Paper deep dive
Protecting the Trace: A Principled Black-Box Approach Against Distillation Attacks
Max Hartman, Vidhata Jayaraman, Moulik Choraria, Lav R. Varshney
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 95%
Last extracted: 6/21/2026, 6:27:10 AM
Summary
The paper proposes 'TraceGuard', a black-box, post-generation method to protect frontier large language models (LLMs) from distillation attacks. The authors formalize the problem of 'antidistillation' as a Stackelberg game, specifically a bi-level optimization problem where a defender seeks to maximize the minimum error across potential student architectures. Unlike previous methods like Antidistillation Sampling (ADS) or Defensive Output Generation (DOGe) which often require heavy fine-tuning or proxy models, TraceGuard focuses on poisoning high-importance 'thought anchors' or branching tokens in reasoning traces. This approach aims to degrade student model performance while maintaining the teacher model's performance and the grammatical coherence of the reasoning traces.
Entities (7)
Relation Signals (5)
TraceGuard → isatypeof → Antidistillation
confidence 100% · we propose TraceGuard, an efficient, post-generation black-box method to poison sentences...
Antidistillation → isformulatedas → Stackelberg game
confidence 100% · we present a theoretical formulation of antidistillation as a Stackelberg game
Antidistillation Sampling → isaspecialcaseof → Stackelberg game
confidence 95% · existing methods such as Antidistillation Sampling... arise as special cases of this formulation
Defensive Output Generation → isaspecialcaseof → Stackelberg game
confidence 95% · existing methods such as... Defensive Output Generation arise as special cases of this formulation
TraceGuard → targets → Thought Anchors
confidence 90% · TraceGuard... poisons sentences anchored at key branching tokens
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Frontier models push the boundaries of what is learnable at extreme computational costs, yet distillation via sampling reasoning traces exposes closed-source frontier models to adversarial third parties who can bypass their guardrails and misappropriate their capabilities, raising safety, security, and intellectual privacy concerns. To address this, there is growing interest in building antidistillation methods, which aim to poison reasoning traces to hinder downstream student model learning while maintaining teacher performance. However, current techniques lack theoretical grounding, requiring either heavy fine-tuning or access to student model proxies for gradient based attacks, and often lead to a significant teacher performance degradation. In this work, we present a theoretical formulation of antidistillation as a Stackelberg game, grounding a problem that has so far largely been approached heuristically. Guided by the desired design properties our formulation reveals, we propose \texttt{TraceGuard}, an efficient, post-generation black-box method to poison sentences with high importance for teacher reasoning. Our work offers a scalable solution to share model insights safely, ensuring that the advancement of reasoning capabilities does not come at the cost of intellectual privacy or AI safety alignment.
Tags
Links
- Source: https://arxiv.org/abs/2604.23238v1
- Canonical: https://arxiv.org/abs/2604.23238v1
Trouble viewing inline? Open PDF directly →
Full Text
58,400 characters extracted from source content.
Expand or collapse full text
Protecting the Trace: A Principled Black-Box Approach Against Distillation Attacks Max Hartman Vidhata Jayaraman Moulik Choraria Lav R. Varshney Abstract Frontier models push the boundaries of what is learnable at extreme computational costs, yet distillation via sampling reasoning traces exposes closed-source frontier models to adversarial third parties who can bypass their guardrails and misappropriate their capabilities, raising safety, security, and intellectual privacy concerns. To address this, there is growing interest in building antidistillation methods, which aim to poison reasoning traces to hinder downstream student model learning while maintaining teacher performance. However, current techniques lack theoretical grounding, requiring either heavy fine-tuning or access to student model proxies for gradient based attacks, and often lead to a significant teacher performance degradation. In this work, we present a theoretical formulation of antidistillation as a Stackelberg game, grounding a problem that has so far largely been approached heuristically. Guided by the desired design properties our formulation reveals, we propose TraceGuard, an efficient, post-generation black-box method to poison sentences with high importance for teacher reasoning. Our work offers a scalable solution to share model insights safely, ensuring that the advancement of reasoning capabilities does not come at the cost of intellectual privacy or AI safety alignment. Machine Learning, ICML, Adversarial Distillation, Antidistillation 1 Introduction Reasoning in large language models (LLMs) has led to significant performance improvements on difficult multi-step reasoning tasks such as mathematics, software debugging, and general strategic planning (OpenAI, 2024; Qwen, 2024; Anthropic, 2026a). In addition to these performance gains, reasoning traces provide practical insights into how answers are generated, improving the trustworthiness of models for users. However, providing full reasoning traces poses a security challenge: while knowledge distillation via reasoning traces was proposed to improve training efficiency (Hsieh et al., 2023; Mukherjee et al., 2023), distilled models have since been shown to match and even surpass their teachers at a fraction of the cost (Guo et al., 2025), raising significant intellectual privacy concerns for frontier labs competing at the edge of learnability (Anthropic, 2026b). These concerns are now reaching the forefront of United States national policy, with recent legislative proposals explicitly targeting the extraction of capabilities from closed-source AI models (119th Congress, 2026; Kratsios, 2026) that essentially circumvent export controls on compute. Furthermore, from a safety perspective, recent work has shown that distilled models often lose the safety alignment trained into the teacher model (Jahan and Sun, 2025; Shi et al., 2026). This creates a direct pathway from publicly exposed reasoning traces to unmoderated, potentially dangerous models. Methods have been proposed to mitigate this risk (Savani et al., 2025; Ma et al., 2026; Li et al., 2025; Ma et al., 2026). While these defensive techniques represent a significant step forward, they are currently bottlenecked by three primary constraints: computational overhead from retraining either the teacher or training an additional model used in the system; a noticeable degradation in the