---
title: "DOGe — paper by Li et al. (2025) — summary and ideas"
description: "Proprietary LLMs can be cheaply copied when competitors fine-tune smaller models on text collected… 71 references, cited by 6 papers here."
authors: ["Pingzhi Li", "Zhen Tan", "Mohan Zhang", "Huaizhi Qu", "Huan Liu", "Tianlong Chen"]
year: 2025
venue: "arXiv:2505.19504"
source: "https://arxiv.org/abs/2505.19504"
doi: "10.48550/arxiv.2505.19504"
arxiv: "2505.19504"
licence: "CC BY 4.0 (arXiv)"
licence_url: "http://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/li-2025-doge-defensive-output-generation-llm/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/li-2025-doge-defensive-output-generation-llm/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2025](https://md.research.elamur.ai/free/en/papers/2025/page/13/) / DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation

# DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation

**Authors:** Pingzhi Li, [Zhen Tan](https://md.research.elamur.ai/free/en/authors/zhen-tan/), Mohan Zhang, Huaizhi Qu, [Huan Liu](https://md.research.elamur.ai/free/en/authors/huan-liu/) and [Tianlong Chen](https://md.research.elamur.ai/free/en/authors/tianlong-chen/) · **Year:** 2025 · **Venue:** arXiv:2505.19504 · **Licence:** [CC BY 4.0 (arXiv)](http://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://arxiv.org/abs/2505.19504) · [PDF](https://arxiv.org/pdf/2505.19504) · [DOI 10.48550/arxiv.2505.19504](https://doi.org/10.48550/arxiv.2505.19504) · [arXiv 2505.19504](https://arxiv.org/abs/2505.19504) · [OpenAlex](https://openalex.org/W6948377803)

**Citations:** 0 citations (OpenAlex, 2026-10-14) · [6](https://md.research.elamur.ai/free/en/papers/li-2025-doge-defensive-output-generation-llm/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Proprietary LLMs can be cheaply copied when competitors fine-tune smaller models on text collected from public APIs. Watermarks and fingerprints only reveal such copying afterwards. Earlier active defenses assume the attacker matches the teacher's logits, which does not hold when only generated text is available. DOGe (Defensive Output Generation) is a preventive defense against this output-only form of knowledge distillation. The authors frame the problem as balancing two goals: the teacher must stay useful while students trained on its outputs should learn poorly. To do this, they adversarially fine-tune only the LM head (the final linear layer). The objective pushes the teacher's outputs away from what proxy students would learn, and it uses reasoning-aware masking. The defended teacher keeps correct final answers, but its reasoning traces become harder to imitate, for example through hedging, redundant re-checks, or occasionally garbled steps. Teacher accuracy stays the same or rises slightly, while distilled students lose substantial accuracy. Because the method needs no full retraining and adds no inference cost, it suits API providers and also developers releasing open-weight models.

## Key points
- Main setup: Qwen3-8B serves as the teacher and Llama-3.2-1B as the student, evaluated on GSM8K, MATH, ARC and CSQA. Teacher accuracy changes by +0.4% to +1.4%, while the misled student loses about 9% to 21%.
- Larger students suffer more. With Llama-3.1-8B as the student, accuracy drops by 20–50%, compared with roughly 8–18% for the 1B student.
- The default adversarial coefficient is λ = 3×10⁻⁵, which converges smoothly within 100 training steps. Training already becomes unstable at λ = 10⁻⁴, and at 10⁻³ the loss landscape becomes much more rugged.
- Case studies use a DeepSeek-R1-7B teacher trained on GSM8K. Typical defended outputs are coherent but filled with low-confidence wording and repeated verification. Rare failure cases show language mixing, yet still reach the right answer.
- Models are released at huggingface.co/unites-lab/doge-anti-distillation, and code at github.com/unites-lab/doge.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [University of North Carolina at Chapel Hill](https://md.research.elamur.ai/free/en/universities/university-of-north-carolina-at-chapel-hill/) — University, Chapel Hill, United States · 77 works · 23,365 citations
- [Arizona State University](https://md.research.elamur.ai/free/en/universities/arizona-state-university/) — University, Tempe, United States · 58 works · 5,334 citations

