{"id":"https://openalex.org/W4417291014","doi":"https://doi.org/10.48550/arxiv.2512.09403","title":"Black-Box Behavioral Distillation Breaks Safety Alignment in Medical LLMs","display_name":"Black-Box Behavioral Distillation Breaks Safety Alignment in Medical LLMs","publication_year":2025,"publication_date":"2025-12-10","ids":{"openalex":"https://openalex.org/W4417291014","doi":"https://doi.org/10.48550/arxiv.2512.09403"},"language":null,"primary_location":{"id":"pmh:oai:arXiv.org:2512.09403","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2512.09403","pdf_url":"https://arxiv.org/pdf/2512.09403","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2512.09403","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120789901","display_name":"Sohely Jahan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jahan, Sohely","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5120789902","display_name":"Ruimin Sun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sun, Ruimin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.933899998664856,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.933899998664856,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11636","display_name":"Artificial Intelligence in Healthcare and Education","score":0.013500000350177288,"subfield":{"id":"https://openalex.org/subfields/2718","display_name":"Health Informatics"},"field":{"id":"https://openalex.org/fields/27","display_name":"Medicine"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},{"id":"https://openalex.org/T13702","display_name":"Machine Learning in Healthcare","score":0.012400000356137753,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6467999815940857},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5491999983787537},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.5206000208854675},{"id":"https://openalex.org/keywords/generative-grammar","display_name":"Generative grammar","score":0.42080000042915344},{"id":"https://openalex.org/keywords/replicate","display_name":"Replicate","score":0.3882000148296356},{"id":"https://openalex.org/keywords/memorization","display_name":"Memorization","score":0.3578000068664551},{"id":"https://openalex.org/keywords/fidelity","display_name":"Fidelity","score":0.3481999933719635},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.32659998536109924}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6779000163078308},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6467999815940857},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5491999983787537},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.5206000208854675},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4438000023365021},{"id":"https://openalex.org/C39890363","wikidata":"https://www.wikidata.org/wiki/Q36108","display_name":"Generative grammar","level":2,"score":0.42080000042915344},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4163999855518341},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.41200000047683716},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.41130000352859497},{"id":"https://openalex.org/C2781162219","wikidata":"https://www.wikidata.org/wiki/Q26250693","display_name":"Replicate","level":2,"score":0.3882000148296356},{"id":"https://openalex.org/C30038468","wikidata":"https://www.wikidata.org/wiki/Q4354775","display_name":"Memorization","level":2,"score":0.3578000068664551},{"id":"https://openalex.org/C2776459999","wikidata":"https://www.wikidata.org/wiki/Q2119376","display_name":"Fidelity","level":2,"score":0.3481999933719635},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.32659998536109924},{"id":"https://openalex.org/C3017944768","wikidata":"https://www.wikidata.org/wiki/Q1450463","display_name":"Poison control","level":2,"score":0.3061999976634979},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3019999861717224},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.3012999892234802},{"id":"https://openalex.org/C167966045","wikidata":"https://www.wikidata.org/wiki/Q5532625","display_name":"Generative