teacher model’s final output performance; and unacceptable level of incoherence in the sampled reasoning trace. In addition to the practical limitations, the theoretical foundations of distillation defense methods remain significantly underexplored as current approaches largely lack any formal guarantees necessary for reliable deployment. In this work, we cast antidistillation in a game-theoretic framework, taking a step toward closing this gap. We then show that existing methods such as Antidistillation Sampling and Defensive Output Generation arise as special cases of this formulation, while drawing attention on an important yet overlooked aspect of the problem: detectability. Factoring in the need to maintain teacher performance and trace coherence, we then ask a natural next question: under these constraints, where and how should a defender intervene? We draw on recent work in LLM interpretability, which has shown that specific tokens in reasoning traces are disproportionately important to the model output and reasoning flow. For example, certain sentences have been shown to have a significant importance in the way reasoning trajectories are generated, known as thought anchors (Bogdan et al., 2025). Additionally, high entropy tokens have been shown to have similar properties (Wang et al., 2025). Guided by these findings, we propose TraceGuard, a training-free, black-box method that poisons sentences anchored at key branching tokens, degrading student post-distillation accuracy while preserving teacher performance and trace coherence. To summarize, our contributions are as follows: 1. We provide an improved formulation of the antidistillation task as a bi-level optimization problem, with the goal of motivating future cryptography and security work from a theoretical perspective. We provide intuition via a security-motivated poisoning method to justify why poisoning fewer tokens makes a poisoning method less detectable. 2. We argue that poisoning branching tokens is an effective way to cause student degradation with a small token poisoning budget. We propose a method to efficiently poison these tokens, while maintaining grammatical coherence in the poisoned trace. This is demonstrated through experiments comparing the degradation versus tokens poisoned. 2 Related Work 2.1 Antidistilation Antidistillation techniques aim to prevent adversarial model distillation attacks by modifying a teacher’s outputs to be poor training data for the student. Savani et al. (2025) proposed antidistillation sampling (ADS), which perturbs the next-token probability distribution of the teacher model by encouraging the generation of tokens to degrade a student model, via a proxy model. Ma et al. (2026) proposed a prompting approach, which instructs the LLM to generate less distillation-friendly reasoning traces, and a gradient-based approach, which perturbs tokens post-generation to maximize test loss on a proxy model. The Defensive Output Generation (DOGe) method (Li et al., 2025) finetunes the teacher model’s final layer with a loss to prevent student learning. Ding et al. (2025) finetunes an LLM to remove self-talk tokens from the reasoning trace. We build upon these works by developing a game-theoretic formulation of the problem and proposing a method that addresses the gaps we observe in these works. 2.2 Reasoning in LLMs Chain-of-thought (CoT) reasoning, in which models are trained to generate intermediate reasoning steps, emerged in recent years as a technique to improve the performance of models on complex multi-step tasks (Wei et al., 2022). The Tree-of-thought (ToT) technique generalized and improved CoT by enabling LLMs to consider different reasoning paths (Yao et al., 2023). Reinforcement learning post-training with human-annotated reasoning data was used as an approach to distill reasoning capabilities models. Reinforcement learning without human-labeled data was then proposed (OpenAI, 2024; Qwen, 2024). Recently, models have been trained to learn reasoning by distilling knowledge from a large reasoning model, such as the R1-distill series (Guo et al., 2025). 2.3 Data Poisoning Data poisoning is an integrity attack on the training phase of machine learning models. These types of attacks manipulate the distribution of training data itself to harm the model according to an objective determined by the attacker (Fan et al., 2022). Early work on the topic started with these attacks on support vector machines and neural networks (Biggio et al., 2012; Shafahi et al., 2018). These attacks have also been shown effective against LLMs (Carlini et al., 2024; Souly et al., 2025). Our work shows that antidistillation can be formulated in a very similar manner to data poisoning, where the roles of the attack and defender are flipped. 3 A Game-Theoretic Formulation of Antidistillation 3.1 Notation D denotes the clean reference dataset; D~ D denotes a candidate poisoned dataset drawn from an admissible perturbation set ℬB around D; θT _T and θS _S denote the teacher and student parameters with corresponding parameter spaces ΘT _T and ΘS _S; and ℒ~ L and ℒL denote the training loss on D~ D and evaluation loss on D, respectively. 3.2 Formulation In prior literature, antidistillation techniques have primarily focused on minimizing the utility of distilling from reasoning traces while preserving teacher performance. However, any practical defense must also account for detectability: if an attacker can identify that a defense is in place, they can adapt their sampling strategy to evade it. In this section, we formalize the antidistillation problem and show how our general setting naturally handles both concerns. We motivate our framework by first analyzing the related problem of data poisoning, in which an adversary injects corrupted examples into a training set such that any model trained on it performs poorly at test time. The adversary is constrained to perturbations that remain close to legitimate data, so that the attack is not trivially detectable. This interaction can be viewed as a Stackelberg game, stated formally in Appendix A. We find that antidistillation fits this template closely: a model provider releases outputs (the “dataset”) that a third party uses to train a student model, and the provider would like those outputs to be useful to legitimate users while being maximally unhelpful as training data for the student. The bi-level structure carries over directly. That said, antidistillation differs from classical data poisoning in two important ways. First, the architecture of the downstream model to be poisoned is not necessarily a priori known. Previous methods typically assume access to a proxy model (Savani et al., 2025; Li et al., 2025), however such an assumption may fail to hold. As such, instead of just maximizing the harm caused to the optimal model trained on the poisoned data, the goal