📚 Shelves (3): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 19,503 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 18,805 works · [🔌 Hardware and Architecture](https://md.research.elamur.ai/free/en/shelves/computer-science/hardware-and-architecture/) · 183 works

🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 4,145 works · [🪶 Efficient models & compression](https://md.research.elamur.ai/free/en/topics/efficient-models/) · 328 works

## Cite

Cite as: Pingzhi Li, Zhen Tan, Mohan Zhang, Huaizhi Qu, Huan Liu and Tianlong Chen. 2025. DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation. arXiv:2505.19504.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@misc{li2025doge,
  title = {{DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation}},
  author = {Pingzhi Li, Zhen Tan, Mohan Zhang, Huaizhi Qu, Huan Liu and Tianlong Chen},
  year = {2025},
  doi = {10.48550/arxiv.2505.19504},
  eprint = {2505.19504},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.48550/arxiv.2505.19504}
}
```

- [← previous Doc-React: Multi-page Heterogeneous Document Question-answering](https://md.research.elamur.ai/free/en/papers/wu-2025-doc-react-multi-page-heterogeneous/)
- [next → Enhancing Knowledge Distillation of Large Language Models through Efficient Multi-Modal Distribution Alignment](https://md.research.elamur.ai/free/en/papers/peng-2025-enhancing-knowledge-distillation-large-language/)
- [↑ back to papers of 2025](https://md.research.elamur.ai/free/en/papers/2025/page/13/)

## References

71 references, 20 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Ba, J. and Caruana, R. Do deep nets really need to be deep? Advances in neural information processing systems, 27, 2014. 3 [find](https://scholar.google.com/scholar?q=Ba%2C+J%2E+and+Caruana%2C+R%2E+Do+deep+nets+really+need+to+be+deep%3F+Advances+in+neural+information+processing+systems%2C+27%2C+2014%2E+3)
2. Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. [Language models are few-shot learners](https://md.research.elamur.ai/free/en/papers/brown-2020-language-models-few-shot-learners/). Advances in neural information processing systems, 33:1877–1901, 2020. 1
3. Chen, P., Liu, S., Zhao, H., and Jia, J. Distilling knowledge via knowledge review. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 5008–5017, 2021. 3 [find](https://scholar.google.com/scholar?q=Chen%2C+P%2E%2C+Liu%2C+S%2E%2C+Zhao%2C+H%2E%2C+and+Jia%2C+J%2E+Distilling+knowledge+via+knowledge+review%2E+In+Proceedings+of+the+IEEE%2FCVF+conference+on+computer+vision+and+pattern+recognition%2C+pp%2E+5008%E2%80%935017%2C+2021%2E+3)
4. Chen, Y., Guan, R., Gong, X., Dong, J., and Xue, M. D-dae: Defense-penetrating model extraction attacks. In 2023 IEEE Symposium on Security and Privacy (SP), pp. 382–399. [find](https://scholar.google.com/scholar?q=Chen%2C+Y%2E%2C+Guan%2C+R%2E%2C+Gong%2C+X%2E%2C+Dong%2C+J%2E%2C+and+Xue%2C+M%2E+D%2Ddae%3A+Defense%2Dpenetrating+model+extraction+attacks%2E+In+2023+IEEE+Symposium+on+Security+and+Privacy+%28SP%29%2C+pp%2E+382%E2%80%93399%2E)
5. Chiang, W.-L., Li, Z., Lin, Z., Sheng, Y., Wu, Z., Zhang, H., Zheng, L., Zhuang, S., Zhuang, Y., Gonzalez, J. E., Stoica, I., and Xing, E. P. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, March 2023. URL [https://lmsys.org/blog/2023-03-30-vicuna/](https://lmsys.org/blog/2023-03-30-vicuna/). 3 [↗](https://lmsys.org/blog/2023-03-30-vicuna/)
6. Clark, P., Cowhey, I., Etzioni, O., Khot, T., Sabharwal, A., Schoenick, C., and Tafjord, O. [Think you have solved question answering? try arc, the ai2 reasoning challenge](https://md.research.elamur.ai/free/en/papers/clark-2018-think-have-solved-question-answering/), 2018. URL https://arxiv.org/abs/1803.05457. 7 [↗](https://arxiv.org/abs/1803.05457)
7. Cobbe, K., Kosaraju, V., Bavarian, M., Chen, M., Jun, H., Kaiser, L., Plappert, M., Tworek, J., Hilton, J., Nakano, R., Hesse, C., and Schulman, J. [Training verifiers to solve math word problems](https://md.research.elamur.ai/free/en/papers/cobbe-2021-training-verifiers-solve-math-word/), 2021. URL https://arxiv.org/abs/2110.14168. 6, 7 [↗](https://arxiv.org/abs/2110.14168)
