---
title: "Antidistillation Sampling — paper by Savani et al. (2025)"
description: "The authors propose antidistillation sampling, a decoding-time defence. 50 references, cited by 8 papers here."
authors: ["Yash Savani", "Asher Trockman", "Zhili Feng", "Yixuan Even Xu", "Avi Schwarzschild", "Alexander Robey", "Marc Finzi", "J. Zico Kolter"]
year: 2025
venue: "arXiv:2504.13146"
source: "https://arxiv.org/abs/2504.13146"
doi: "10.48550/arxiv.2504.13146"
arxiv: "2504.13146"
licence: "CC BY 4.0 (arXiv)"
licence_url: "http://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/savani-2025-antidistillation-sampling/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/savani-2025-antidistillation-sampling/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2025](https://md.research.elamur.ai/free/en/papers/2025/page/11/) / Antidistillation Sampling

# Antidistillation Sampling

**Authors:** Yash Savani, Asher Trockman, [Zhili Feng](https://md.research.elamur.ai/free/en/authors/zhili-feng/), Yixuan Even Xu, [Avi Schwarzschild](https://md.research.elamur.ai/free/en/authors/avi-schwarzschild/), [Alexander Robey](https://md.research.elamur.ai/free/en/authors/alexander-robey/), [Marc Finzi](https://md.research.elamur.ai/free/en/authors/marc-finzi/) and [J. Zico Kolter](https://md.research.elamur.ai/free/en/authors/j-zico-kolter/) · **Year:** 2025 · **Venue:** [arXiv:2504.13146](https://md.research.elamur.ai/free/en/venues/neural-information-processing-systems/) ([NeurIPS 2025](https://md.research.elamur.ai/free/en/venues/neural-information-processing-systems/2025/)) · **Licence:** [CC BY 4.0 (arXiv)](http://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://arxiv.org/abs/2504.13146) · [PDF](https://arxiv.org/pdf/2504.13146) · [DOI 10.48550/arxiv.2504.13146](https://doi.org/10.48550/arxiv.2504.13146) · [arXiv 2504.13146](https://arxiv.org/abs/2504.13146) · [OpenAlex](https://openalex.org/W4417091945)

**Citations:** 1 citations (OpenAlex, 2026-10-14) · [8](https://md.research.elamur.ai/free/en/papers/savani-2025-antidistillation-sampling/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Reasoning models that expose their full chains of thought give competitors cheap training data. Another model can be distilled from these traces and inherit much of the original's capability, and safety behaviour may not carry over. The authors propose antidistillation sampling, a decoding-time defence. At each step, the teacher's next-token log-probabilities receive an additive term, weighted by λ. This term estimates how much a given token would increase a proxy student's loss on a downstream task. The estimate is a cheap finite difference: the proxy model is evaluated with its weights shifted slightly in both directions along the gradient of that loss. The resulting traces stay plausible under the teacher's own distribution but are harmful as training data. Experiments used GSM8K, MATH and MMLU, Qwen teachers and proxies, and Llama students fine-tuned with LoRA. At equal cost in teacher accuracy, students trained on these traces did much worse than those trained on ordinary temperature-sampled traces. The defence also transferred across model families. This gives model owners a tunable way to keep reasoning traces visible while making them much less useful for copying.

## Key points
- **MMLU example:** the teacher scores 72%, and a greedily distilled student reaches about 52%. Raising the teacher's temperature costs roughly 4 points of teacher accuracy but leaves the student near 52%. Antidistillation sampling at the same teacher cost pushes the student down to about 40%.
- **Cheap utility loss:** in the high-utility regime, dropping teacher accuracy from 90% to 89% lowers the poisoned student from 65% to 56%. Temperature sampling causes no student degradation at that teacher cost.
- **Cross-family transfer:** the main setup uses a Qwen teacher, a Qwen proxy and a Llama student, with the proxy and student both around 3B parameters. The effect also holds in all-Llama and all-Qwen settings, and when proxy and student differ in size.
- **Approximation check and training setup:** the finite-difference approximation performs about the same as an exact Jacobian-vector product. Distillation used LoRA (rank 128, 4 epochs), and decoding temperature was 0.6.
