checkpoint-sensitive, without a systematic attempt to align settings or use publicly released DOGe checkpoints.
The core claim—that CALA improves the utility-distillability Pareto frontier—is best supported on GSM8K and MATH, where CALA simultaneously dominates ADS and temperature baselines in high-utility regimes. On MMLU the margin vanishes: ADS achieves the lowest student accuracy at its most aggressive point, and CALA only clearly outperforms temperature sampling. The characterization of ADS as introducing surface artifacts is supported by qualitative examples and fluency scores, though the fluency judge is an automatic GPT-4o mini scorer with its own prompt biases. Related work is discussed fairly, and the distinction from watermarking is sharply drawn. However, the comparative evidence against DOGe is too thin to assert that CALA is the preferred training-time method.
Experimental details are extensive: Appendix B lists optimizer settings, hyperparameters ($\rho=10^{-3}$, $\kappa=0.5$, top-$k=50$), LoRA student-distillation configs, and generation prompts. The authors indicate that code and data are provided in the supplemental material. A critical omission, however, is the exact architecture of the residual adapter (e.g., hidden dimensions, layers, activation), without which independent reproduction of the adapter training is impossible. Teacher-generated traces for the 6,800 MetaMathQA training samples are not pre-packaged, so reproducing the pipeline requires access to the frozen teacher and compute to regenerate them. Inference is straightforward because only a scalar $\delta$ controls strength, but the missing adapter specification is a notable blocker.
While reasoning traces improve model capability, they also provide supervision signals for downstream distillation. Initial efforts to mitigate this issue rely on decoding-time interventions, but they incur high inference overhead and can harm the teacher model's natural fluency. We propose Conflict-Aware Logit Adapters (CALA), a lightweight training-time defense. CALA attaches a small residual adapter to a frozen teacher model and trains only the adapter. A proxy student identifies positions where imitation is most sensitive, and the adapter perturbs the output distribution at these positions while remaining within high-probability regions. A conflict-aware optimization strategy balances anti-distillation and utility objectives, while regularization preserves the teacher's performance and fluency. At inference time, CALA incurs modest overhead and requires no auxiliary model. Experiments on reasoning benchmarks show that CALA substantially reduces successful student imitation while maintaining near-original teacher performance and generation quality. These results establish CALA as a practical and efficient alternative to decoding-time approaches.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.