8. Cui, W., Li, X., Huang, J., Wang, W., Wang, S., and Chen, J. Substitute model generation for black-box adversarial attack based on knowledge distillation. In 2020 IEEE International Conference on Image Processing (ICIP), pp. 648–652. [find](https://scholar.google.com/scholar?q=Cui%2C+W%2E%2C+Li%2C+X%2E%2C+Huang%2C+J%2E%2C+Wang%2C+W%2E%2C+Wang%2C+S%2E%2C+and+Chen%2C+J%2E+Substitute+model+generation+for+black%2Dbox+adversarial+attack+based+on+knowledge+distillation%2E+In+2020+IEEE+International+Conference+on+Imag)
9. Cui, X., Zhu, M., Qin, Y., Xie, L., Zhou, W., and Li, H. Multi-level optimal transport for universal cross-tokenizer knowledge distillation on language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 23724–23732, 2025. 6 [find](https://scholar.google.com/scholar?q=Cui%2C+X%2E%2C+Zhu%2C+M%2E%2C+Qin%2C+Y%2E%2C+Xie%2C+L%2E%2C+Zhou%2C+W%2E%2C+and+Li%2C+H%2E+Multi%2Dlevel+optimal+transport+for+universal+cross%2Dtokenizer+knowledge+distillation+on+language+models%2E+In+Proceedings+of+the+AAAI+Conference+on)
10. Ge, Y., Wang, Q., Zheng, B., Zhuang, X., Li, Q., Shen, C., and Wang, C. Anti-distillation backdoor attacks: Backdoors can really survive in knowledge distillation. In Proceedings of the 29th ACM International Conference on Multimedia, pp. 826–834, 2021. 3 [find](https://scholar.google.com/scholar?q=Ge%2C+Y%2E%2C+Wang%2C+Q%2E%2C+Zheng%2C+B%2E%2C+Zhuang%2C+X%2E%2C+Li%2C+Q%2E%2C+Shen%2C+C%2E%2C+and+Wang%2C+C%2E+Anti%2Ddistillation+backdoor+attacks%3A+Backdoors+can+really+survive+in+knowledge+distillation%2E+In+Proceedings+of+the+29th+ACM+Inter)
11. Gong, X., Wang, Q., Chen, Y., Yang, W., and Jiang, X. Model extraction attacks and defenses on cloud-based machine learning models. IEEE Communications Magazine, 58(12):83–89, 2021. 3 [find](https://scholar.google.com/scholar?q=Gong%2C+X%2E%2C+Wang%2C+Q%2E%2C+Chen%2C+Y%2E%2C+Yang%2C+W%2E%2C+and+Jiang%2C+X%2E+Model+extraction+attacks+and+defenses+on+cloud%2Dbased+machine+learning+models%2E+IEEE+Communications+Magazine%2C+58%2812%29%3A83%E2%80%9389%2C+2021%2E+3)
12. Goodfellow, I. J., Shlens, J., and Szegedy, C. [Explaining and harnessing adversarial examples](https://md.research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/). arXiv preprint arXiv:1412.6572, 2014. 2
13. Gou, J., Yu, B., Maybank, S. J., and Tao, D. Knowledge distillation: A survey. International Journal of Computer Vision, 129(6):1789–1819, 2021. 3 [find](https://scholar.google.com/scholar?q=Gou%2C+J%2E%2C+Yu%2C+B%2E%2C+Maybank%2C+S%2E+J%2E%2C+and+Tao%2C+D%2E+Knowledge+distillation%3A+A+survey%2E+International+Journal+of+Computer+Vision%2C+129%286%29%3A1789%E2%80%931819%2C+2021%2E+3)
14. Guan, J., Liang, J., and He, R. Are you stealing my model? sample correlation for fingerprinting deep neural networks. Advances in Neural Information Processing Systems, 35:36571–36584, 2022. 3 [find](https://scholar.google.com/scholar?q=Guan%2C+J%2E%2C+Liang%2C+J%2E%2C+and+He%2C+R%2E+Are+you+stealing+my+model%3F+sample+correlation+for+fingerprinting+deep+neural+networks%2E+Advances+in+Neural+Information+Processing+Systems%2C+35%3A36571%E2%80%9336584%2C+2022%2E+3)
15. He, J., Zhang, J., Chen, Z., Chen, S., Zhang, M., and Liu, Y. Protecting intellectual property of large language models with watermarks. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pp. 10711–10721, 2022. 1 [find](https://scholar.google.com/scholar?q=He%2C+J%2E%2C+Zhang%2C+J%2E%2C+Chen%2C+Z%2E%2C+Chen%2C+S%2E%2C+Zhang%2C+M%2E%2C+and+Liu%2C+Y%2E+Protecting+intellectual+property+of+large+language+models+with+watermarks%2E+In+Proceedings+of+the+2022+Conference+on+Empirical+Methods+in+N)
16. Hendrycks, D., Burns, C., Kadavath, S., Arora, A., Basart, S., Tang, E., Song, D., and Steinhardt, J. [Measuring mathematical problem solving with the math dataset](https://md.research.elamur.ai/free/en/papers/hendrycks-2021-measuring-mathematical-problem-solving-math/), 2021. URL [https://arxiv.org/](https://arxiv.org/) abs/2103.03874. 7 [↗](https://arxiv.org/)
17. Hinton, G., Vinyals, O., and Dean, J. [Distilling the knowledge in a neural network](https://md.research.elamur.ai/free/en/papers/hinton-2015-distilling-knowledge-neural-network/). arXiv preprint arXiv:1503.02531, 2015. 1, 2, 3
18. Hong, I. and Choi, C. Knowledge distillation vulnerability of deit through cnn adversarial attack. Neural Computing and Applications, pp. 1–11, 2023. 3 [find](https://scholar.google.com/scholar?q=Hong%2C+I%2E+and+Choi%2C+C%2E+Knowledge+distillation+vulnerability+of+deit+through+cnn+adversarial+attack%2E+Neural+Computing+and+Applications%2C+pp%2E+1%E2%80%9311%2C+2023%2E+3)
