Antidistillation Fingerprinting

Model distillation enables efficient emulation of frontier large language models (LLMs), creating a need for robust mechanisms to detect when a third-party student model has trained on a teacher model's outputs. However, existing fingerprinting techniques that could be used to detect such distillation rely on heuristic perturbations that impose a steep trade-off between generation quality and fingerprinting strength, often requiring significant degradation of utility to ensure the fingerprint is effectively internalized by the student. We introduce antidistillation fingerprinting (ADFP), a principled approach that aligns the fingerprinting objective with the student's learning dynamics. Building upon the gradient-based framework of antidistillation sampling, ADFP utilizes a proxy model to identify and sample tokens that directly maximize the expected detectability of the fingerprint in the student after fine-tuning, rather than relying on the incidental absorption of the un-targeted biases of a more naive watermark. Experiments on GSM8K, OASST1, and MBPP demonstrate that ADFP achieves a significant Pareto improvement over state-of-the-art baselines, yielding stronger detection confidence with minimal impact on utility across mathematical reasoning, dialogue, and code generation, even when the student model's architecture is unknown.

Distillation is the process of training one language model on data generated by another. It enables efficient emulation of large language models, but verifying whether distillation happened given a pair of models remains a difficult scientific problem. One promising idea is to place a hidden fingerprint in a teacher model's outputs and later test whether that fingerprint appears in a student model. The challenge is that existing fingerprints often make the teacher's outputs noticeably worse, which limits their usefulness. We propose antidistillation fingerprinting, a method that chooses subtle changes a student model is especially likely to learn while preserving the quality of the teacher's responses. To do this, we use a stand-in model to predict which output changes will leave the clearest trace after distillation. Across math, dialogue, and code-generation tasks, our method provides stronger evidence of distillation than prior approaches at similar or better output quality. This helps make model provenance easier to study and verify as distillation becomes more common.