- **Mechanism and code:** students fit the poisoned traces, since their training loss falls, while their holdout loss rises. Code is published at github.com/locuslab/antidistillation-sampling.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Carnegie Mellon University](https://md.research.elamur.ai/free/en/universities/carnegie-mellon-university/) — University, Pittsburgh, United States · 633 works · 195,217 citations
- [OpenAI](https://md.research.elamur.ai/free/en/companies/openai/) — Company, San Francisco, United States · 25 works · 27,899 citations
- [ETH Zurich](https://md.research.elamur.ai/free/en/universities/eth-zurich/) — University, Zurich, Switzerland · 97 works · 9,612 citations

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 19,503 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 18,805 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 17,959 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 17,789 works

## Cite

Cite as: Yash Savani, Asher Trockman, Zhili Feng, Yixuan Even Xu, Avi Schwarzschild, Alexander Robey, Marc Finzi and J. Zico Kolter. 2025. Antidistillation Sampling. arXiv:2504.13146.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@misc{savani2025antidistillation,
  title = {{Antidistillation Sampling}},
  author = {Yash Savani, Asher Trockman, Zhili Feng, Yixuan Even Xu, Avi Schwarzschild, Alexander Robey, Marc Finzi and J. Zico Kolter},
  year = {2025},
  doi = {10.48550/arxiv.2504.13146},
  eprint = {2504.13146},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.48550/arxiv.2504.13146}
}
```

- [← previous Advancing Mathematical Reasoning in Language Models: The Impact of Problem-Solving Data, Data Synthesis Methods, and Training Stages](https://md.research.elamur.ai/free/en/papers/chen-2025-advancing-mathematical-reasoning-language-models/)
- [next → AraHalluEval: A Fine-grained Hallucination Evaluation Framework for Arabic LLMs](https://md.research.elamur.ai/free/en/papers/alansari-2025-arahallueval-fine-grained-hallucination-evaluation/)
- [↑ back to papers of 2025](https://md.research.elamur.ai/free/en/papers/2025/page/11/)

## References

50 references, 19 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, et al. [Openai o1 system card](https://md.research.elamur.ai/free/en/papers/openai-2024-openai-o1-system-card/). arXiv preprint arXiv:2412.16720, 2024.
2. Anthropic. Claude 3.5 sonnet model card addendum, 2024. URL [https://www.anthropic.com/news/claude-3-5-sonnet](https://www.anthropic.com/news/claude-3-5-sonnet). Accessed: 2025-05-12. [↗](https://www.anthropic.com/news/claude-3-5-sonnet)
3. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. [Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning](https://md.research.elamur.ai/free/en/papers/deepseek-ai-2025-deepseek-r1-incentivizing-reasoning-capability/). arXiv preprint arXiv:2501.12948, 2025.
4. Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. [Distilling the knowledge in a neural network](https://md.research.elamur.ai/free/en/papers/hinton-2015-distilling-knowledge-neural-network/). arXiv preprint arXiv:1503.02531, 2015.
