Redwood Research empirically studies two paths of distillation auditing and capability transfer

Redwood Research published a paper empirically testing two approaches that use knowledge distillation to serve AI safety. Distillation for forensics (DFI) distills an untrusted model into a weaker, trusted student model, hoping to transfer the teacher's inaccuracies without transferring its ability to hide those inaccuracies, thereby indicting the teacher by auditing the student. The researchers tested this on AuditBench's secret-preserving models: these models are fine-tuned from Llama-3.3-70B-Instruct, each with a hidden quirk and trained to refuse to admit it; after distilling back to their instruction-tuned base, students admitted the quirk at a much higher rate than the original model, showing that quirks transfer faster than hidden tendencies. DFI performs poorly in two cases: when the student and teacher do not share the same base model (Llama-8B student admission rate 18%, Llama-70B student 65%), and when the teacher itself has lost introspective awareness of the quirk (KTO-trained models went from 0.3% to 7%). The authors therefore recommend narrowing DFI to distilling the model back to its own pre-RL checkpoint.