Study reveals that distillation can selectively transfer teacher model backdoor behaviors
Start here
In October 2026, an arXiv paper studied differences in how knowledge distillation transfers hidden attributes of the teacher model. The authors found that benchmark knowledge can be transferred through all four distillation channels tested; in contrast, a refusal backdoor implanted in the teacher model is almost not transferred under sequence distillation—a student trained only on digit sequences generated by a teacher with near-perfect triggered refusal largely does not inherit the behavior. Logit-based distillation, however, transfers the behavior significantly: students that saw no backdoor samples had a triggered refusal rate of 85.5%. The authors accordingly argue that what determines whether transfer occurs is not the data the student sees, but the structure of the teacher attribute itself. The code has been released.
Generated by AI from reports · Updated 24 days ago
Attention and developments
Attention, hourly
Now 36, 0% in 24 hours·Peak 36 (Nov 6 02:00)
Related research
This event's paper
- Selective Transfer through Sequence Distillation: From Benchmark Knowledge to Backdoor Behaviour
arXiv · 2026-10-19 · Deep reading
Progress timeline
- arXiv: Adversarial Attacks, Backdoors & PoisoningSelective transfer of sequence distillation: from benchmark knowledge to backdoor behavior
The paper finds that knowledge distillation is selective with respect to different hidden attributes of the teacher model: benchmark knowledge can be transferred through all four distillation channels tested, whereas the refusal backdoor is almost not transferred under sequence distillation. The teacher model implanted with the backdoor triggers refusals almost perfectly, but students trained only on digit sequences generated by the teacher largely do not inherit this behavior; logit-based distillation, by contrast, transfers this behavior significantly, with students that have seen no backdoor samples reaching a refusal trigger rate of 85.5%. The authors accordingly argue that the criterion determining whether transfer occurs is not the data the student sees, but the structure of the teacher attribute itself. The code has been released.