5. Jürgen Schmidhuber. Learning complex, extended sequences using the principle of history compression. Neural computation, 4(2):234–242, 1992. [find](https://scholar.google.com/scholar?q=J%C3%BCrgen+Schmidhuber%2E+Learning+complex%2C+extended+sequences+using+the+principle+of+history+compression%2E+Neural+computation%2C+4%282%29%3A234%E2%80%93242%2C+1992%2E)
6. Jianping Gou, Baosheng Yu, Stephen J Maybank, and Dacheng Tao. Knowledge distillation: A survey. International Journal of Computer Vision, 129(6):1789–1819, 2021. [find](https://scholar.google.com/scholar?q=Jianping+Gou%2C+Baosheng+Yu%2C+Stephen+J+Maybank%2C+and+Dacheng+Tao%2E+Knowledge+distillation%3A+A+survey%2E+International+Journal+of+Computer+Vision%2C+129%286%29%3A1789%E2%80%931819%2C+2021%2E)
7. Mahdi Sabbaghi, Paul Kassianik, George Pappas, Yaron Singer, Amin Karbasi, and Hamed Hassani. Adversarial reasoning at jailbreaking time. arXiv preprint arXiv:2502.01633, 2025. — [arXiv:2502.01633](https://arxiv.org/abs/2502.01633) [find](https://scholar.google.com/scholar?q=Mahdi+Sabbaghi%2C+Paul+Kassianik%2C+George+Pappas%2C+Yaron+Singer%2C+Amin+Karbasi%2C+and+Hamed+Hassani%2E+Adversarial+reasoning+at+jailbreaking+time%2E+arXiv+preprint+arXiv%3A2502%2E01633%2C+2025%2E+%E2%80%94+%5BarXiv%3A2502%2E01633%5D%28ht)
8. Matt Burgess and Lily Hay Newman. Deepseek’s safety guardrails failed every test researchers threw at its ai chatbot. URL [https://www.wired.com/story/](https://www.wired.com/story/) deepseeks-ai-jailbreak-prompt-injection-attacks/. [↗](https://www.wired.com/story/)
9. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. [Training verifiers to solve math word problems](https://md.research.elamur.ai/free/en/papers/cobbe-2021-training-verifiers-solve-math-word/). arXiv preprint arXiv:2110.14168, 2021.
10. Dan Hendrycks, Collin Burns, Saurav Kadavath, Akul Arora, Steven Basart, Eric Tang, Dawn Song, and Jacob Steinhardt. [Measuring mathematical problem solving with the math dataset](https://md.research.elamur.ai/free/en/papers/hendrycks-2021-measuring-mathematical-problem-solving-math/). arXiv preprint arXiv:2103.03874, 2021.
11. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. [Measuring massive multitask language understanding](https://md.research.elamur.ai/free/en/papers/hendrycks-2020-measuring-massive-multitask-language-understanding/). arXiv preprint arXiv:2009.03300, 2020.
12. Cristian Buciluǎ, Rich Caruana, and Alexandru Niculescu-Mizil. Model compression. In Proceedings of the 12th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 535–541, 2006. [find](https://scholar.google.com/scholar?q=Cristian+Bucilua%CC%8C%2C+Rich+Caruana%2C+and+Alexandru+Niculescu%2DMizil%2E+Model+compression%2E+In+Proceedings+of+the+12th+ACM+SIGKDD+international+conference+on+Knowledge+discovery+and+data+mining%2C+pages+535%E2%80%93541%2C)
13. Yu Cheng, Duo Wang, Pan Zhou, and Tao Zhang. A survey of model compression and acceleration for deep neural networks. arXiv preprint arXiv:1710.09282, 2017. — [arXiv:1710.09282](https://arxiv.org/abs/1710.09282) [find](https://scholar.google.com/scholar?q=Yu+Cheng%2C+Duo+Wang%2C+Pan+Zhou%2C+and+Tao+Zhang%2E+A+survey+of+model+compression+and+acceleration+for+deep+neural+networks%2E+arXiv+preprint+arXiv%3A1710%2E09282%2C+2017%2E+%E2%80%94+%5BarXiv%3A1710%2E09282%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F)
14. Antonio Polino, Razvan Pascanu, and Dan Alistarh. Model compression via distillation and quantization. arXiv preprint arXiv:1802.05668, 2018. — [arXiv:1802.05668](https://arxiv.org/abs/1802.05668) [find](https://scholar.google.com/scholar?q=Antonio+Polino%2C+Razvan+Pascanu%2C+and+Dan+Alistarh%2E+Model+compression+via+distillation+and+quantization%2E+arXiv+preprint+arXiv%3A1802%2E05668%2C+2018%2E+%E2%80%94+%5BarXiv%3A1802%2E05668%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F1802%2E05668%29)
15. Kumar Shridhar, Alessandro Stolfo, and Mrinmaya Sachan. [Distilling reasoning capabilities into smaller language models](https://md.research.elamur.ai/free/en/papers/shridhar-2023-distilling-reasoning-capabilities-into-smaller/). Findings of the Association for Computational Linguistics: ACL 2023, pages 7059–7073, 2023.