of antidistillation is to maximize the minimum error across all potential architectures by optimizing the poison in the training data. Second, as a conceptual difference in this setting, the roles of the attacker and defender are flipped from the classical data poisoning formulation: the defender is poisoning the data whereas the attacker is training the optimal model from the poisoned data. This gives rise to a slightly different Stackelberg game, where the defender is concerned with maximizing the loss over all allowed architectures rather than maximizing the loss over a specific known architecture. This is because the attacker has a priori chosen a specific architecture to finetune; however, the defender does not know that choice of architecture. Formally, the defender seeks a robust poisoned dataset D~T∗ D_T^* such that D~T∗=argmaxD~T∈ℬ(D;θT,ΘT)infℋ∈ℱx∼pdata[ℒ(hℋ∗(D~T);x)], D_T^*= _ D_T (D; _T, _T) _H E_x p_data [L(h_H^*( D_T);x) ], where ℬ(D;θT,ΘT)B(D; _T, _T)111For convenience, this set will be denoted as ℬB for the remainder of this paper. is the set of admissible poisoned datasets which can depend on the original dataset produced by the teacher D, on the teacher’s parameters θT _T, and on the architecture of the teacher ΘT _T. Additionally, ℱF is the set of admissible function classes (e.g. model architectures), pdatap_data is the true data distribution, and ℒL is the population loss function. Here, hℋ∗(D~T)h_H^*( D_T) is defined as hℋ∗(D~T):=arginfh∈ℋℒ~(h;D~T).h_H^*( D_T):= _h L(h; D_T). In contrast to this robust formulation for the defender, the attacker’s objective is simply hℋs∗(D~T)=arginfh∈ℋsL~(h;D~T),h_H_s^*( D_T)= _h _s L(h; D_T), where the attacker wants to minimize, for their specific architecture ℋsH_s, the loss on the poisoned dataset. This formulation provides the defender with a strict theoretical guarantee: as long as the attacker’s true architecture satisfies ℋs∈ℱH_s , the actual population loss accrued, x∼pdata[ℒ(hℋs∗(D~T∗);x)]E_x p_data [L (h_H_s^* ( D_T^* );x ) ], is bounded from below by the solution to the robust max-inf objective in (1). The above game gives rise to the following robust optimization formulation of antidistillation (from the defender’s perspective): D~T=argmaxD~T∈ℬinfℋ∈ℱx∼pdata[ℒ(hℋ∗(D~T);x)]. D_T= _ D_T _H E_x p_data [L (h_H^* ( D_T );x ) ]. (1) Remark 3.1. Observe that (1) fundamentally differs from formulating the problem as directly evaluating the empirical risk minimizer over the entire function space: D~T=argmaxD~T∈ℬx∼pdata[ℒ(arginfh∈ℱℒ~(h;D~T);x)]. D_T= _ D_T E_x p_data [L ( _h L (h; D_T );x ) ]. If ℱF is sufficiently expressive, directly evaluating arginfh∈ℱ _h allows the model to perfectly memorize the poisoned dataset D~T D_T while performing arbitrarily poorly on the true distribution pdatap_data. This makes the defender’s task trivial. By placing the infℋ∈ℱ _H outside the population loss, we impose a stricter, more realistic burden on the defender: it must find a universal poison that maximizes the generalization error against the most resilient admissible architecture, rather than merely exploiting a hypothetical overfit model. Remark 3.2. In practice, most constraint sets ℬ(D;θT,ΘT)B(D; _T, _T) will take the form ℬϵ(D;θT):=D~T:d(D~T(θ~T),D(θT))≤ϵ,θ~T∈ΘT, _ε(D; _T):= \ D_T:d( D_T( θ_T),D( _T))≤ε,\, θ_T∈ _T \, where θT∈ΘT _T∈ _T, d is some distortion measure between the perturbed dataset D~T D_T, which is perhaps a function of some perturbed teacher model θ~T θ_T, and D, which is a function of θT _T. This distortion measure allows one to capture both the difference in performance of the perturbed dataset (or perturbed teacher model) and the detectability of the proposed antidistillation method. 3.3 Instantiations of the Antidistillation Game Within this subsection, we go through consequences of two specific instantiations of the antidistillation game with respect to ℱF. 3.3.1 Student Architecture is Known We first consider the simplest case where ℱ=ℋF=\H\. In this case the antidistillation problem (1) simplifies to D~T=argmaxD~∈ℬx∼pdata[ℒ(arginfh∈ℋℒ~(h;D~T);x)]. D_T= _ D E_x p_data [L ( _h L (h; D_T );x ) ]. (2) The antidistillation problem in this case reduces to the data poisoning problem, described in Appendix A. When the student model architecture is a priori known, literature from data poisoning can be used to adequately determine the “best” poisoning policy. 3.3.2 Defender has Prior over Architectures Often, defenders will have some prior PℱP_F, which describes the likelihood different model architectures are for distillation attacks. For example, a defender may assign a very high probability to Transformer-based architectures, thus encoding useful information to make their defense stronger. Concretely, the space of allowable student architectures may be finite, thus allowing the defender to construct the following probability space (ℱ,2ℱ,Pℱ)(F,2^F,P_F). We note that in practice, one would have to imbue the space of all admissible student architectures with a σ-algebra, which may be non-trivial. Regardless, this permits the following relaxation of (1): D~T D_T =argmaxD~T∈ℬℋ∼Pℱ[x∼pdata[ℒ(hℋ∗(D~T);x)]] = _ D_T E_H P_F [E_x p_data [L (h_H^* ( D_T );x ) ] ] (3) =argmaxD~T∈ℬ(ℋ,x)∼Pℱ⊗pdata[ℒ(hℋ∗(D~T);x)]. = _ D_T E_(H,x) P_F p_data [L (h_H^* ( D_T );x ) ]. (4) 222Assuming ℒL is non-negative and measurable, since PℱP_F and pdatap_data are independent this follows by Fubini’s theorem. Also, observe that maxD~T∈ℬinfℋ∈ℱx∼pdata[ℒ(hℋ∗(D~T);x)] _ D_T _H E_x p_data [L (h_H^* ( D_T );x ) ] ≤ ≤ maxD~T∈ℬ(ℋ,x)∼Pℱ⊗pdata[ℒ(hℋ∗(D~T);x)], _ D_T E_(H,x) P_F p_data [L (h_H^* ( D_T );x ) ], meaning that this is an upper-bound relaxation of the original worst-case, max max-min objective. However, the Bayesian setting may still be more practically useful as a defender will often have some prior on the feasible student architectures. Remark 3.3. This Bayesian reframing transforms the original purely adversarial game into a Bayesian Robust Stackelberg game, where the defender maximizes their expected payoff against a known distribution of attacker types. 3.4 Generalization of Previous Antidistillation Methods The main distinction between different antidistillation methods is how they instantiate the set of admissible perturbations of the dataset D and in what they consider the set of viable student architectures. In the remainder of this subsection, we show how both Antidistillation Sampling (Savani et al., 2025) and Defensive Output Generation (Li et al., 2025) fit into the framework of (1). 