{"id":"https://openalex.org/W6948377803","doi":"https://doi.org/10.48550/arxiv.2505.19504","title":"DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation","display_name":"DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation","publication_year":2025,"publication_date":"2025-05-26","ids":{"openalex":"https://openalex.org/W6948377803","doi":"https://doi.org/10.48550/arxiv.2505.19504"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2505.19504","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2505.19504","pdf_url":"https://arxiv.org/pdf/2505.19504","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2505.19504","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Li, Pingzhi","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Li, Pingzhi","raw_affiliation_strings":["Equal","The University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Equal","institution_ids":[]},{"raw_affiliation_string":"The University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Tan, Zhen","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tan, Zhen","raw_affiliation_strings":["Arizona State University","Equal"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Arizona State University","institution_ids":["https://openalex.org/I55732556"]},{"raw_affiliation_string":"Equal","institution_ids":[]}]},{"author_position":"middle","author":{"id":null,"display_name":"Zhang, Mohan","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Mohan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102833420","display_name":"Huaizhi Qu","orcid":"https://orcid.org/0009-0003-7861-0458","observed_orcids":["https://orcid.org/0009-0003-7861-0458"]},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qu, Huaizhi","raw_affiliation_strings":["The University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100338946","display_name":"Huan Liu","orcid":"https://orcid.org/0000-0002-3264-7904","observed_orcids":["https://orcid.org/0000-0002-3264-7904","https://orcid.org/0000-0001-9316-4749","https://orcid.org/0000-0003-4134-7580","https://orcid.org/0000-0002-7453-3307","https://orcid.org/0000-0001-6025-6807","https://orcid.org/0000-0002-7863-3751"]},"institutions":[{"id":"https://openalex.org/I55732556","display_name":"Arizona State University","ror":"https://ror.org/03efmqc40","country_code":"US","type":"education","lineage":["https://openalex.org/I55732556"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Liu, Huan","raw_affiliation_strings":["Arizona State University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Arizona State University","institution_ids":["https://openalex.org/I55732556"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103073431","display_name":"Tianlong Chen","orcid":"https://orcid.org/0000-0001-7774-8197","observed_orcids":["https://orcid.org/0000-0001-7774-8197","https://orcid.org/0000-0001-5588-717X"]},"institutions":[{"id":"https://openalex.org/I114027177","display_name":"University of North Carolina at Chapel Hill","ror":"https://ror.org/0130frc33","country_code":"US","type":"education","lineage":["https://openalex.org/I114027177"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chen, Tianlong","raw_affiliation_strings":["The University of North Carolina at Chapel Hill"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The University of North Carolina at Chapel Hill","institution_ids":["https://openalex.org/I114027177"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9955999851226807,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.0020000000949949026,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/knowledge-distillation","display_name":"knowledge distillation","score":0.902999997138977},{"id":"https://openalex.org/keywords/adversarial-fine-tuning","display_name":"adversarial fine-tuning","score":0.6859999895095825}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.58160001039505},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.5339999794960022},{"id":"https://openalex.org/C126388530","wikidata":"https://www.wikidata.org/wiki/Q1131737","display_name":"Imitation","level":2,"score":0.49390000104904175},{"id":"https://openalex.org/C205711294","wikidata":"https://www.wikidata.org/wiki/Q176953","display_name":"Rendering (computer graphics)","level":2,"score":0.4767000079154968},{"id":"https://openalex.org/C204030448","wikidata":"https://www.wikidata.org/wiki/Q101017","display_name":"Distillation","level":2,"score":0.4489000141620636},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.43529999256134033},{"id":"https://openalex.org/C127576917","wikidata":"https://www.wikidata.org/wiki/Q624630","display_name":"Competitor