Defenses Against Stealing Reasoning Must Consider the Reasoning Boundary

Distillation attacks are used to steal the reasoning capabilities of proprietary Large Language Models (LLMs), allowing malicious actors to replicate state-of-the-art model performance at low cost. These attacks steal reasoning by systematically gathering a large volume of frontier model reasoning traces and training LLMs on them using distillation, potentially followed by further training with reinforcement learning (RL). Although training pipelines combining distillation and RL are increasingly common, conflicting results exist comparing the effectiveness of RL and distillation as standalone techniques for improving a model's reasoning capabilities, obscuring the source of the value of frontier model reasoning traces in pipelines for stealing reasoning. This work reconciles this conflict by demonstrating that RL outperforms distillation in improving a model's ability to solve reasoning problems in a single attempt, but that distillation is a more efficient way to expand a model's reasoning boundary, increasing the complexity of the problems it can solve when given multiple attempts. Theoretically, this is explained by distillation being mode-covering while RL is mode-seeking. We conclude by demonstrating that defenses against stealing reasoning must evaluate a distilled model's performance at its reasoning boundary, which indicates its performance ceiling after potential subsequent RL training.