3.4.1 Antidistillation Sampling ADS proceeds in an online antidistillation fashion, where individual teacher outputs are given per user query. Their formulation is a greedy approach to the outer maximization over D~T D_T, where they try to maximize the loss of each individual teacher output. ADS considers the following perturbation to the teacher output distribution: p~(⋅∣x1:t;θT):=1Zexp( p(· x_1:t; _T):= 1Z ( 1τlogp(⋅∣x1:t;θT) 1τ p(· x_1:t; _T) +λΔ(⋅∣x1:t;θP)), +λ (· x_1:t; _P) ), where Z is a normalization factor, τ is the sampling temperature, p(⋅∣x1:t;θT)p(· x_1:t; _T) is the original teacher distribution for token t+1t+1, λ is a scaling hyperparameter and Δ is a perturbation to the output distribution determined by the gradients of a proxy model.333Δ(⋅∣x1:t;θP)=ℓ(θP+)−ℓ(θP)=ℓ(θP+η∇θPlogp(xt+1∣x1:t;θP))−ℓ(θP) aligned (· x_1:t; _P)&= ( _P^+)- ( _P)\\ &= ( _P+η _ _P p(x_t+1 x_1:t; _P))- ( _P) aligned Thus, the set of admissible perturbations is the following, ℬADS(D;θT)=x~i:x~i∼p~(⋅∣x1:t;θT)i=1n. _ADS(D; _T)= \ x_i: x_i p(· x_1:t; _T) \_i=1^n. (5) 3.4.2 Defensive Output Generation DOGe proposes that the task of antidistillation can be framed as the following bi-level optimization problem. The defender controls the teacher’s parameters to maximize its performance while weakening any student distilled from its outputs. The optimization problem is thus: θT∗=argmaxθT[Perf(θT)−λ⋅Perf(θS∗)] θ^*_T= _ _T [Perf( _T)-λ·Perf (θ^*_S ) ] θS∗=argminθSℒ(θS;DKD(θT)), θ^*_S= _ _SL( _S;D_KD( _T)), where Perf(⋅)Perf(·) is the performance of the input model, DKD_KD is the outputs of the teacher model θT∗θ^*_T, and λ>0λ>0 is a scaling hyperparameter. We connect this to our formulation in (1) by first defining ℬDOGe(D;θT,ΘT) _DOGe(D; _T, _T) (6) =D~T:D~T∼p(⋅∣θT),θT∈ΘT,Perf(θT)≥τ. = \ D_T: D_T p(· _T), _T∈ _T,Perf( _T)≥τ \. (7) If we now consider the case where |ℱ|=1|F|=1, (1) simplifies to D~T D_T =argmaxD~T∈ℬDOGex∼pdata[−Perf(θS∗(D~T);x)]. = _ D_T _DOGeE_x p_data [-Perf( _S^*( D_T);x) ]. Since the dataset entirely depends on the parameters θT _T we can determine D~T D_T equivalently by finding θT∗=argmaxθT∈ΘT,Perf(θT)≥τx∼pdata[−Perf(θS∗(D~T);x)], _T^*= _ _T∈ _T,Perf( _T)≥τE_x p_data [-Perf( _S^*( D_T);x) ], and taking a Lagrangian relaxation of this problem yields θT∗=argmaxθT∈ΘTPerf(θT)−λPerf(θS∗(θT)) _T^*= _ _T∈ _TPerf( _T)- ( _S^*( _T)) which is exactly the DOGe framework. 3.5 A Gaussian Case Study The prior works, ADS and DOGe, perturb the teacher’s output distribution (within some λ ball) at every token position, analogous to ℓ2 _2 attacks on images (Moosavi-Dezfooli et al., 2016; Madry et al., 2019) in the adversarial robustness literature. However, a well-established finding from this area is that sparse, targeted perturbations can be equally effective while being harder to detect. One-pixel attacks (Su et al., 2017) and the Jacobian-based Saliency Map Approach (JSMA) (Wiyatno and Xu, 2018) demonstrate that perturbing a small number of carefully chosen input dimensions suffices to fool classifiers, often with greater success than uniform perturbation at equivalent total distortion budgets. Motivated by this analogy, we ask: what are the theoretical properties of an antidistillation method that modifies only k≪Lk L tokens in a reasoning trace of length L? To study this, we consider a simple Gaussian perturbation scheme that admits closed-form detectability bounds. Specifically, we consider the following constraint set ℬB. Let D=x(i)i=1nD=\x^(i)\_i=1^n be the clean dataset generated by teacher model θT _T where each output is a sequence of length LiL_i (i.e. x(i)=(x1(i),…,xLi(i))x^(i)=(x_1^(i),…,x_L_i^(i))). Let fθT(x<t)∈ℝ||f_ _T(x_<t) ^|V| denote the pre-softmax logits of the teacher model at step t over a vocabulary V. We define the constraint set ℬη,k(D;θT)B_η,k(D; _T) as the set of all D~T=x~(i) D_T=\ x^(i)\ such that the following conditions hold for every sequence i∈1,…,Ni∈\1,…,N\: 1. There exists a mask of chosen token indices M(i)⊂1,…,LiM^(i)⊂\1,…,L_i\ such that |M(i)|≤k|M^(i)|≤ k 2. For all t∉M(i)t∉ M^(i), the original token is perfectly preserved (i.e. x~(i)=x(i) x^(i)=x^(i)). 3. For all t∈M(i)t∈ M^(i), the perturbed token x~(i) x^(i) is sampled from the following perturbed distribution x~(i)∼softmax(fθT(x<t(i))+ξt),where ξt∼(0,σ2I) x^(i) (f_ _T(x_<t^(i))+ _t),\;where _t (0,σ^2I) 4. We have the following bound on the variance σ2σ^2 σ2≤2ηkσ^2≤ 2ηk We can see that since the constraint set perturbs some set of k tokens post-generation, the performance of the teacher model can be perfectly maintained by not perturbing the answer token(s). Broadly, the set of admissible architectures could be some set of known LLM architectures. Because we are restricting to autoregressive models, if token t is poisoned in this way, then the student model will be attempting to learn noise when it predicts token t from the previous t−1t-1 tokens. As such, this will likely degrade student performance. Thus, the main concern will be the detectability of this method. In Proposition 3.4 and Corollary 3.5 we provide results on the detectability of this method as measured by the expected Kullback-Leibler divergence between the perturbed distribution used and the original teacher distribution. Proposition 3.4. Let z∈ℝVz ^V be a vector of logits defining a teacher distribution PT=softmax(z)P_T=softmax(z). Let ϵ∈ℝVε ^V be a random noise vector satisfying [‖ϵ‖22]=σ2E[\|ε\|_2^2]=σ^2, and define the perturbed distribution P=softmax(z+ϵ)P_P=softmax(z+ε). Then ϵ[DKL(P∥PT)]≤σ22.E_ε\! [D_KL(P_P\,\|\,P_T) ]\;≤\; σ^22. Proof. Rewriting the KL divergence between the two softmax distributions as the Bregman divergence generated by the log-sum-exp function Φ , its integral form expresses the KL as a path integral of ϵ⊤∇2Φϵε ∇^2 \,ε, which is a variance under the intermediate softmax and hence bounded by ‖ϵ‖22\|ε\|_2^2. Evaluating ∫01tt=12 _0^1t\,dt= 12 and taking expectation with ‖ϵ‖22=σ2E\|ε\|_2^2=σ^2 yields the bound σ2/2σ^2/2. See full proof in Appendix D. ∎ This shows that the divergence of a single next-token distribution is bounded proportionally to the variance of the perturbation noise. In the following corollary, we show that the expected divergence for some k independent tokens is bounded proportionally to the number of tokens and noise added to each token. Corollary 3.5. If ϵ(i)∈ℝVε^(i) ^V is applied to k independent tokens with [‖ϵ(i)‖]≤σ2E[\|ε^(i)\|]≤σ^2, ∀i∀ i then ϵ[DKL(P∥PT)]≤kσ22.E_ε\! [D_KL(P_P\,\|\,P_T) ]\;≤\;k σ^22. Proof. Since the k noisy token distributions are conditionally independent given the unchanged context, the joint KL divergence factorizes into a sum of k per-token KL divergences. We can then apply the previous proposition to each term bounds the total by kσ2/2kσ^2/2 (proof in Appendix D). ∎ The main takeaway is that for any dataset in ℬη,k(D;θT)B_η,k(D; _T) such that the mask tokens are chosen independently, the detectability is less than η. As the divergence between the perturbed distribution grows linearly with k, this shows that using a method which modifies fewer tokens will be less detectable by an attacker. This will serve as the guiding design principle for our method in the next section. 