Knowledge distillation selectively transfers model skills and backdoors
Selective Transfer through Sequence Distillation: From Benchmark Knowledge to Backdoor Behaviour
Artificial Intelligence
Summary
Knowledge distillation is a way to copy what a big AI model knows into a smaller one. The authors found that when copying, useful knowledge from benchmark tests easily passes on to the smaller model. But harmful hidden tricks, called backdoors that make the model refuse certain inputs, mostly do not transfer this way. This means some parts of the teacher model’s behavior survive distillation better than others, depending on how the knowledge is structured.
What this means in practice
- •For ai safety engineers: Detect and reduce harmful backdoors in distilled models by recognizing which distillation methods limit backdoor transfer.
- •For machine learning engineers: Improve distillation workflows by choosing channels that reliably transfer desired benchmark knowledge without inheriting undesirable behaviors.
Authors
Jonibek Mansurov, Sholpan Bolatzhanova, Filbert Aurelian Tjiaranta, Vallerie Alexandara Putra, Alham Fikri Aji
Abstract
Knowledge distillation is widely used to transfer capabilities from teacher models to student models, but recent work shows that it can also transfer unintended teacher properties. We study whether different hidden teacher properties survive the same distillation channels. Specifically, we compare two properties: benchmark-associated knowledge and refusal backdoors, and show that distillation treats them very differently. Teachers fine-tuned on benchmark data successfully pass that knowledge to students through all four distillation channels we test, including when students are trained only on teacher-generated number sequences containing no natural language or domain content whatsoever. Refusal backdoors tell the opposite story: backdoored teachers achieve near-perfect triggered refusal, yet sequence-distilled students inherit essentially none of this behaviour. Logit-based distillation transfers it substantially, reaching up to 85.5\% triggered refusal in students that saw zero backdoor examples. Distillation is therefore selective, and the selection criterion is not what data the student sees, but what structure the teacher's property has. The code is available at https://github.com/MJonibek/kd-leakage.