[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85677-en":3,"doc-seo-85677-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85677,549758252649,"Ivy","https://ap-avatar.wpscdn.com/avatar/8000253669c5317157?_k=1778319167496531819",8,"Research & Report","Reference-Based Distillation Detection in LLMs","Model distillation, which trains a student on outputs from a stronger third-party teacher, improves performance but raises concerns about unfair advantage and policy violations. The paper asks whether distillation can be detected and, if so, which teacher was used. It introduces reference-based membership inference: compare reference-normalized likelihood shifts against multiple candidate teachers, infer proxy prompt templates when pipelines are hidden, and use a distinctive glyph-level signal for o1/o3 models. Hybrid evaluation combines controlled and real-world settings, supported by statistical tests and open-world variants.","arXiv :2607 .09692v1 [ cs .LG] 19 Jun 2026  \nReference-Based Distillation Detection in LLMs  \nRajat Rawat 1 Sizhe Chen 1 Akshay Anand 1 Michael Duan2 Bob Rotsted3 Sewon Min 1  \n1University of California, Berkeley 2University of Southern California 3 OpenAI  \n[rajat_rawat@berkeley.edu](rajat_rawat@berkeley.edu)  \nAbstract  \nModel distillation—training on outputs from stronger third-party models—is widely used to boost performance, but raises concerns about unfair advantages and policy violations. This motivates a fundamental question: can we detect whether a model was distilled from another? We show that, while identifying a teacher model from a student in isolation is highly challenging, it becomes tractable in a referencebased setting: given a model and an earlier-generation checkpoint from the same lineage, we can identify the teacher model used to train the later checkpoint. We introduce a distillation detection method based on reference-based membership inference. By comparing how strongly a student model preferentially aligns withoutputs from different candidate teachers relative to a reference checkpoint, our method identifies the most likely teacher and detects evidence of distillation. To handle unknown distillation pipelines such as hidden prompts, we infer proxy prompt templates directly from model outputs. We additionally identify a distinctive glyph-level signal specific to o1/o3 models. Evaluating distillation detection is challenging because modern model lineages are already heavily entangled. To address this, we develop a hybrid evaluation spanning both controlled distillation experiments and real-world models. Across both settings, our approach recovers the true teacher with near-perfect accuracy in single-teacher distillation scenarios, even when the underlying distillation pipeline is largely unknown. We further introduce statistical tests for both teacher attribution and distillation detection, and extend our framework to open-world settings where no teacher is guaranteed tobe present among the candidates. Applying our method to contemporary models yields new evidence regarding potential distillation relationships involving QwQ, DeepSeek-R1, and GPT-OSS.1  \n1 Introduction  \nLarge language models (LLMs) are increasingly trained via model distillation, where a student is fine-tuned on outputs from a stronger teacher. This approach has become a standard way to transfer capabilities such as reasoning and instruction following [7, 13, 26, 27] . While effective and widely adopted, distillation creates ecosystem-level risks: a competitor can query a proprietary model at scale and train a competing system on its outputs, cheaply acquiring capabilities that would otherwise require new architectures or datasets. This raises concerns about unfair advantage and policy violations. Major providers (e.g., Google, OpenAI, Anthropic) have responded with systemlevel defenses based on request metadata [3, 14, 22], but these require usage logs and infrastructure access and do not address detection from model behavior.  \nThis motivates a fundamental problem in model auditing: given a model, can we determine whether a teacher was used to train it? Answering this is important for intellectual property protection,  \naccountability, and transparency when training details are undisclosed, but is challenging due to both 1 Code is available at [https://github.com/RajatRawat-creator/DistillDetect](https://github.com/RajatRawat-creator/DistillDetect).  \nPreprint.  \n(a) (b)  \n? Candidate teacher T  \nused for distillation?  \nreference checkpoint  \nQwQ-32B  \nstudent checkpoint  \nScore  \nHard. From the final student alone it is difficult to tell whether a given teacher was used.  \nTractable. Compare the referencestudent shift and ask which candidate best explains it.  \n1.0  \n0.8  \n0.6  \n0.4  \n0.2  \n0.0  \nRanked by mean score  \n 1. DeepSeek R1  \n 2. GPT-OSS-120B  \n 3. o1 *  \n 4. o3 *  \n 5. Claude Opus 4.6 *  \n 6. Claude 3.5 Sonnet  \n 7. Claud","cbCaieHiFEnKOWiB","https://ap.wps.com/l/cbCaieHiFEnKOWiB","pdf",1394311,1,27,"English","en",105,"# Abstract\n# Introduction\n## Distillation risks and auditing motivation\n## Reference-based detection setup\n# Method Overview\n## Reference-normalized teacher scoring\n## Proxy prompt inference for hidden pipelines\n## Glyph-level signatures for o1/o3 models\n# Evaluation Strategy\n## Controlled experiments and real-world models\n## Statistical tests and open-world attribution\n# Applications and Findings","[{\"question\":\"What problem does reference-based distillation detection address in LLM auditing?\",\"answer\":\"It determines whether a given language model checkpoint was trained using another teacher model, and identifies the most likely teacher despite opaque or unknown distillation pipelines.\"},{\"question\":\"How does the proposed method score candidate teacher models?\",\"answer\":\"For each candidate teacher, it measures how strongly the student preferentially aligns with the candidate’s outputs relative to an earlier reference checkpoint, using likelihood shifts that remain robust when absolute signals fail.\"},{\"question\":\"What special techniques help when the distillation pipeline is unknown?\",\"answer\":\"It infers proxy prompt templates directly from model outputs for hidden-prompt settings and also leverages a distinctive glyph-level signal specific to o1/o3 models.\"}]",1784205543,68,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"reference-based-distillation-detection-in-llms","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/reference-based-distillation-detection-in-llms/85677/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does reference-based distillation detection address in LLM auditing?","Question",{"text":75,"@type":76},"It determines whether a given language model checkpoint was trained using another teacher model, and identifies the most likely teacher despite opaque or unknown distillation pipelines.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the proposed method score candidate teacher models?",{"text":80,"@type":76},"For each candidate teacher, it measures how strongly the student preferentially aligns with the candidate’s outputs relative to an earlier reference checkpoint, using likelihood shifts that remain robust when absolute signals fail.",{"name":82,"@type":73,"acceptedAnswer":83},"What special techniques help when the distillation pipeline is unknown?",{"text":84,"@type":76},"It infers proxy prompt templates directly from model outputs for hidden-prompt settings and also leverages a distinctive glyph-level signal specific to o1/o3 models.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]