19. Hosny, K. M., Magdi, A., ElKomy, O., and Hamza, H. M. Digital image watermarking using deep learning: A survey. Computer Science Review, 53:100662, 2024. 3 [find](https://scholar.google.com/scholar?q=Hosny%2C+K%2E+M%2E%2C+Magdi%2C+A%2E%2C+ElKomy%2C+O%2E%2C+and+Hamza%2C+H%2E+M%2E+Digital+image+watermarking+using+deep+learning%3A+A+survey%2E+Computer+Science+Review%2C+53%3A100662%2C+2024%2E+3)
20. Hsu, Y.-S., Feldhus, N., and Hakimov, S. Free-text rationale generation under readability level control. ArXiv, abs/2407.01384, 2024. URL [https://api.semanticscholar.org/CorpusId:270870139](https://api.semanticscholar.org/CorpusId:270870139). 3 [↗](https://api.semanticscholar.org/CorpusId:270870139)
21. Huang, J., Shao, H., and Chang, K. C.-C. [Are large pre-trained language models leaking your personal information?](https://md.research.elamur.ai/free/en/papers/huang-2022-large-pre-trained-language-models/) In Findings of the Association for Computational Linguistics: EMNLP 2022, pp. 2038–2047, 2022. 1
22. Huang, L., Joseph, A. D., Nelson, B., Rubinstein, B. I., and Tygar, J. D. Adversarial machine learning. In Proceedings of the 4th ACM workshop on Security and artificial intelligence, pp. 43–58, 2011. 3 [find](https://scholar.google.com/scholar?q=Huang%2C+L%2E%2C+Joseph%2C+A%2E+D%2E%2C+Nelson%2C+B%2E%2C+Rubinstein%2C+B%2E+I%2E%2C+and+Tygar%2C+J%2E+D%2E+Adversarial+machine+learning%2E+In+Proceedings+of+the+4th+ACM+workshop+on+Security+and+artificial+intelligence%2C+pp%2E+43%E2%80%9358%2C+2011%2E)
23. Huang, Z. and Wang, N. Like what you like: Knowledge distill via neuron selectivity transfer. arXiv preprint arXiv:1707.01219, 2017. 3 — [arXiv:1707.01219](https://arxiv.org/abs/1707.01219) [find](https://scholar.google.com/scholar?q=Huang%2C+Z%2E+and+Wang%2C+N%2E+Like+what+you+like%3A+Knowledge+distill+via+neuron+selectivity+transfer%2E+arXiv+preprint+arXiv%3A1707%2E01219%2C+2017%2E+3+%E2%80%94+%5BarXiv%3A1707%2E01219%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1707%2E01219%29)
24. Jiang, W., Li, H., Xu, G., Zhang, T., and Lu, R. A comprehensive defense framework against model extraction attacks. IEEE Transactions on Dependable and Secure Computing, 21(2):685–700, 2023. 3 [find](https://scholar.google.com/scholar?q=Jiang%2C+W%2E%2C+Li%2C+H%2E%2C+Xu%2C+G%2E%2C+Zhang%2C+T%2E%2C+and+Lu%2C+R%2E+A+comprehensive+defense+framework+against+model+extraction+attacks%2E+IEEE+Transactions+on+Dependable+and+Secure+Computing%2C+21%282%29%3A685%E2%80%93700%2C+2023%2E+3)
25. Jiang, Y., Gao, Y., Zhou, C., Hu, H., Fu, A., and Susilo, W. Intellectual property protection for deep learning model and dataset intelligence. arXiv preprint arXiv:2411.05051, 2024. 3 — [arXiv:2411.05051](https://arxiv.org/abs/2411.05051) [find](https://scholar.google.com/scholar?q=Jiang%2C+Y%2E%2C+Gao%2C+Y%2E%2C+Zhou%2C+C%2E%2C+Hu%2C+H%2E%2C+Fu%2C+A%2E%2C+and+Susilo%2C+W%2E+Intellectual+property+protection+for+deep+learning+model+and+dataset+intelligence%2E+arXiv+preprint+arXiv%3A2411%2E05051%2C+2024%2E+3+%E2%80%94+%5BarXiv%3A2411%2E0)
26. Kim, H. J., Kim, Y., Park, C., Kim, J., Park, C., Yoo, K. M., goo Lee, S., and Kim, T. Aligning language models to explicitly handle ambiguity. In Conference on Empirical Methods in Natural Language Processing, 2024. URL [https://api.semanticscholar.org/CorpusId:269214521](https://api.semanticscholar.org/CorpusId:269214521). 3 [↗](https://api.semanticscholar.org/CorpusId:269214521)
27. Kim, J., Park, S., and Kwak, N. Paraphrasing complex network: Network compression via factor transfer. Advances in neural information processing systems, 31, 2018. 3 [find](https://scholar.google.com/scholar?q=Kim%2C+J%2E%2C+Park%2C+S%2E%2C+and+Kwak%2C+N%2E+Paraphrasing+complex+network%3A+Network+compression+via+factor+transfer%2E+Advances+in+neural+information+processing+systems%2C+31%2C+2018%2E+3)
28. Kim, Y. and Rush, A. M. [Sequence-level knowledge distillation](https://md.research.elamur.ai/free/en/papers/kim-2016-sequence-level-knowledge-distillation/). In Proceedings of the 2016 conference on empirical methods in natural language processing, pp. 1317–1327, 2016. 3
29. Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., and Goldstein, T. [A watermark for large language models](https://md.research.elamur.ai/free/en/papers/kirchenbauer-2023-watermark-large-language-models/). In International Conference on Machine Learning, pp. 17061–17089. PMLR, 2023. 1