16. Jierui Li and Raymond Mooney. Distilling algorithmic reasoning from llms via explaining solution programs. arXiv preprint arXiv:2404.08148, 2024. — [arXiv:2404.08148](https://arxiv.org/abs/2404.08148) [find](https://scholar.google.com/scholar?q=Jierui+Li+and+Raymond+Mooney%2E+Distilling+algorithmic+reasoning+from+llms+via+explaining+solution+programs%2E+arXiv+preprint+arXiv%3A2404%2E08148%2C+2024%2E+%E2%80%94+%5BarXiv%3A2404%2E08148%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2404%2E08148%29)
17. Yuxian Gu, Li Dong, Furu Wei, and Minlie Huang. Minillm: Knowledge distillation of large language models. arXiv preprint arXiv:2306.[08543, 2023](https://md.research.elamur.ai/free/en/papers/gu-2023-minillm-policy-distillation-large-language/).
18. Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein. Adversarially robust distillation. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 3996–4003, 2020. [find](https://scholar.google.com/scholar?q=Micah+Goldblum%2C+Liam+Fowl%2C+Soheil+Feizi%2C+and+Tom+Goldstein%2E+Adversarially+robust+distillation%2E+In+Proceedings+of+the+AAAI+conference+on+artificial+intelligence%2C+volume+34%2C+pages+3996%E2%80%934003%2C+2020%2E)
19. Adriana Romero, Nicolas Ballas, Samira Ebrahimi Kahou, Antoine Chassang, Carlo Gatta, and Yoshua Bengio. Fitnets: Hints for thin deep nets. arXiv preprint arXiv:1412.6550, 2014. [find](https://scholar.google.com/scholar?q=Adriana+Romero%2C+Nicolas+Ballas%2C+Samira+Ebrahimi+Kahou%2C+Antoine+Chassang%2C+Carlo+Gatta%2C+and+Yoshua+Bengio%2E+Fitnets%3A+Hints+for+thin+deep+nets%2E+arXiv+preprint+arXiv%3A1412%2E6550%2C+2014%2E)
20. New York Times. Openai says it has evidence china’s deepseek used its model to train competitor. The New York Times, January 2025. URL [https://www.nytimes.com/2025/](https://www.nytimes.com/2025/) 01/29/technology/openai-deepseek-data-harvest.html. Accessed: 2025-04-10. [↗](https://www.nytimes.com/2025/)
21. DeepSeek-AI. [Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning](https://md.research.elamur.ai/free/en/papers/deepseek-ai-2025-deepseek-r1-incentivizing-reasoning-capability/), 2025. URL https://arxiv.org/abs/2501.12948. [↗](https://arxiv.org/abs/2501.12948)
22. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862, 2022. [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Andy+Jones%2C+Kamal+Ndousse%2C+Amanda+Askell%2C+Anna+Chen%2C+Nova+DasSarma%2C+Dawn+Drain%2C+Stanislav+Fort%2C+Deep+Ganguli%2C+Tom+Henighan%2C+et+al%2E+Training+a+helpful+and+harmless+assistant+with+reinforcem)
23. Charlie Snell, Dan Klein, and Ruiqi Zhong. [Learning by distilling context](https://md.research.elamur.ai/free/en/papers/snell-2022-learning-distilling-context/). arXiv preprint arXiv:2209.15189, 2022.
24. Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, et al. A general language assistant as a laboratory for alignment. arXiv preprint arXiv:2112.00861, 2021. [find](https://scholar.google.com/scholar?q=Amanda+Askell%2C+Yuntao+Bai%2C+Anna+Chen%2C+Dawn+Drain%2C+Deep+Ganguli%2C+Tom+Henighan%2C+Andy+Jones%2C+Nicholas+Joseph%2C+Ben+Mann%2C+Nova+DasSarma%2C+et+al%2E+A+general+language+assistant+as+a+laboratory+for+alignment%2E+a)
25. Melody Y Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Helyar, Rachel Dias, Andrea Vallone, Hongyu Ren, Jason Wei, et al. [Deliberative alignment: Reasoning enables safer language models](https://md.research.elamur.ai/free/en/papers/guan-2024-deliberative-alignment-reasoning-enables-safer/). arXiv preprint arXiv:2412.16339, 2024.