4 Method Figure 1: The figure shows a poisoned reasoning trace of a sample prompt from MATH (Hendrycks et al., 2021) using the Gaussian perturbation method described above and std=10. This poisoned trace has many grammatical errors. Figure 2: The figure shows a poisoned reasoning trace of a sample prompt from MATH (Hendrycks et al., 2021) using the Gaussian perturbation method described above using std=0.5=0.5. Many tokens which were poisoned did not modify the token from baseline because the poisoning to their logits was too small. 4.1 A Naive Approach to Sparse Perturbations While the Gaussian case study establishes that modifying fewer tokens reduces detectability, directly implementing ℬη,kB_η,k, that is, selecting k positions and adding Gaussian noise to their logits faces three obstacles. First, a noise intensity dilemma: large σ produces tokens that break grammatical coherence with unperturbed neighbors (Figure 1), while small σ is absorbed by the softmax and fails to change the sampled token at all (Figure 2). This tension is inherent to perturbing individual token logits while leaving adjacent tokens fixed. Second, combinatorial hardness: selecting which k of L tokens to perturb requires evaluating (Lk) Lk candidate subsets, each requiring a student training run to assess effectiveness. Even greedy approximations require backpropagation through a non-differentiable discrete sampling operation. Third, local detectability: although aggregate KL remains bounded by Corollary 3.5, a distiller can easily flag positions where the observed token does fit in the context of the sentence, leading to obvious incoherence. These limitations motivate a method that identifies structurally important positions without combinatorial search and perturbs them in a way that preserves local coherence. 4.2 Identifying Critical Reasoning Steps Rather than searching over (Lk) Lk token subsets, we leverage the finding that reasoning traces have highly non-uniform importance. Specifically, Bogdan et al. (2025) showed that a small fraction of sentences, termed thought anchors, have significant counterfactual importance on the final answer. These are predominantly planning sentences (e.g., “Alternatively, maybe I can calculate this in decimal”) and uncertainty management sentences (e.g., “Wait, I made a mistake”), while active computation sentences perform predetermined operations with minimal causal influence. Complementary work also shows that ∼20% 20\% of tokens are high-entropy “forks” that steer reasoning trajectories (Wang et al., 2025), and that replacing individual critical tokens can even flip model outputs (Lin et al., 2025). While these ideas do provide a clear starting point, a natural concern is whether removing these anchors from the teacher’s trace actually degrades student models trained via distillation, given that the teacher’s own answer is unaffected. To that end, recent work from Zhang et al. (2025) shows that activation patching at key reasoning tokens in distilled DeepSeek-R1 models reliably alters final answers, confirming that functional dependence on reasoning steps transfers through SFT. Since fine-tuning gradients are largest at the teacher’s most informative tokens (precisely the planning tokens within thought anchors), removing these sentences remove the highest-gradient training signals. Note that by targeting thought anchors, we also resolve the pitfalls listed in Section 4.1: there is no noise parameter to tune (sentences are either removed or retained), no combinatorial search (targets are identified by their semantic role), and no local incoherence (the removed sentences are self-reflective steps whose absence still preserves the logical flow of surrounding text). The method requires no proxy model, making it compatible with the robust formulation in (1) where ℋsH_s is unknown. 4.3 TraceGuard Algorithm 1 TraceGuard: Targeted Trace Poisoning 0: Reasoning trace D=s1,s2,…,snD=\s_1,s_2,…,s_n\, branching tokens S=“Wait”, “Hold on”, …S=\``Wait′, ``Hold on′, …\, removal budget k 0: Poisoned reasoning trace D~ D 1: Initialize D~←∅ D← 2: Initialize removedCount←0removedCount← 0 3: for all si∈Ds_i∈ D do 4: firstToken←GetFirstToken(si)firstToken← GetFirstToken(s_i) 5: if firstToken∈SfirstToken∈ S and removedCount<kremovedCount<k then 6: removedCount←removedCount+1removedCount +1 Remove anchor 7: else 8: Append sis_i to D~ D Keep sentence 9: end if 10: end for 11: Return D~ D Having established the case for targeting thought anchors, a practical challenge remains: the full receiver-head methodology of Bogdan et al. (2025) requires a forward pass with attention extraction per trace, which is computationally expensive. However, we observe empirically that high-importance sentences are strongly correlated with sentences beginning with characteristic discourse markers such as “Wait”, “Hold on”, and “Alternatively.” This lightweight keyword heuristic identifies thought anchors with reasonable accuracy at zero additional compute cost, and we adopt it as the basis for our proposed method, TraceGuard, formalized in Algorithm 1. Figure 3: Example trace poisoning with the TraceGuard method. Without explicitly searching for thought anchors, each sentence that gets poisoned by the method is a thought anchor (Bogdan et al., 2025). These sentences have been shown to disproportionately affect answer quality. The removal budget k, which denotes the maximum number of branching sentences that can be removed for each trace, is included so we can vary the poisoning intensity. We provide an example of our method poisoning a reasoning trace in Figure 3. 5 Experiments In the following experiments, we evaluate the distillation performance degradation using teacher traces both unaltered and protected with TraceGuard. We then evaluate how the accuracy changes when a student is distilled with these datasets. When poisoning, we vary the removal budget by searching for at most k=10,20,50k=10,20,50 reasoning sentences to remove in each trace. We report the accuracy drop from baseline to poisoned distillation versus the average number of tokens poisoned per trace. We use DeepSeek-R1-Distill-Qwen-7B as the teacher model, and Llama-3.2-3B, Llama-3.2-1B, and Gemma 3 1B as student models. Exact distillation training parameters and setup are provided in Appendix C. Because of these fundamental differences between our method and existing methods (training, modification of traces, etc), making a direct comparison would be unfair. The contribution of proposing this method is to show the importance of branching anchors in student distillation, and how removing them is a simple way to protect a teacher model from distillation attacks. Therefore, we evaluate two primary trends: the correlation between the number of poisoned reasoning sentence tokens and student distillation degradation, and comparative efficacy of our method against random sentence pruning. 