30. Kumar, R. S. S., Nyström, M., Lambert, J., Marshall, A., Goertzel, M., Comissoneru, A., Swann, M., and Xia, S. Adversarial machine learning-industry perspectives. In 2020 IEEE security and privacy workshops (SPW), pp. 69–75. [find](https://scholar.google.com/scholar?q=Kumar%2C+R%2E+S%2E+S%2E%2C+Nystr%C3%B6m%2C+M%2E%2C+Lambert%2C+J%2E%2C+Marshall%2C+A%2E%2C+Goertzel%2C+M%2E%2C+Comissoneru%2C+A%2E%2C+Swann%2C+M%2E%2C+and+Xia%2C+S%2E+Adversarial+machine+learning%2Dindustry+perspectives%2E+In+2020+IEEE+security+and+privacy+wor)
31. Kurakin, A., Goodfellow, I., and Bengio, S. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016. 3 — [arXiv:1611.01236](https://arxiv.org/abs/1611.01236) [find](https://scholar.google.com/scholar?q=Kurakin%2C+A%2E%2C+Goodfellow%2C+I%2E%2C+and+Bengio%2C+S%2E+Adversarial+machine+learning+at+scale%2E+arXiv+preprint+arXiv%3A1611%2E01236%2C+2016%2E+3+%E2%80%94+%5BarXiv%3A1611%2E01236%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1611%2E01236%29)
32. Lambert, N., Morrison, J., Pyatkin, V., Huang, S., Ivison, H., Brahman, F., Miranda, L. J. V., Liu, A., Dziri, N., Lyu, S., Gu, Y., Malik, S., Graf, V., Hwang, J. D., Yang, J., Bras, R. L., Tafjord, O., Wilhelm, C., Soldaini, L., Smith, N. A., Wang, Y., Dasigi, P., and Hajishirzi, H. Tülu 3: Pushing… — [Tulu 3: Pushing Frontiers in Open Language Model Post-Training](https://md.research.elamur.ai/free/en/papers/lambert-2024-tulu-3-pushing-frontiers-open/)
33. Li, B., Wang, Y., Meng, T., Chang, K.-W., and Peng, N. Control large language models via divide and conquer. In Conference on Empirical Methods in Natural Language Processing, 2024a. URL [https://api.semanticscholar.org/CorpusId:273185893](https://api.semanticscholar.org/CorpusId:273185893). 3 [↗](https://api.semanticscholar.org/CorpusId:273185893)
34. Li, D., Jiang, B., Huang, L., Beigi, A., Zhao, C., Tan, Z., Bhattacharjee, A., Jiang, Y., Chen, C., Wu, T., et al. From generation to judgment: Opportunities and challenges of llm-as-a-judge. arXiv preprint arXiv:2411.16594, 2024b. 10 [find](https://scholar.google.com/scholar?q=Li%2C+D%2E%2C+Jiang%2C+B%2E%2C+Huang%2C+L%2E%2C+Beigi%2C+A%2E%2C+Zhao%2C+C%2E%2C+Tan%2C+Z%2E%2C+Bhattacharjee%2C+A%2E%2C+Jiang%2C+Y%2E%2C+Chen%2C+C%2E%2C+Wu%2C+T%2E%2C+et+al%2E+From+generation+to+judgment%3A+Opportunities+and+challenges+of+llm%2Das%2Da%2Djudge%2E+arXiv+pr)
35. Li, D., Jiang, B., Huang, L., Beigi, A., Zhao, C., Tan, Z., Bhattacharjee, A., Jiang, Y., Chen, C., Wu, T., Shu, K., Cheng, L., and Liu, H. From generation to judgment: Opportunities and challenges of llm-as-a-judge, 2025a. URL https://arxiv.org/abs/2411.16594. 19 [↗](https://arxiv.org/abs/2411.16594)
36. Li, D., Sun, R., Huang, Y., Zhong, M., Jiang, B., Han, J., Zhang, X., Wang, W., and Liu, H. Preference leakage: A contamination problem in llm-as-a-judge, 2025b. URL https://arxiv.org/abs/2502. 01534. 19 [↗](https://arxiv.org/abs/2502)
37. Li, G., Zhu, P., Li, J., Yang, Z., Cao, N., and Chen, Z. Security matters: A survey on adversarial machine learning. arXiv preprint arXiv:1810.07339, 2018. 3 — [arXiv:1810.07339](https://arxiv.org/abs/1810.07339) [find](https://scholar.google.com/scholar?q=Li%2C+G%2E%2C+Zhu%2C+P%2E%2C+Li%2C+J%2E%2C+Yang%2C+Z%2E%2C+Cao%2C+N%2E%2C+and+Chen%2C+Z%2E+Security+matters%3A+A+survey+on+adversarial+machine+learning%2E+arXiv+preprint+arXiv%3A1810%2E07339%2C+2018%2E+3+%E2%80%94+%5BarXiv%3A1810%2E07339%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs)
38. Liang, J., Li, G., and Yu, Y. Universal and context-independent triggers for precise control of llm outputs. ArXiv, abs/2411.14738, 2024a. URL [https://api.semanticscholar.org/CorpusId:274192480](https://api.semanticscholar.org/CorpusId:274192480). 3 — [arXiv:2411.14738](https://arxiv.org/abs/2411.14738) [↗](https://api.semanticscholar.org/CorpusId:274192480)
39. Liang, J., Pang, R., Li, C., and Wang, T. Model extraction attacks revisited. In Proceedings of the 19th ACM Asia Conference on Computer and Communications Security, pp. 1231–1245, 2024b. 3 [find](https://scholar.google.com/scholar?q=Liang%2C+J%2E%2C+Pang%2C+R%2E%2C+Li%2C+C%2E%2C+and+Wang%2C+T%2E+Model+extraction+attacks+revisited%2E+In+Proceedings+of+the+19th+ACM+Asia+Conference+on+Computer+and+Communications+Security%2C+pp%2E+1231%E2%80%931245%2C+2024b%2E+3)
