How To Catch a Distilled Model
> "Distillation is great until your new trillion-dollar sovereign AI introduces itself as 'Claude from Anthropic' on day one." > > - random guy from Reddit TLDR * We introduce a novel algorithm to detect distillation across large language models. * We provide evidence suggesting this approach can be applied to logit-based and hard-label distillation. * We provide evidence that this algorithm embeds hidden signatures into the token distribution of the model whilst not changing any downstream capabilities. * We discuss the implications and potential large-scale applications for this approach. Introduction On February 23, 2026, Anthropic published an article titled Detecting and preventing distillation attacks [1], which provides substantial evidence on why Anthropic strongly believes their frontier models were distilled by Chinese open-source weights. Since then, many researchers have voiced concerns about distillation and its large-scale implications. At the time of writing this article, there is no specific government law that prohibits distillation. Still, frontier labs such as OpenAI, Anthropic, and Google explicitly prohibit the use of their outputs to train competing models in their Terms of Service. As authors of this post, we strongly advocate against such unlawful means of training models to exhibit similar behaviour to frontier counterparts. This article will not go in depth about regulatory policies surrounding distillation nor about the moral implications; instead, we will introduce a novel algorithm to give frontier models hidden signatures that can transfer to student models during distillation using both logit-based and hard label approaches. We show that if model X has been truly distilled from model Y, our approach can identify unique signatures in model X pointing towards model Y. We hope that our contribution can be helpful to those in the research community who are worried about distillation in general. While this approach cannot st