model","level":3,"score":0.3005000054836273},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.2874999940395355},{"id":"https://openalex.org/C2776289891","wikidata":"https://www.wikidata.org/wiki/Q1931511","display_name":"Neglect","level":2,"score":0.27790001034736633},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.2727000117301941},{"id":"https://openalex.org/C204030448","wikidata":"https://www.wikidata.org/wiki/Q101017","display_name":"Distillation","level":2,"score":0.2678999900817871},{"id":"https://openalex.org/C31170391","wikidata":"https://www.wikidata.org/wiki/Q188619","display_name":"Hierarchy","level":2,"score":0.26759999990463257},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.26190000772476196}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2512.09403","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2512.09403","pdf_url":"https://arxiv.org/pdf/2512.09403","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2512.09403","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2512.09403","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2512.09403","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2512.09403","pdf_url":"https://arxiv.org/pdf/2512.09403","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4417291014.pdf","grobid_xml":"https://content.openalex.org/works/W4417291014.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"As":[0],"medical":[1,39,55,211],"large":[2],"language":[3],"models":[4,29],"(LLMs)":[5],"become":[6],"increasingly":[7],"integrated":[8],"into":[9],"clinical":[10],"workflows,":[11],"concerns":[12],"around":[13],"alignment":[14,144,189],"robustness,":[15],"and":[16,68,128,169,204],"safety":[17,96,216,223],"are":[18],"escalating.":[19],"Prior":[20],"work":[21],"on":[22,27,111],"model":[23,94,132],"extraction":[24],"has":[25],"focused":[26],"classification":[28],"or":[30,98],"memorization":[31],"leakage,":[32],"leaving":[33],"the":[34,50,106,129,219],"vulnerability":[35],"of":[36,53,104,120],"safety-aligned":[37,54],"generative":[38],"LLMs":[40,56],"underexplored.":[41],"We":[42,176],"present":[43],"a":[44,77,86,102,136,152,179,184,202],"black-box":[45,192,199],"distillation":[46,200],"attack":[47],"that":[48,197],"replicates":[49],"domain-specific":[51],"reasoning":[52],"using":[57],"only":[58],"output-level":[59],"access.":[60],"By":[61],"issuing":[62],"48,000":[63],"instruction":[64,72],"queries":[65],"to":[66,93],"Meditron-7B":[67,126],"collecting":[69],"25,000":[70],"benign":[71,112],"response":[73],"pairs,":[74],"we":[75,150],"fine-tune":[76],"LLaMA3":[78],"8B":[79],"surrogate":[80,107],"via":[81],"parameter":[82],"efficient":[83],"LoRA":[84],"under":[85],"zero-alignment":[87],"supervision":[88],"setting,":[89],"requiring":[90],"no":[91],"access":[92],"weights,":[95],"filters,":[97],"training":[99],"data.":[100],"With":[101],"cost":[103],"$12,":[105],"achieves":[108],"strong":[109],"fidelity":[110],"inputs":[113],"while":[114,143,214],"producing":[115],"unsafe":[116],"completions":[117],"for":[118,187,221],"86%":[119],"adversarial":[121,154],"prompts,":[122],"far":[123],"exceeding":[124],"both":[125],"(66%)":[127],"untuned":[130],"base":[131],"(46%).":[133],"This":[134],"reveals":[135],"pronounced":[137],"functional-ethical":[138],"gap,":[139],"task":[140],"utility":[141],"transfers,":[142],"collapses.":[145],"To":[146],"analyze":[147],"this":[148],"collapse,":[149],"develop":[151],"dynamic":[153],"evaluation":[155],"framework":[156],"combining":[157],"Generative":[158],"Query":[159],"(GQ)-based":[160],"harmful":[161],"prompt":[162],"generation,":[163],"verifier":[164],"filtering,":[165],"category-wise":[166],"failure":[167],"analysis,":[168],"adaptive":[170],"Random":[171],"Search":[172],"(RS)":[173],"jailbreak":[174],"attacks.":[175],"also":[177],"propose":[178],"layered":[180],"defense":[181],"system,":[182],"as":[183],"prototype":[185],"detector":[186],"real-time":[188],"drift":[190],"in":[191],"deployments.":[193],"Our":[194],"findings":[195],"show":[196],"benign-only":[198],"exposes":[201],"practical":[203],"under-recognized":[205],"threat:":[206],"adversaries":[207],"can":[208],"cheaply":[209],"replicate":[210],"LLM":[212],"capabilities":[213],"stripping":[215],"mechanisms,":[217],"underscoring":[218],"need":[220],"extraction-aware":[222],"monitoring.":[224]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-08-26T07:47:46.906454","created_date":"2025-12-12T00:00:00"}