🤖 AI

Asking Back: Interaction-Layer Antidistillation Watermarks

This paper proposes "interaction-layer antidistillation watermarks," a novel defense mechanism that embeds detectable behavioral markers into an LLM's system prompts to reliably trace unauthorized knowledge distillation even when attackers paraphrase or strip traditional token-level signals, demonstrating high transferability across diverse student models and minimal impact on user experience.

Original authors: Guang Yang, Amir Ghasemian, Fengchen Liu, Zhong Wang, Ninareh Mehrabi, Homa Hosseinmardi

Published 2026-05-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Guang Yang, Amir Ghasemian, Fengchen Liu, Zhong Wang, Ninareh Mehrabi, Homa Hosseinmardi

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Problem: The "Phantom Student"

Imagine a famous chef (the Teacher) who works in a high-end restaurant. They have a secret recipe book that no one else can see. A sneaky competitor (the Attacker) can't steal the book, but they can order every dish on the menu, write down exactly what the chef says and how they serve it, and then hire a junior cook (the Student) to memorize those notes.

The junior cook becomes so good at copying the dishes that they can open their own restaurant and sell the same food, without ever having seen the original recipe book or paid the chef. This is called unauthorized knowledge distillation.

The chef wants to know: "Is that new restaurant using my recipes?"

The Old Solutions: Marking the Food

Previously, chefs tried to catch the thief by putting invisible ink in the food itself.

The Token Watermark: The chef would secretly change the way they chopped vegetables or arrange the garnish (changing the specific words or "tokens" in the AI's response).
The Problem: If the thief is smart, they can just re-plate the dish. They can take the chef's description, rewrite it in their own words (paraphrasing), and serve it again. The invisible ink is washed away, but the taste (the knowledge) remains. The thief gets away with it.

The New Idea: The "Asking Back" Watermark

This paper proposes a new strategy. Instead of marking the food (the text), the chef marks the conversation (the interaction).

Imagine the chef has a rule: "After serving every dish, I must ask the customer one follow-up question, like, 'Is this for a birthday party or a business lunch?'"

The Strategy: The chef (the AI API) is given a hidden instruction to occasionally ask these follow-up questions.
The Theft: The thief records the chef's answers and the questions. They train their junior cook to copy this behavior.
The Catch: Even if the thief rewrites the chef's answers in their own words, the junior cook learns that "good service" includes asking a follow-up question. So, the junior cook starts asking those questions too, even though they never saw the original chef.

The defender (the original chef) can then visit the new restaurant, ask a question, and see if the junior cook asks a follow-up question back. If they do, it's a strong sign they stole the training data.

How They Tested It

The researchers set up a massive experiment to see if this "asking back" trick works.

The Setup: They used a giant, smart AI (Llama-3.3-70B) as the "Chef." They trained three different types of smaller AIs (Gemma, OLMo, and Qwen) to copy the Chef.
The Conditions:
- Strong: The Chef asked a follow-up question every single time.
- Soft: The Chef asked a follow-up question only about 20% of the time (to make it harder to spot).
- Style: Instead of a question, the Chef added a helpful tip like, "This works best when you're in a hurry."
The Attack: They simulated a thief who rewrites the Chef's prompts before training the student (a "paraphrase attack").

What They Found (The Results)

It Works (H1 & H2): The smaller AIs learned the behavior perfectly. Even when the Chef only asked questions 20% of the time, the students started asking them too, at a much higher rate than normal. This happened across all three different types of student AIs.
It Survives Rewriting (H3): Even when the thief tried to rewrite the prompts to hide the pattern, the students still kept the habit. Interestingly, one student model (OLMo) actually became better at asking the questions than the original Chef did after being trained on the paraphrased data.
It's Hard to Spot (H4 & H5):
- Low Density: The watermark worked even when the Chef only used it 20% of the time.
- Stealth: They asked 20 people to chat with the AI. The people didn't notice the difference. They rated the conversations with the "watermarked" AI just as happy as the normal ones. The extra questions didn't feel annoying or weird.

The "Secret Sauce" Analogy

Think of the old watermarks as painting a unique pattern on a brick. If you take the brick, sand it down, and paint over it, the pattern is gone.

This new method is like teaching the bricklayer a specific habit. If you teach a bricklayer to always tap the trowel three times before laying a brick, and then they build a wall for someone else, they will still tap the trowel three times. You can't sand that habit away just by repainting the wall. The "tap" is the behavior, not the paint.

The Conclusion

The paper concludes that looking at how an AI interacts (its behavior) is a powerful new way to catch thieves. It's a "fourth layer" of defense, sitting above the text, the model code, and the reasoning steps.

Good news: It's hard to remove, works on different types of AI, and doesn't annoy users.
Caveats: The study admits that if a thief is very smart and specifically tries to remove this specific behavior, they might still succeed. Also, the "super-learning" effect seen in one AI model (OLMo) might be a fluke specific to that model and needs more testing.

In short: If you want to know if an AI is a copycat, don't just look at what it says; listen to how it talks back. If it starts asking the same weird follow-up questions as the original, it's likely a student.

Technical Summary: Asking Back: Interaction-Layer Antidistillation Watermarks

Problem Statement

The proliferation of frontier language models served via black-box APIs has created a mature commercial threat: unauthorized knowledge distillation. Adversaries harvest prompt–response pairs from a teacher API, fine-tune a smaller student model, and deploy it without permission. Defending against this is difficult because the defender controls neither the attacker's training pipeline nor the teacher's internal logits (next-token distributions).

Existing antidistillation defenses operate on three primary layers, all of which share a vulnerability to pre-distillation rewriting:

Token-distribution layer: Perturbs next-token probabilities (e.g., green-list watermarks, cryptographic schemes).
Model layer: Edits the teacher model itself to embed signatures.
Reasoning-trace layer: Reorders or rewrites chain-of-thought traces.