40. Liang, Y., Xiao, J., Gan, W., and Yu, P. S. Watermarking techniques for [large language models: A survey](https://md.research.elamur.ai/free/en/papers/minaee-2024-large-language-models-survey/). arXiv preprint arXiv:2409.00089, 2024c. 1, 3 — [arXiv:2409.00089](https://arxiv.org/abs/2409.00089)
41. Liu, P., Wu, L., Wang, L., Guo, S., and Liu, Y. Step-by-step: Controlling arbitrary style in text with large language models. In Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING 2024), pp. 15285–15295, 2024. 3 [find](https://scholar.google.com/scholar?q=Liu%2C+P%2E%2C+Wu%2C+L%2E%2C+Wang%2C+L%2E%2C+Guo%2C+S%2E%2C+and+Liu%2C+Y%2E+Step%2Dby%2Dstep%3A+Controlling+arbitrary+style+in+text+with+large+language+models%2E+In+Proceedings+of+the+2024+Joint+International+Conference+on+Computational)
42. Ma, H., Chen, T., Hu, T.-K., You, C., Xie, X., and Wang, Z. Undistillable: Making a nasty teacher that cannot teach students. arXiv preprint arXiv:2105.07381, 2021. 1 — [arXiv:2105.07381](https://arxiv.org/abs/2105.07381) [find](https://scholar.google.com/scholar?q=Ma%2C+H%2E%2C+Chen%2C+T%2E%2C+Hu%2C+T%2E%2DK%2E%2C+You%2C+C%2E%2C+Xie%2C+X%2E%2C+and+Wang%2C+Z%2E+Undistillable%3A+Making+a+nasty+teacher+that+cannot+teach+students%2E+arXiv+preprint+arXiv%3A2105%2E07381%2C+2021%2E+1+%E2%80%94+%5BarXiv%3A2105%2E07381%5D%28https%3A%2F%2Farxi)
43. Minixhofer, B., Ponti, E. M., and Vulić, I. Cross-tokenizer distillation via approximate likelihood matching. arXiv preprint arXiv:2503.20083, 2025. 6 [find](https://scholar.google.com/scholar?q=Minixhofer%2C+B%2E%2C+Ponti%2C+E%2E+M%2E%2C+and+Vuli%C4%87%2C+I%2E+Cross%2Dtokenizer+distillation+via+approximate+likelihood+matching%2E+arXiv+preprint+arXiv%3A2503%2E20083%2C+2025%2E+6)
44. Mirzadeh, S. I., Farajtabar, M., Li, A., Levine, N., Matsukawa, A., and Ghasemzadeh, H. [Improved knowledge distillation via teacher assistant](https://md.research.elamur.ai/free/en/papers/mirzadeh-2019-improved-knowledge-distillation-teacher-assistant/). In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 5191–5198, 2020. 3
45. Nguyen, D., Chen, J., and Zhou, T. Multi-objective linguistic control of large language models. In Annual Meeting of the Association for Computational Linguistics, 2024. URL [https://api.semanticscholar.org/CorpusId:270702436](https://api.semanticscholar.org/CorpusId:270702436). 3 [↗](https://api.semanticscholar.org/CorpusId:270702436)
46. Peng, X. and Geng, X. Self-controller: Controlling llms with multi-round step-by-step self-awareness. ArXiv, abs/2410.00359, 2024. URL [https://api.semanticscholar.org/CorpusId:273022522](https://api.semanticscholar.org/CorpusId:273022522). 3 — [arXiv:2410.00359](https://arxiv.org/abs/2410.00359) [↗](https://api.semanticscholar.org/CorpusId:273022522)
47. Peng, Z., Li, S., Chen, G., Zhang, C., Zhu, H., and Xue, M. Fingerprinting deep neural networks globally via universal adversarial perturbations. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 13430–13439, 2022. 3 [find](https://scholar.google.com/scholar?q=Peng%2C+Z%2E%2C+Li%2C+S%2E%2C+Chen%2C+G%2E%2C+Zhang%2C+C%2E%2C+Zhu%2C+H%2E%2C+and+Xue%2C+M%2E+Fingerprinting+deep+neural+networks+globally+via+universal+adversarial+perturbations%2E+In+Proceedings+of+the+IEEE%2FCVF+conference+on+computer+)
48. Romero, A., Ballas, N., Kahou, S. E., Chassang, A., Gatta, C., and Bengio, Y. Fitnets: Hints for thin deep nets. arXiv preprint arXiv:1412.6550, 2014. 3 [find](https://scholar.google.com/scholar?q=Romero%2C+A%2E%2C+Ballas%2C+N%2E%2C+Kahou%2C+S%2E+E%2E%2C+Chassang%2C+A%2E%2C+Gatta%2C+C%2E%2C+and+Bengio%2C+Y%2E+Fitnets%3A+Hints+for+thin+deep+nets%2E+arXiv+preprint+arXiv%3A1412%2E6550%2C+2014%2E+3)
49. Šarčević, T., Karlowicz, A., Mayer, R., Baeza-Yates, R., and Rauber, A. U can’t gen this? a survey of intellectual property protection methods for data in generative ai. arXiv preprint arXiv:2406.15386, 2024. 3 — [arXiv:2406.15386](https://arxiv.org/abs/2406.15386) [find](https://scholar.google.com/scholar?q=%C5%A0ar%C4%8Devi%C4%87%2C+T%2E%2C+Karlowicz%2C+A%2E%2C+Mayer%2C+R%2E%2C+Baeza%2DYates%2C+R%2E%2C+and+Rauber%2C+A%2E+U+can%E2%80%99t+gen+this%3F+a+survey+of+intellectual+property+protection+methods+for+data+in+generative+ai%2E+arXiv+preprint+arXiv%3A2406%2E1538)