5.1 Results Based on Figure 4, there is a positive relationship between the number of tokens in the poisoned branch sentences and the accuracy drop between baseline and poisoned distillation. We hypothesize that the reason such a trend is not seen for LLama 3.2 1B is because the baseline student accuracy is so low (7.78%) that poisoning traces has minimal effect (if the student model is already unable to learn from baseline traces, poisoning the traces will not have a substantial impact). Figure 4: Accuracy drop between baseline versus poisoned reasoning trace distillation for varying numbers of tokens poisoned trained on MATH (Hendrycks et al., 2021). Teacher used was DeepSeek R1 Distill Qwen 7B with accuracy an of 73.8%. Baseline distillation accuracy of LLama 3.2 3B was 20.9%, Gemma 3.1 1B was 20.1%, and Llama 3.2 1B was 7.78%. The max number of tokens generated per sample in all examples is 4096. Based on these results, there is a positive relationship between number of tokens in branching sentences poisoned and the accuracy drop. We hypothesize that the reason such a trend is not seen for LLama 3.2 1B is because the baseline student accuracy is so low that poisoning traces has minimal effect. The amount of student accuracy degradation scales sub-linearly. This suggests that poisoning more tokens only marginally increases degradation. Additionally, based on Corollary 3.5, the divergence of the perturbed and original distribution scales linearly with k. Thus, there is a trade-off between number of tokens poisoned and the detectability of the method. Future methods should ideally poison very few tokens to minimize detectability, while preventing student distillation. To verify that these results are due to branching sentences specifically (and not just from poisoning any sentences), we include an additional experiment in which we poison random reasoning trace sentences, and compare the accuracy drop between this trivial method and our branching sentence method. We include this study in Appendix B. 6 Discussion We present a general formulation of antidistillation as a robust bi-level optimization problem, showing how it subsumes both data poisoning as a special case and existing methods such as ADS and DOGe as specific instantiations. Our detectability analysis establishes that sparse perturbation, modifying fewer tokens, is provably less detectable, which motivates TraceGuard, a lightweight defense that removes thought anchor sentences from reasoning traces. We demonstrate its efficacy in a black-box setting, showing that it requires no proxy model, no teacher fine-tuning, and no additional forward passes, while preserving teacher accuracy by construction. Several directions remain open. Our detectability bounds assume independent token perturbations; extending these to the dependent setting and to sentence deletion (rather than token-level noise) would strengthen the theoretical grounding of TraceGuard. Our current method uses a keyword heuristic to approximate thought anchors, and a more precise identification method could yield stronger results, while motivating interpretability research into how students internalize reasoning structure during distillation. Finally, our formulation assumes the defender knows when an attacker is querying; incorporating side information about attack confidence into poisoning intensity is a natural extension. 7 Limitations The proposed antidistillation formulation is mainly used to motivate directional ideas for poisoning strategies. Here, (3.5) and (3.4) make the assumption that the tokens are independent, which is unrealistic in practice. The TraceGuard method’s key limitation is in its assumption that sentences starting with branching tokens in set S is a strong indicator that the sentence is a thought anchor. While reasoning literature suggests the importance of these tokens for output generation, which we discuss, directly detecting thought anchors directly would be a more-grounded approach to find important sentences. 8 Conclusion In this work, we provide a general formulation of Antidistillation as a bi-level optimization problem. We show how the data poisoning problem is a special case of the antidistillation problem. We show how this setup subsumes existing methods and provide preliminary detectability results on this problem. Based on recent LLM interpretability results and our detectability insights, we also propose the TraceGuard defense method as an efficient solution against distillation attacks. Our method protects important reasoning tokens and maintains teacher accuracy performance, while not finetuning the teacher model or using a proxy model to approximate the student. Impact Statement The problem studied in this work is very relevant to today’s global AI policy. Distillation attacks have been used to undermine the intellectual privacy of the teacher model provider and essentially circumvent export controls by lowering the computational bar to obtaining performant reasoning models. In the United States, this led to Bill HR8283 (119th Congress, 2026), deeming distillation attacks as a threat to the United States. As such, this problem is relevant with regards to AI regulations and policy. Additionally, given the literature suggesting safety alignment guardrails can be lost from distillation post-training (Li et al., 2026; Jahan and Sun, 2025; Shi et al., 2026), distillation attacks may be in conflict with AI safety guidelines around the world (National Information Security Standardization Technical Committee (TC260), 2023; European Parliament and Council of the European Union, 2024). References 119th Congress (2026) H.r. 8283 (ih) - deterring american ai model theft act of 2026. Technical report U.S. House of Representatives. Note: Introduced in House (IH) External Links: Link Cited by: §1, Impact Statement. Anthropic (2026a) Claude Opus 4.6 system card. Technical report Anthropic. Note: Accessed: 2026-04-11 External Links: Link Cited by: §1. Anthropic (2026b) Detecting and preventing distillation attacks. Note: https://w.anthropic.com/news/detecting-and-preventing-distillation-attacks Cited by: §1. B. Biggio, B. Nelson, and P. Laskov (2012) Poisoning attacks against support vector machines. In Proceedings of the 29th International Coference on International Conference on Machine Learning, ICML’12, Madison, WI, USA, p. 1467–1474. External Links: ISBN 9781450312851 Cited by: §2.3. P. C. Bogdan, U. Macar, N. Nanda, and A. Conmy (2025) Thought anchors: which llm reasoning steps matter?. External Links: 2506.19143, Link Cited by: §1, Figure 3, Figure 3, §4.2, §4.3. N. Carlini, M. Jagielski, C. A. Choquette-Choo, D. Paleka, W. Pearce, H. Anderson, A. Terzis, K. Thomas, and F. Tramer (2024) Poisoning Web-Scale Training Datasets is Practical . In 2024 IEEE Symposium on Security and Privacy (SP), Vol. , Los Alamitos, CA, USA, p. 407–425. External Links: ISSN , Document, Link Cited by: §2.3. J. Ding, L. Cui, L. Dong, N. Zheng, and F. Wei (2025) Information-preserving reformulation of reasoning traces for antidistillation. External Links: 2510.11545, Link Cited by: §2.1. European Parliament and Council of the European Union (2024) Regulation (EU) 2024/1689 of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act). L 2024/1689. Note: Art. 15: Accuracy, Robustness and Cybersecurity External Links: Link Cited by: Impact Statement. J. Fan, Q. Yan, M. Li, G. Qu, and Y. Xiao (2022) A survey on data poisoning attacks and defenses. In 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC), Vol. , p. 48–55. External Links: Document Cited by: §2.3. D. Guo, D. Yang, H. Zhang, J. Song, P. Wang, Q. Zhu, R. Xu, R. Zhang, S. Ma, X. Bi, X. Zhang, X. Yu, Y. Wu, Z. F. Wu, Z. Gou, Z. Shao, Z. Li, Z. Gao, A. Liu, B. Xue, B. Wang, B. Wu, B. Feng, C. Lu, C. Zhao, C. Deng, C. Ruan, D. Dai, D. Chen, D. Ji, E. Li, F. Lin, F. Dai, F. Luo, G. Hao, G. Chen, G. Li, H. Zhang, H. Xu, H. Ding, H. Gao, H. Qu, H. Li, J. Guo, J. Li, J. Chen, J. Yuan, J. Tu, J. Qiu, J. Li, J. L. Cai, J. Ni, J. Liang, J. Chen, K. Dong, K. Hu, K. You, K. Gao, K. Guan, K. Huang, K. Yu, L. Wang, L. Zhang, L. Zhao, L. Wang, L. Zhang, L. Xu, L. Xia, M. Zhang, M. Zhang, M. Tang, M. Zhou, M. Li, M. Wang, M. Li, N. Tian, P. Huang, P. Zhang, Q. Wang, Q. Chen, Q. Du, R. Ge, R. Zhang, R. Pan, R. Wang, R. J. Chen, R. L. Jin, R. Chen, S. Lu, S. Zhou, S. Chen, S. Ye, S. Wang, S. Yu, S. Zhou, S. Pan, S. S. Li, S. Zhou, S. Wu, T. Yun, T. Pei, T. Sun, T. Wang, W. Zeng, W. Liu, W. Liang, W. Gao, W. Yu, W. Zhang, W. L. Xiao, W. An, X. Liu, X. Wang, X. Chen, X. Nie, X. Cheng, X. Liu, X. Xie, X. Liu, X. Yang, X. Li, X. Su, X. Lin, X. Q. Li, X. Jin, X. Shen, X. Chen, X. Sun, X. Wang, X. Song, X. Zhou, X. Wang, X. Shan, Y. K. Li, Y. Q. Wang, Y. X. Wei, Y. Zhang, Y. Xu, Y. Li, Y. Zhao, Y. Sun, Y. Wang, Y. Yu, Y. Zhang, Y. Shi, Y. Xiong, Y. He, Y. Piao, Y. Wang, Y. Tan, Y. Ma, Y. Liu, Y. Guo, Y. Ou, Y. Wang, Y. Gong, Y. Zou, Y. He, Y. Xiong, Y. Luo, Y. You, Y. Liu, Y. Zhou, Y. X. Zhu, Y. Huang, Y. Li, Y. Zheng, Y. Zhu, Y. Ma, Y. Tang, Y. Zha, Y. Yan, Z. Z. Ren, Z. Ren, Z. Sha, Z. Fu, Z. Xu, Z. Xie, Z. Zhang, Z. Hao, Z. Ma, Z. Yan, Z. Wu, Z. Gu, Z. Zhu, Z. Liu, Z. Li, Z. Xie, Z. Song, Z. Pan, Z. Huang, Z. Xu, Z. Zhang, and Z. Zhang (2025) DeepSeek-r1 incentivizes reasoning in llms through reinforcement learning. Nature 645 (8081), p. 633–638. External Links: ISSN 1476-4687, Link, Document Cited by: §1, §2.2. D. Hendrycks, C. Burns, S. Kadavath, A. Arora, S. Basart, E. Tang, D. Song, and J. Steinhardt (2021) Measuring mathematical problem solving with the MATH dataset. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), External Links: Link Cited by: Figure 1, Figure 1, Figure 2, Figure 2, Figure 4, Figure 4. C. Hsieh, C. Li, C. Yeh, H. Nakhost, Y. Fujii, A. Ratner, R. Krishna, C. Lee, and T. Pfister (2023) Distilling step-by-step! outperforming larger language models with less training data and smaller model sizes. In Findings of the Association for Computational Linguistics: ACL 2023, A. Rogers, J. Boyd-Graber, and N. Okazaki (Eds.), Toronto, Canada, p. 8003–8017. External Links: Link, Document Cited by: §1. S. Jahan and R. Sun (2025) Black-box behavioral distillation breaks safety alignment in medical llms. External Links: 2512.09403, Link Cited by: §1, Impact Statement. M. J. Kratsios (2026) National security technology memorandum 4 (nstm-4): adversarial distillation of american ai models. Memorandum The White House, Office of Science and Technology Policy. Note: Memorandum for the Heads of Executive Departments and Agencies External Links: Link Cited by: §1. P. Li, Z. Tan, M. Zhang, H. Qu, H. Liu, and T. Chen (2025) DOGe: defensive output generation for llm protection against knowledge distillation. External Links: 2505.19504, Link Cited by: §1, §2.1, §3.2, §3.4. X. Li, H. Zhen, L. Yin, X. Yu, Z. Dong, and M. Yuan (2026) What matters for safety alignment?. External Links: 2601.03868, Link Cited by: Impact Statement. Z. Lin, T. Liang, J. Xu, Q. Lin, X. Wang, R. Luo, C. Shi, S. Li, Y. Yang, and Z. Tu (2025) Critical tokens matter: token-level contrastive estimation enhances llm’s reasoning capability. External Links: 2411.19943, Link Cited by: §4.2. X. Ma, W. Yeoh, N. Zhang, and Y. Vorobeychik (2026) Protecting language models against unauthorized distillation through trace rewriting. External Links: 2602.15143, Link Cited by: §1, §2.1. A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu (2019) Towards deep learning models resistant to adversarial attacks. External Links: 1706.06083, Link Cited by: §3.5. S. Moosavi-Dezfooli, A. Fawzi, and P. Frossard (2016) DeepFool: a simple and accurate method to fool deep neural networks. External Links: 1511.04599, Link Cited by: §3.5. S. (. Mukherjee, A. Mitra, G. Jawahar, S. Agarwal, H. Palangi, and A. Awadallah (2023) Orca: progressive learning from complex explanation traces of gpt-4. arXiv: Computation and Language. Cited by: §1. National Information Security Standardization Technical Committee (TC260) (2023) Cybersecurity technology—basic security requirements for generative artificial intelligence services (draft for feedback). Technical report National Information Security Standardization Technical Committee. Note: Accessed: 2026-04-22 External Links: Link Cited by: Impact Statement. OpenAI (2024) Learning to reason with llms. Note: Accessed: 2024-09-12 External Links: Link Cited by: §1, §2.2. Qwen (2024) QwQ: reflect deeply on the boundaries of the unknown. External Links: Link Cited by: §1, §2.2. Y. Savani, A. Trockman, Z. Feng, Y. E. Xu, A. Schwarzschild, A. Robey, M. Finzi, and J. Z. Kolter (2025) Antidistillation sampling. External Links: 2504.13146, Link Cited by: Appendix C, §1, §2.1, §3.2, §3.4. A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein (2018) Poison frogs! targeted clean-label poisoning attacks on neural networks. In Proceedings of the 32nd International Conference on Neural Information Processing Systems, NIPS’18, Red Hook, NY, USA, p. 6106–6116. Cited by: §2.3. H. Shi, G. Wang, T. Ouyang, and A. Wang (2026) EASE: practical and efficient safety alignment for small language models. Proceedings of the AAAI Conference on Artificial Intelligence 40 (44), p. 37923–37931. External Links: Link, Document Cited by: §1, Impact Statement. A. Souly, J. Rando, E. Chapman, X. Davies, B. Hasircioglu, E. Shereen, C. Mougan, V. Mavroudis, E. Jones, C. Hicks, N. Carlini, Y. Gal, and R. Kirk (2025) Poisoning attacks on llms require a near-constant number of poison samples. External Links: 2510.07192, Link Cited by: §2.3. J. Su, D. V. Vargas, and K. Sakurai (2017) One pixel attack for fooling deep neural networks. CoRR abs/1710.08864. External Links: Link, 1710.08864 Cited by: §3.5. S. Wang, L. Yu, C. Gao, C. Zheng, S. Liu, R. Lu, K. Dang, X. Chen, J. Yang, Z. Zhang, Y. Liu, A. Yang, A. Zhao, Y. Yue, S. Song, B. Yu, G. Huang, and J. Lin (2025) Beyond the 80/20 rule: high-entropy minority tokens drive effective reinforcement learning for LLM reasoning. In The Thirty-ninth Annual Conference on Neural Information Processing Systems, External Links: Link Cited by: §1, §4.2. J. Wei, X. Wang, D. Schuurmans, M. Bosma, b. ichter, F. Xia, E. Chi, Q. V. Le, and D. Zhou (2022) Chain-of-thought prompting elicits reasoning in large language models. In Advances in Neural Information Processing Systems, S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (Eds.), Vol. 35, p. 24824–24837. Cited by: §2.2. R. Wiyatno and A. Xu (2018) Maximal jacobian-based saliency map attack. External Links: 1808.07945, Link Cited by: §3.5. S. Yao, D. Yu, J. Zhao, I. Shafran, T. L. Griffiths, Y. Cao, and K. R. Narasimhan (2023) Tree of thoughts: deliberate problem solving with large language models. In Thirty-seventh Conference on Neural Information Processing Systems, External Links: Link Cited by: §2.2. J. Zhang, Q. Lin, S. Rajmohan, and D. Zhang (2025) From reasoning to answer: empirical, attention-based and mechanistic insights into distilled deepseek r1 models. External Links: 2509.23676, Link Cited by: §4.2. Appendix A Formulation of Data Poisoning as Stackelberg game In data poisoning, an attacker wants to find a set of data points sufficiently “close” to real data points that maximally harm the performance of a given statistical model. This format can be viewed as a Stackelberg game, where the attacker commits to a poisoned dataset D~ D, after which the defender attempts to find the optimal model parameters from it. Observe that the best action for the defender in this game is: θ∗(D~):=argminθ∈Θℒ~(θ;D~),θ^*( D):= _θ∈ L(θ; D), while the optimal action for the attacker to take is: D~∗:=argmaxD~∈ℬℒ(θ∗(D~);D). D^*:= _ D L(θ^*( D);D). Therefore, the game can be viewed as the following bi-level optimization problem: D~=argmaxD~∈ℬℒ(argminθℒ~(θ;D~);D), D= _ D L( _θ L(θ; D);D), (8) where D~ D is the poisoned dataset, ℬB is the set of admissible poisoned datasets, D is the dataset for final evaluation, ℒL is the loss function to evaluate the optimal model θ, and ℒ~ L is the loss function for evaluating the model on the poisoned dataset. The solution, (D~∗,θ∗(D∗~))( D^*,θ^*( D^*)), to (8) constitutes the Stackelberg equilibrium for this data poisoning game. Appendix B Method against random sentence poisoning Our method shows that student model distillation performance is worse when the teacher model traces are poisoned than baseline. In this additional experiment, we compare the results of our standard method to poisoning random sentences. The goal of this experiment is to verify that the backtracking sentences we poison are truly important for distillation. Figure 5: Accuracy drop between baseline versus poisoned reasoning trace distillation for varying numbers of tokens based on TraceGuard versus Random Sentence Removal. Based on the figure, poisoning random sentences has a substantially lower impact on distillation performance than the branching sentences. In this experiment, the teacher mdoel is DeepSeek R1 Distill Qwen 7B and the student model is Llama 3.2 3B. From Figure 5, the distillation performance gap is minimal for a varying number of tokens poisoned. Appendix C Distillation experimental setup In this work, we run knowledge distillation experiments on the student models using traces generated by the teacher model. The models are trained using HuggingFace’s SFTTrainer with the following optimal hyperparameters: Parameter Value Optimizer Fused AdamW Learning Rate 5×10−45× 10^-4 LR Schedule Cosine decay with 3% linear warmup Batch Size 16 (via gradient accumulation) Epochs 3 Weight Decay 0.1 Gradient Clipping 1.0 (max norm) Context Window 4096 tokens Precision bfloat16 (mixed precision) Attention Mechanism Flash Attention (sdpa) Table 1: Hyperparameters and Hardware Settings for Student Model Distillation These hyperparameters are very similar to those used in the Antidistillation Sampling method (Savani et al., 2025). Appendix D Proofs Proof of Proposition 3.4. We begin by defining the log-sum-exp function Φ(z)=log∑w∈exp(zw). (z)\;=\; _w (z_w). Φ has two important properties: ∇Φ(z) ∇ (z) =PT, =P_T, (9) ∇2Φ(z) ∇^2 (z) =diag(PT)−PTPT⊤. =diag(P_T)-P_TP_T . (10) Because logPT(v)=zv−Φ(z) P_T(v)=z_v- (z) and logP(v)=zv+ϵv−Φ(z+ϵ) P_P(v)=z_v+ _v- (z+ε), the KL divergence expands as DKL(P∥PT) D_KL(P_P\,\|\,P_T) =∑vPP(v)[logP(v)−logPT(v)] = _vP_P(v) [ P_P(v)- P_T(v) ] =∑vPP(v)[ϵv−Φ(z+ϵ)+Φ(z)] = _vP_P(v) [ _v- (z+ε)+ (z) ] =Φ(z)−Φ(z+ϵ)+⟨∇Φ(z+ϵ),ϵ⟩. = (z)- (z+ε)+ ∇ (z+ε),\,ε . Rewriting ϵ=z−(z+ϵ)ε=z-(z+ε) in the inner product recovers the definition of the Bregman divergence generated by Φ : DKL(P∥PT)=Φ(z)−Φ(z+ϵ)−⟨∇Φ(z+ϵ),z−(z+ϵ)⟩=DΦ(z,z+ϵ).D_KL(P_P\,\|\,P_T)\;=\; (z)- (z+ε)- ∇ (z+ε),\,z-(z+ε) \;=\;D_ (z,\,z+ε). We know that any Bregman divergence admits the integral representation DΦ(z,z+ϵ)=∫01tϵ⊤∇2Φ(z+tϵ)ϵt,D_ (z,\,z+ε)\;=\; _0^1t\;ε ∇^2 (z+tε)\,ε\;dt, where the path is the line segment z+tϵz+tε for t∈[0,1]t∈[0,1]. Writing Pt=∇Φ(z+tϵ)P_t=∇ (z+tε) for the intermediate softmax distribution, this gives DKL(P∥PT)=∫01tϵ⊤(diag(Pt)−PtPt⊤)ϵt.D_KL(P_P\,\|\,P_T)\;=\; _0^1t\;ε \! (diag(P_t)-P_tP_t )ε\;dt. The quadratic form equals the variance of the components of ϵε under PtP_t: ϵ⊤(diag(Pt)−PtPt⊤)ϵ=∑vPt(v)ϵv2−(∑vPt(v)ϵv)2=VarPt(ϵ).ε \! (diag(P_t)-P_tP_t )ε\;=\; _vP_t(v)\, _v^2\;-\; ( _vP_t(v)\, _v )^\!2\;=\;Var_P_t(ε). Now we also have, VarPt(ϵ)≤∑vPt(v)ϵv2≤∑vϵv2=‖ϵ‖22.Var_P_t(ε)\;≤\; _vP_t(v)\, _v^2\;≤\; _v _v^2\;=\;\|ε\|_2^2. Hence, uniformly for all t∈[0,1]t∈[0,1], ϵ⊤∇2Φ(z+tϵ)ϵ≤‖ϵ‖22.ε ∇^2 (z+tε)\,ε\;≤\;\|ε\|_2^2. Substituting in the bound we get, DKL(P∥PT)≤∫01t‖ϵ‖22t.D_KL(P_P\,\|\,P_T)\;≤\; _0^1t\,\|ε\|_2^2\;dt. Since ‖ϵ‖22\|ε\|_2^2 no longer depends on t or on the intermediate distributions PtP_t, we may pass the expectation through the integral: ϵ[DKL(P∥PT)] _ε\! [D_KL(P_P\,\|\,P_T) ] ≤ϵ[∫01t‖ϵ‖22t]=∫01tϵ[‖ϵ‖22]t \;≤\;E_ε\! [ _0^1t\,\|ε\|_2^2\;dt ]\;=\; _0^1t\;E_ε\! [\|ε\|_2^2 ]dt =σ2∫01tt=σ2⋅12=σ22.∎ \;=\;σ^2 _0^1t\;dt\;=\;σ^2· 12\;=\; σ^22. Proof of Corollary 3.5. Observe that since the k token distributions that are independently perturbed by noise are themselves independently conditioned on the original unchanged context (because the noise is added post-hoc, not during generation), we have that P(yM|x,y )=∏i=1kPP(ymi|x,y ).P_P(y_M|x,y_ M)= _i=1^kP_P(y_m_i|x,y_ M). Similarly, PT(yM|x,y∖M)=∏i=1kPT(ymi|x,y∖M)P_T(y_M|x,y_ M)= _i=1^kP_T(y_m_i|x,y_ M) Thus, we have that DKL(P(yM)∥PT(yM))=∑i=1kDKL(P(ymi)∥PT(ymi)).D_KL (P_P(y_M) P_T(y_M) )= _i=1^kD_KL (P_P(y_m_i) P_T(y_m_i) ). Taking expectations, we have that [∑i=1k(P(yM)∥PT(yM))] [ _i=1^k (P_P(y_M) P_T(y_M) ) ] =∑i=1k[DKL(P(ymi)∥PT(ymi))] = _i=1^kE [D_KL (P_P(y_m_i) P_T(y_m_i) ) ] ≤∑i=1kσ22=kσ22 ≤ _i=1^k σ^22=k σ^22 ∎