DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation

TL;DR

This paper presents DOGe, a method that subtly modifies LLM outputs to prevent effective knowledge distillation, thereby protecting proprietary models from imitation while maintaining output quality for legitimate users.

Contribution

Introducing DOGe, a novel output modification technique that actively defends LLMs against knowledge distillation by fine-tuning the final layer with an adversarial loss.

Findings

Defensive outputs significantly reduce the quality of student models.

The method preserves the original model's performance for legitimate use.

DOGe is practical and effective in API-based access scenarios.

Abstract

Large Language Models (LLMs) represent substantial intellectual and economic investments, yet their effectiveness can inadvertently facilitate model imitation via knowledge distillation (KD). In practical scenarios, competitors can distill proprietary LLM capabilities by simply observing publicly accessible outputs, akin to reverse-engineering a complex performance by observation alone. Existing protective methods like watermarking only identify imitation post-hoc, while other defenses assume the student model mimics the teacher's internal logits, rendering them ineffective against distillation purely from observed output text. This paper confronts the challenge of actively protecting LLMs within the realistic constraints of API-based access. We introduce an effective and efficient Defensive Output Generation (DOGe) strategy that subtly modifies the output behavior of an LLM. Its outputs are accurate and useful for legitimate users, yet are designed to be misleading for distillation, significantly undermining imitation attempts. We achieve this by fine-tuning only the final linear layer of the teacher LLM with an adversarial loss. This targeted training approach anticipates and disrupts distillation attempts during inference time. Our experiments show that, while preserving the performance of the teacher model, student models distilled from the defensively generated outputs demonstrate catastrophically reduced performance, demonstrating DOGe as a practical safeguard against KD-based model imitation.