Recent work demonstrates that attackers can paraphrase harvested responses before training, effectively stripping these surface-level signals while preserving the underlying knowledge transfer. This leaves a structural gap: even if a signal survives, it does not necessarily specify a distinctive, queryable behavior in the distilled student.

Methodology

This paper proposes a fourth, complementary locus for watermarking: the interaction layer. Instead of modifying token probabilities or model parameters, the defender wraps the teacher with a system prompt that intermittently induces a specific behavioral marker ( $B$ ).

The Asking-Back Mechanism

The defender implements a trigger policy ( $\Pi_B$ ) that selects a system prompt ( $s_B$ ) for a fraction ( $\rho$ ) of inputs. The system prompt instructs the teacher to exhibit a specific interaction behavior, such as:

STRONG (Explicit): Appending a follow-up question regarding the user's use case, environment, or intent.
SOFT (Low-density Explicit): The same follow-up question, but only for a $\sim20\%$ subset of prompts.
STYLE-CONTROL (Implicit): A declarative restatement or advisory phrase (e.g., "In practice, this works best when...") embedded in the response, also at $\sim20\%$ density.

An oblivious distiller, unaware of the trigger policy, trains a student on the harvested corpus. Because the behavioral marker is part of the response text the student is asked to imitate, the student inherits this behavior. The defender can later audit a suspected student via black-box queries, using an LLM-as-a-judge to detect the presence of the marker.

Formalization

The watermark is defined as a triple $(B, \Pi_B, \rho)$ , where $B$ is a marker function, $\Pi_B$ is the trigger policy, and $\rho$ is the induced marker rate. The paper introduces metrics for:

Transfer Rate ( $\tau$ ): The rate at which a student exhibits the marker on held-out data.
Relative Transfer ( $\tau_{rel}$ ): The student's rate normalized by the teacher's rate.
Paraphrase Robustness: Decomposed into a teacher-self ceiling ( $R_T$ , the teacher's retention under prompt-side paraphrasing) and a student-relative retention ( $R_{rel}$ , how well the student preserves the signal relative to the teacher's degradation).

Key Contributions

Problem Framing: The authors formalize the interaction-layer watermark and define behavioral counterparts to existing token-level metrics (green-list, radioactive data).
Scale: The study presents the broadest cross-family distillation watermarking evaluation to date, involving 63 LoRA-distilled students across three model families (Gemma, OLMo, Qwen) trained on a Llama-3.3-70B-Instruct teacher, with 35,343 judged samples.
Two-Level Paraphrase Robustness: The work characterizes robustness not as a single number but as a decomposition of teacher-inherited limits and student-specific retention, revealing that some students can preserve watermarks more reliably than the teacher itself under specific conditions.

Experimental Results

The evaluation covers five hypotheses ( $H1$ – $H5$ ) and several findings:

Learnability ( $H1$ ): Students trained on watermarked data exhibit the marker at rates substantially above baseline. In a within-family case study, a student trained on "STRONG" data achieved a 99.56% marker rate compared to a 5.09% baseline.
Cross-Family Generalization ( $H2$ ): The effect holds across three distinct model families. Relative transfer rates for the "STRONG" marker were 88.9% (Gemma), 80.9% (OLMo), and 45.2% (Qwen).
Paraphrase Robustness ( $H3$ ): When the user prompt is paraphrased (using DIPPER), the teacher's marker rate drops (e.g., from 90.9% to 60.4% for STRONG, a 66.4% retention). This sets a ceiling. However, student-relative retention varies:
- Gemma: 89% retention of the teacher's degraded rate.
- Qwen: 65% retention.
- OLMo Anomaly: OLMo exhibited 112% retention, preserving the watermark above the teacher's own degraded performance.
Density-Detectability ( $H4$ ): Even at low densities ( $\rho \approx 20\%$ ), detection rates are reliably above the per-family noise floor. For example, OLMo students trained on 20% density data showed a 31.99% detection rate (vs. 0.65% baseline), exceeding the teacher's own 17.85% rate on the same subset.
Stealth ( $H5$ ): An in-lab study ( $N=20$ ) using a pre-registered Latin-square protocol found that low-density markers (20% and 50%) did not significantly degrade user-perceived interaction quality. All marker variants remained within 0.22 Likert steps of the baseline.
Implicit Transfer (F-Style): The "STYLE-CONTROL" marker (declarative, non-interrogative) also transferred reliably (4.1x to 7.9x baseline), demonstrating that the mechanism relies on interaction-level discourse rather than specific syntactic forms like question marks.

Significance and Claims

The paper claims that the interaction layer is a viable design locus for antidistillation watermarking, offering a complementary audit channel to token-, model-, and reasoning-trace defenses.

Complementary Failure Modes: While token-level signals are vulnerable to response-level rewriting, and reasoning traces are vulnerable to structural reordering, interaction-layer signals (behavioral tendencies) appear robust to prompt-side paraphrasing and survive distillation as learned discourse competencies.
Behavioral Transfer: The results suggest that distillation preferentially preserves structural regularities and discourse-level competencies (like "asking back") over surface-level token statistics.
Practical Viability: The study demonstrates that low-density watermarks can be deployed without degrading user experience, providing a practical method for auditing unauthorized distillation via black-box queries.

The authors remain modest regarding the scope, noting that the current threat model focuses on non-adaptive, prompt-side paraphrasing. They identify response-side rewriting and adaptive attacks as open problems for future work. Additionally, the "amplification" effect observed in OLMo (where the student outperforms the teacher) is treated as a single-family observation requiring further empirical grounding rather than a universal property.