Hiding in Plain Sight: Detectability-Aware Antidistillation of Reasoning Models

Researchers from arXiv have introduced a novel approach to protect closed-source frontier AI models from adversarial distillation, a process where third parties sample reasoning traces to bypass guardrails and misappropriate capabilities. Existing antidistillation methods often poison reasoning traces but overlook detectability, which can erode trust and signal defense presence to adversaries. This new study addresses this gap by framing antidistillation as a Stackelberg game with constraints explicitly encoding semantic and syntactic detectability. The authors demonstrate that sparingly perturbing specific parts of the trace is more effective and less detectable than full-trace poisoning. Leveraging mechanistic interpretability, they identify 'thought anchors'—sentences with disproportionate counterfactual influence on outputs—as ideal sparse targets. These anchors are critical for reasoning yet minimally detectable when altered. The team instantiated this concept in TraceGuard, a training-free, black-box proof-of-concept. TraceGuard locates thought anchors via branching-token detection and poisons them to degrade student model distillation while preserving the coherence of the teacher model's output traces, offering a robust defense mechanism against capability misappropriation.