26. Hunter Lightman, Vineet Kosaraju, Yuri Burda, Harrison Edwards, Bowen Baker, Teddy Lee, Jan Leike, John Schulman, Ilya Sutskever, and Karl Cobbe. Let’s verify step by step. In The Twelfth International Conference on Learning Representations, 2023. — [Let's Verify Step by Step](https://md.research.elamur.ai/free/en/papers/lightman-2023-let-s-verify-step-step/)
27. Jonathan Uesato, Nate Kushman, Ramana Kumar, Francis Song, Noah Siegel, Lisa Wang, Antonia Creswell, Geoffrey Irving, and Irina Higgins. Solving math word problems with process-and outcome-based feedback. arXiv preprint arXiv:2211.[14275, 2022](https://md.research.elamur.ai/free/en/papers/uesato-2022-solving-math-word-problems-process/).
28. Nicholas Carlini, Daniel Paleka, Krishnamurthy Dj Dvijotham, Thomas Steinke, Jonathan Hayase, A Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, et al. Stealing part of a production language model. arXiv preprint arXiv:2403.06634, 2024. — [arXiv:2403.06634](https://arxiv.org/abs/2403.06634) [find](https://scholar.google.com/scholar?q=Nicholas+Carlini%2C+Daniel+Paleka%2C+Krishnamurthy+Dj+Dvijotham%2C+Thomas+Steinke%2C+Jonathan+Hayase%2C+A+Feder+Cooper%2C+Katherine+Lee%2C+Matthew+Jagielski%2C+Milad+Nasr%2C+Arthur+Conmy%2C+et+al%2E+Stealing+part+of+a+prod)
29. Milad Nasr, Nicholas Carlini, Jonathan Hayase, Matthew Jagielski, A Feder Cooper, Daphne Ippolito, Christopher A Choquette-Choo, Eric Wallace, Florian Tramèr, and Katherine Lee. [Scalable extraction of training data from (production) language models](https://md.research.elamur.ai/free/en/papers/nasr-2023-scalable-extraction-training-data-production/). arXiv preprint arXiv:2311.17035, 2023.
30. Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander M adry, Bo Li, and Tom Goldstein. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(2):1563–158… [find](https://scholar.google.com/scholar?q=Micah+Goldblum%2C+Dimitris+Tsipras%2C+Chulin+Xie%2C+Xinyun+Chen%2C+Avi+Schwarzschild%2C+Dawn+Song%2C+Aleksander+M+adry%2C+Bo+Li%2C+and+Tom+Goldstein%2E+Dataset+security+for+machine+learning%3A+Data+poisoning%2C+backdoor+at)
31. Javier Rando and Florian Tramèr. Universal jailbreak backdoors from poisoned human feedback. In International Conference on Learning Representations, 2024. [find](https://scholar.google.com/scholar?q=Javier+Rando+and+Florian+Tram%C3%A8r%2E+Universal+jailbreak+backdoors+from+poisoned+human+feedback%2E+In+International+Conference+on+Learning+Representations%2C+2024%2E)
32. Haoyu Ma, Tianlong Chen, Ting-Kuei Hu, Chenyu You, Xiaohui Xie, and Zhangyang Wang. Undistillable: Making a nasty teacher that cannot teach students. arXiv preprint arXiv:2105.07381, 2021. — [arXiv:2105.07381](https://arxiv.org/abs/2105.07381) [find](https://scholar.google.com/scholar?q=Haoyu+Ma%2C+Tianlong+Chen%2C+Ting%2DKuei+Hu%2C+Chenyu+You%2C+Xiaohui+Xie%2C+and+Zhangyang+Wang%2E+Undistillable%3A+Making+a+nasty+teacher+that+cannot+teach+students%2E+arXiv+preprint+arXiv%3A2105%2E07381%2C+2021%2E+%E2%80%94+%5BarXiv%3A21)