50. Savani, Y., Trockman, A., Feng, Z., Schwarzschild, A., Robey, A., Finzi, M., and Kolter, J. Z. [Antidistillation sampling](https://md.research.elamur.ai/free/en/papers/savani-2025-antidistillation-sampling/). arXiv preprint arXiv:2504.13146, 2025a. 2, 6
51. Savani, Y., Trockman, A., Feng, Z., Schwarzschild, A., Robey, A., Finzi, M., and Kolter, J. Z. [Antidistillation sampling](https://md.research.elamur.ai/free/en/papers/savani-2025-antidistillation-sampling/), 2025b. URL https://arxiv.org/abs/2504.13146. 3 [↗](https://arxiv.org/abs/2504.13146)
52. Sun, Y., Liu, T., Hu, P., Liao, Q., Fu, S., Yu, N., Guo, D., Liu, Y., and Liu, L. Deep intellectual property protection: A survey. arXiv preprint arXiv:2304.14613, 2023. 3 — [arXiv:2304.14613](https://arxiv.org/abs/2304.14613) [find](https://scholar.google.com/scholar?q=Sun%2C+Y%2E%2C+Liu%2C+T%2E%2C+Hu%2C+P%2E%2C+Liao%2C+Q%2E%2C+Fu%2C+S%2E%2C+Yu%2C+N%2E%2C+Guo%2C+D%2E%2C+Liu%2C+Y%2E%2C+and+Liu%2C+L%2E+Deep+intellectual+property+protection%3A+A+survey%2E+arXiv+preprint+arXiv%3A2304%2E14613%2C+2023%2E+3+%E2%80%94+%5BarXiv%3A2304%2E14613%5D%28https%3A%2F)
53. Takemura, T., Yanai, N., and Fujiwara, T. Model extraction attacks on recurrent neural networks. Journal of Information Processing, 28:1010–1024, 2020. 3 [find](https://scholar.google.com/scholar?q=Takemura%2C+T%2E%2C+Yanai%2C+N%2E%2C+and+Fujiwara%2C+T%2E+Model+extraction+attacks+on+recurrent+neural+networks%2E+Journal+of+Information+Processing%2C+28%3A1010%E2%80%931024%2C+2020%2E+3)
54. Talmor, A., Herzig, J., Lourie, N., and Berant, J. [Commonsenseqa: A question answering challenge targeting commonsense knowledge](https://md.research.elamur.ai/free/en/papers/talmor-2019-commonsenseqa-question-answering-challenge-targeting/), 2019. URL https://arxiv.org/abs/1811.00937. 7 [↗](https://arxiv.org/abs/1811.00937)
55. Tang, M., Dai, A., DiValentin, L., Ding, A., Hass, A., Gong, N. Z., Chen, Y., et al. {ModelGuard}:{Information-Theoretic} defense against model extraction attacks. In 33rd USENIX Security Symposium (USENIX Security 24), pp. 5305–5322, 2024. 3 [find](https://scholar.google.com/scholar?q=Tang%2C+M%2E%2C+Dai%2C+A%2E%2C+DiValentin%2C+L%2E%2C+Ding%2C+A%2E%2C+Hass%2C+A%2E%2C+Gong%2C+N%2E+Z%2E%2C+Chen%2C+Y%2E%2C+et+al%2E+%7BModelGuard%7D%3A%7BInformation%2DTheoretic%7D+defense+against+model+extraction+attacks%2E+In+33rd+USENIX+Security+Symposium+%28U)
56. Tao, Z., Xi, D., Li, Z., Tang, L., and Xu, W. Cat-llm: prompting large language models with text style definition for chinese article-style transfer. arXiv preprint arXiv:2401.05707, 2024. 3 [find](https://scholar.google.com/scholar?q=Tao%2C+Z%2E%2C+Xi%2C+D%2E%2C+Li%2C+Z%2E%2C+Tang%2C+L%2E%2C+and+Xu%2C+W%2E+Cat%2Dllm%3A+prompting+large+language+models+with+text+style+definition+for+chinese+article%2Dstyle+transfer%2E+arXiv+preprint+arXiv%3A2401%2E05707%2C+2024%2E+3)
57. Taori, R., Gulrajani, I., Zhang, T., Dubois, Y., Li, X., Guestrin, C., Liang, P., and Hashimoto, T. B. Stanford alpaca: An instruction-following llama model. [https://github.com/tatsu-lab/stanford_](https://github.com/tatsu-lab/stanford_) alpaca, 2023. 3 [↗](https://github.com/tatsu-lab/stanford_)
58. Team, G. [Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context](https://md.research.elamur.ai/free/en/papers/gemini-team-2024-gemini-1-5-unlocking-multimodal/), 2024. URL https://arxiv.org/abs/2403.05530. 19 [↗](https://arxiv.org/abs/2403.05530)
59. Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al. [Llama 2: Open foundation and fine-tuned chat models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-2-open-foundation-fine/). arXiv preprint arXiv:2307.09288, 2023. 1
60. Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., and Ristenpart, T. Stealing machine learning models via prediction apis. In 25th USENIX Security Symposium (USENIX Security 16), pp. 601–618, 2016. 1 [find](https://scholar.google.com/scholar?q=Tram%C3%A8r%2C+F%2E%2C+Zhang%2C+F%2E%2C+Juels%2C+A%2E%2C+Reiter%2C+M%2E+K%2E%2C+and+Ristenpart%2C+T%2E+Stealing+machine+learning+models+via+prediction+apis%2E+In+25th+USENIX+Security+Symposium+%28USENIX+Security+16%29%2C+pp%2E+601%E2%80%93618%2C+2016%2E+1)
61. Vorobeychik, Y. and Kantarcioglu, M. Adversarial machine learning. Morgan & Claypool Publishers, 2018. 3 [find](https://scholar.google.com/scholar?q=Vorobeychik%2C+Y%2E+and+Kantarcioglu%2C+M%2E+Adversarial+machine+learning%2E+Morgan+%26+Claypool+Publishers%2C+2018%2E+3)