analysis","level":2,"score":0.41290000081062317},{"id":"https://openalex.org/C2780771206","wikidata":"https://www.wikidata.org/wiki/Q3271761","display_name":"Safeguard","level":2,"score":0.4115999937057495},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4090000092983246},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3725000023841858},{"id":"https://openalex.org/C2776650193","wikidata":"https://www.wikidata.org/wiki/Q264661","display_name":"Obstacle","level":2,"score":0.29820001125335693},{"id":"https://openalex.org/C28427503","wikidata":"https://www.wikidata.org/wiki/Q13580300","display_name":"Internal model","level":3,"score":0.27570000290870667},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2750000059604645},{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.26170000433921814},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.26159998774528503},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2500999867916107}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2505.19504","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2505.19504","pdf_url":"https://arxiv.org/pdf/2505.19504","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2505.19504","doi":"https://doi.org/10.48550/arxiv.2505.19504","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2505.19504","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2505.19504","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2505.19504","pdf_url":"https://arxiv.org/pdf/2505.19504","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320307791","display_name":"Cisco Systems","ror":"https://ror.org/03yt1ez60"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W6948377803.pdf","grobid_xml":"https://content.openalex.org/works/W6948377803.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7134822694","https://openalex.org/W7130482357","https://openalex.org/W7127643295","https://openalex.org/W7161719613","https://openalex.org/W4413387654","https://openalex.org/W4407719157","https://openalex.org/W7221132743","https://openalex.org/W7214044927","https://openalex.org/W4389524481","https://openalex.org/W4380993498"],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"represent":[4],"substantial":[5],"intellectual":[6],"and":[7,97,117,157],"economic":[8],"investments,":[9],"yet":[10,122],"their":[11],"effectiveness":[12],"can":[13,26],"inadvertently":[14],"facilitate":[15],"model":[16,61,196],"imitation":[17,53,132],"via":[18],"knowledge":[19],"distillation":[20,71,159],"(KD).":[21],"In":[22],"practical":[23,192],"scenarios,":[24],"competitors":[25],"distill":[27],"proprietary":[28],"LLM":[29,147],"capabilities":[30],"by":[31,43,137],"simply":[32],"observing":[33],"publicly":[34],"accessible":[35],"outputs,":[36],"akin":[37],"to":[38,125],"reverse-engineering":[39],"a":[40,191],"complex":[41],"performance":[42,171],"observation":[44],"alone.":[45],"Existing":[46],"protective":[47],"methods":[48],"like":[49],"watermarking":[50],"only":[51,139],"identify":[52],"post-hoc,":[54],"while":[55,168],"other":[56],"defenses":[57],"assume":[58],"the":[59,63,80,87,107,140,145,170,173,180],"student":[60,176],"mimics":[62],"teacher's":[64],"internal":[65],"logits,":[66],"rendering":[67],"them":[68],"ineffective":[69],"against":[70,194],"purely":[72],"from":[73,179],"observed":[74],"output":[75,108],"text.":[76],"This":[77,152],"paper":[78],"confronts":[79],"challenge":[81],"of":[82,90,110,144,172],"actively":[83],"protecting":[84],"LLMs":[85],"within":[86],"realistic":[88],"constraints":[89],"API-based":[91],"access.":[92],"We":[93,134],"introduce":[94],"an":[95,111,149],"effective":[96],"efficient":[98],"Defensive":[99],"Output":[100],"Generation":[101],"(DOGe)":[102],"strategy":[103],"that":[104],"subtly":[105],"modifies":[106],"behavior":[109],"LLM.":[112],"Its":[113],"outputs":[114,183],"are":[115,123],"accurate":[116],"useful":[118],"for":[119,128],"legitimate":[120],"users,":[121],"designed":[124],"be":[126],"misleading":[127],"distillation,":[129],"significantly":[130],"undermining":[131],"attempts.":[133],"achieve":[135],"this":[136],"fine-tuning":[138],"final":[141],"linear":[142],"layer":[143],"teacher":[146,174],"with":[148],"adversarial":[150],"loss.":[151],"targeted":[153],"training":[154],"approach":[155],"anticipates":[156],"disrupts":[158],"attempts":[160],"during":[161],"inference":[162],"time.":[163],"Our":[164],"experiments":[165],"show":[166],"that,":[167],"preserving":[169],"model,":[175],"models":[177],"distilled":[178],"defensively":[181],"generated":[182],"demonstrate":[184],"catastrophically":[185],"reduced":[186],"performance,":[187],"demonstrating":[188],"DOGe":[189],"as":[190],"safeguard":[193],"KD-based":[195],"imitation.":[197]},"counts_by_year":[],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2025-10-10T00:00:00"}