33. Haoyu Ma, Yifan Huang, Tianlong Chen, Hao Tang, Chenyu You, Zhangyang Wang, and Xiaohui Xie. Stingy teacher: Sparse logits suffice to fail knowledge distillation. 2022. [find](https://scholar.google.com/scholar?q=Haoyu+Ma%2C+Yifan+Huang%2C+Tianlong+Chen%2C+Hao+Tang%2C+Chenyu+You%2C+Zhangyang+Wang%2C+and+Xiaohui+Xie%2E+Stingy+teacher%3A+Sparse+logits+suffice+to+fail+knowledge+distillation%2E+2022%2E)
34. Xuandong Zhao, Yu-Xiang Wang, and Lei Li. Protecting language generation models via invisible watermarking. In International Conference on Machine Learning, pages 42187–42199. PMLR, 2023. [find](https://scholar.google.com/scholar?q=Xuandong+Zhao%2C+Yu%2DXiang+Wang%2C+and+Lei+Li%2E+Protecting+language+generation+models+via+invisible+watermarking%2E+In+International+Conference+on+Machine+Learning%2C+pages+42187%E2%80%9342199%2E+PMLR%2C+2023%2E)
35. Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of watermarks for language models. arXiv preprint arXiv:2312.04469, 2023. [find](https://scholar.google.com/scholar?q=Chenchen+Gu%2C+Xiang+Lisa+Li%2C+Percy+Liang%2C+and+Tatsunori+Hashimoto%2E+On+the+learnability+of+watermarks+for+language+models%2E+arXiv+preprint+arXiv%3A2312%2E04469%2C+2023%2E)
36. Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes language models radioactive. Advances in Neural Information Processing Systems, 37:21079–21113, 2024. [find](https://scholar.google.com/scholar?q=Tom+Sander%2C+Pierre+Fernandez%2C+Alain+Durmus%2C+Matthijs+Douze%2C+and+Teddy+Furon%2E+Watermarking+makes+language+models+radioactive%2E+Advances+in+Neural+Information+Processing+Systems%2C+37%3A21079%E2%80%9321113%2C+2024%2E)
37. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. [A watermark for large language models](https://md.research.elamur.ai/free/en/papers/kirchenbauer-2023-watermark-large-language-models/). In International Conference on Machine Learning, pages 17061–17084. PMLR, 2023.
38. Huajie Chen, Tianqing Zhu, Lefeng Zhang, Bo Liu, Derui Wang, Wanlei Zhou, and Minhui Xue. Queen: Query unlearning against model extraction. IEEE Transactions on Information Forensics and Security, 2025. [find](https://scholar.google.com/scholar?q=Huajie+Chen%2C+Tianqing+Zhu%2C+Lefeng+Zhang%2C+Bo+Liu%2C+Derui+Wang%2C+Wanlei+Zhou%2C+and+Minhui+Xue%2E+Queen%3A+Query+unlearning+against+model+extraction%2E+IEEE+Transactions+on+Information+Forensics+and+Security%2C+202)
39. Sidharth Mudgal, Jong Lee, Harish Ganapathy, YaGuang Li, Tao Wang, Yanping Huang, Zhifeng Chen, Heng-Tze Cheng, Michael Collins, Trevor Strohman, et al. Controlled decoding from language models. arXiv preprint arXiv:2310.17022, 2023. [find](https://scholar.google.com/scholar?q=Sidharth+Mudgal%2C+Jong+Lee%2C+Harish+Ganapathy%2C+YaGuang+Li%2C+Tao+Wang%2C+Yanping+Huang%2C+Zhifeng+Chen%2C+Heng%2DTze+Cheng%2C+Michael+Collins%2C+Trevor+Strohman%2C+et+al%2E+Controlled+decoding+from+language+models%2E+arXiv)
40. Xiang Lisa Li, Ari Holtzman, Daniel Fried, Percy Liang, Jason Eisner, Tatsunori Hashimoto, Luke Zettlemoyer, and Mike Lewis. [Contrastive decoding: Open-ended text generation as optimization](https://md.research.elamur.ai/free/en/papers/li-2022-contrastive-decoding-open-ended-text/). arXiv preprint arXiv:2210.15097, 2022.