62. Wan, W., Wang, J., Zhang, Y., Li, J., Yu, H., and Sun, J. A comprehensive survey on robust image watermarking. Neurocomputing, 488:226–247, 2022. 3 [find](https://scholar.google.com/scholar?q=Wan%2C+W%2E%2C+Wang%2C+J%2E%2C+Zhang%2C+Y%2E%2C+Li%2C+J%2E%2C+Yu%2C+H%2E%2C+and+Sun%2C+J%2E+A+comprehensive+survey+on+robust+image+watermarking%2E+Neurocomputing%2C+488%3A226%E2%80%93247%2C+2022%2E+3)
63. West, P., Bhagavatula, C., Hessel, J., Hwang, J. D., Jiang, L., Bras, R. L., Lu, X., Welleck, S., and Choi, Y. [Symbolic knowledge distillation: from general language models to commonsense models](https://md.research.elamur.ai/free/en/papers/west-2022-symbolic-knowledge-distillation-general-language/). arXiv preprint arXiv:2110.07178, 2021. 3
64. Xu, J., Wang, F., Ma, M. D., Koh, P. W., Xiao, C., and Chen, M. Instructional fingerprinting of large language models. arXiv preprint arXiv:2401.12255, 2024a. 1 [find](https://scholar.google.com/scholar?q=Xu%2C+J%2E%2C+Wang%2C+F%2E%2C+Ma%2C+M%2E+D%2E%2C+Koh%2C+P%2E+W%2E%2C+Xiao%2C+C%2E%2C+and+Chen%2C+M%2E+Instructional+fingerprinting+of+large+language+models%2E+arXiv+preprint+arXiv%3A2401%2E12255%2C+2024a%2E+1)
65. Xu, X., Li, M., Tao, C., Shen, T., Cheng, R., Li, J., Xu, C., Tao, D., and Zhou, T. A survey on knowledge distillation of large language models. arXiv preprint arXiv:2402.13116, 2024b. 3 — [arXiv:2402.13116](https://arxiv.org/abs/2402.13116) [find](https://scholar.google.com/scholar?q=Xu%2C+X%2E%2C+Li%2C+M%2E%2C+Tao%2C+C%2E%2C+Shen%2C+T%2E%2C+Cheng%2C+R%2E%2C+Li%2C+J%2E%2C+Xu%2C+C%2E%2C+Tao%2C+D%2E%2C+and+Zhou%2C+T%2E+A+survey+on+knowledge+distillation+of+large+language+models%2E+arXiv+preprint+arXiv%3A2402%2E13116%2C+2024b%2E+3+%E2%80%94+%5BarXiv%3A2402)
66. Yu, N., Skripniuk, V., Abdelnabi, S., and Fritz, M. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In Proceedings of the IEEE/CVF International conference on computer vision, pp. 14448–14457, 2021. 3 [find](https://scholar.google.com/scholar?q=Yu%2C+N%2E%2C+Skripniuk%2C+V%2E%2C+Abdelnabi%2C+S%2E%2C+and+Fritz%2C+M%2E+Artificial+fingerprinting+for+generative+models%3A+Rooting+deepfake+attribution+in+training+data%2E+In+Proceedings+of+the+IEEE%2FCVF+International+confere)
67. Zelikman, E., Wu, Y., Mu, J., and Goodman, N. [Star: Bootstrapping reasoning with reasoning](https://md.research.elamur.ai/free/en/papers/zelikman-2022-star-bootstrapping-reasoning-reasoning/). Advances in Neural Information Processing Systems, 35:15476–15488, 2022. 3
68. Zhang, X., Fang, C., and Shi, J. Thief, beware of what get you there: Towards understanding model extraction attack. arXiv preprint arXiv:2104.05921, 2021. 3 — [arXiv:2104.05921](https://arxiv.org/abs/2104.05921) [find](https://scholar.google.com/scholar?q=Zhang%2C+X%2E%2C+Fang%2C+C%2E%2C+and+Shi%2C+J%2E+Thief%2C+beware+of+what+get+you+there%3A+Towards+understanding+model+extraction+attack%2E+arXiv+preprint+arXiv%3A2104%2E05921%2C+2021%2E+3+%E2%80%94+%5BarXiv%3A2104%2E05921%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs)
69. Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E. P., Zhang, H., Gonzalez, J. E., and Stoica, I. [Judging llm-as-a-judge with mt-bench and chatbot arena](https://md.research.elamur.ai/free/en/papers/zheng-2023-judging-llm-judge-mt-bench/), 2023. URL https://arxiv.org/abs/2306.05685. 19 [↗](https://arxiv.org/abs/2306.05685)
70. Zhong, X., Das, A., Alrasheedi, F., and Tanvir, A. A brief, in-depth survey of deep learning-based image watermarking. Applied Sciences, 13(21):11852, 2023. 3 [find](https://scholar.google.com/scholar?q=Zhong%2C+X%2E%2C+Das%2C+A%2E%2C+Alrasheedi%2C+F%2E%2C+and+Tanvir%2C+A%2E+A+brief%2C+in%2Ddepth+survey+of+deep+learning%2Dbased+image+watermarking%2E+Applied+Sciences%2C+13%2821%29%3A11852%2C+2023%2E+3)
71. Zhou, G., Fan, Y., Cui, R., Bian, W., Zhu, X., and Gai, K. Rocket launching: A universal and efficient framework for training well-performing light net. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 32, 2018. 3 [find](https://scholar.google.com/scholar?q=Zhou%2C+G%2E%2C+Fan%2C+Y%2E%2C+Cui%2C+R%2E%2C+Bian%2C+W%2E%2C+Zhu%2C+X%2E%2C+and+Gai%2C+K%2E+Rocket+launching%3A+A+universal+and+efficient+framework+for+training+well%2Dperforming+light+net%2E+In+Proceedings+of+the+AAAI+Conference+on+Artifi)

*Updated 3 November 2026*