41. Haozhe Ji, Pei Ke, Hongning Wang, and Minlie Huang. Language model decoding as direct metrics optimization. arXiv preprint arXiv:2310.01041, 2023. — [arXiv:2310.01041](https://arxiv.org/abs/2310.01041) [find](https://scholar.google.com/scholar?q=Haozhe+Ji%2C+Pei+Ke%2C+Hongning+Wang%2C+and+Minlie+Huang%2E+Language+model+decoding+as+direct+metrics+optimization%2E+arXiv+preprint+arXiv%3A2310%2E01041%2C+2023%2E+%E2%80%94+%5BarXiv%3A2310%2E01041%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2310%2E01041)
42. Lianhui Qin, Sean Welleck, Daniel Khashabi, and Yejin Choi. Cold decoding: Energy-based constrained text generation with langevin dynamics. Advances in Neural Information Processing Systems, 35:9538–9551, 2022. [find](https://scholar.google.com/scholar?q=Lianhui+Qin%2C+Sean+Welleck%2C+Daniel+Khashabi%2C+and+Yejin+Choi%2E+Cold+decoding%3A+Energy%2Dbased+constrained+text+generation+with+langevin+dynamics%2E+Advances+in+Neural+Information+Processing+Systems%2C+35%3A9538%E2%80%939)
43. An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, Jin Xu, Jingren Zhou, Jinze Bai, Jinzheng He, Junyang Lin, Kai D… [find](https://scholar.google.com/scholar?q=An+Yang%2C+Baosong+Yang%2C+Binyuan+Hui%2C+Bo+Zheng%2C+Bowen+Yu%2C+Chang+Zhou%2C+Chengpeng+Li%2C+Chengyuan+Li%2C+Dayiheng+Liu%2C+Fei+Huang%2C+Guanting+Dong%2C+Haoran+Wei%2C+Huan+Lin%2C+Jialong+Tang%2C+Jialin+Wang%2C+Jian+Yang%2C+Jian)
44. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). arXiv preprint arXiv:2407.21783, 2024.
45. Joshua Vendrow, Edward Vendrow, Sara Beery, and Aleksander Madry. Do large language model benchmarks test reliability? arXiv preprint arXiv:2502.03461, 2025. [find](https://scholar.google.com/scholar?q=Joshua+Vendrow%2C+Edward+Vendrow%2C+Sara+Beery%2C+and+Aleksander+Madry%2E+Do+large+language+model+benchmarks+test+reliability%3F+arXiv+preprint+arXiv%3A2502%2E03461%2C+2025%2E)
46. Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoe… — [Transformers: State-of-the-Art Natural Language Processing](https://md.research.elamur.ai/free/en/papers/wolf-2020-transformers-state-art-natural-language/)
47. Leandro von Werra, Younes Belkada, Lewis Tunstall, Edward Beeching, Tristan Thrush, Nathan Lambert, Shengyi Huang, Kashif Rasul, and Quentin Gallouédec. Trl: Transformer reinforcement learning. [https://github.com/huggingface/trl](https://github.com/huggingface/trl), 2020. [↗](https://github.com/huggingface/trl)
48. Sylvain Gugger, Lysandre Debut, Thomas Wolf, Philipp Schmid, Zachary Mueller, Sourab Mangrulkar, Marc Sun, and Benjamin Bossan. Accelerate: Training and inference at scale made simple, efficient and adaptable. [https://github.com/](https://github.com/) huggingface/accelerate, 2022. [↗](https://github.com/)
49. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. [Lora: Low-rank adaptation of large language models](https://md.research.elamur.ai/free/en/papers/hu-2021-lora-low-rank-adaptation-large/). ICLR, 1(2):3, 2022.
50. Tri Dao, Dan Fu, Stefano Ermon, Atri Rudra, and Christopher Ré. Flashattention: Fast and memory-efficient exact attention with io-awareness. Advances in neural information processing systems, 35:16344–16359, 2022. *Figure 6: Permutation sampling is a strong baseline where we destroy the information… [find](https://scholar.google.com/scholar?q=Tri+Dao%2C+Dan+Fu%2C+Stefano+Ermon%2C+Atri+Rudra%2C+and+Christopher+R%C3%A9%2E+Flashattention%3A+Fast+and+memory%2Defficient+exact+attention+with+io%2Dawareness%2E+Advances+in+neural+information+processing+systems%2C+35%3A16344)

*Updated 3 November 2026*