safety security
Self-Distillation Leaves a Sparse Membership Print
OP-Print targets uncertainty-sensitive correction sites rather than averaging a privacy signal across the whole generated rollout.
Summary
OP-Print targets uncertainty-sensitive correction sites rather than averaging a privacy signal across the whole generated rollout.
On-policy self-distillation uses a model's enhanced output to supervise another view of the same example, avoiding an external teacher but potentially coupling memorization signals. OP-Print finds that the teacher-student correction imprint is concentrated at a small set of uncertainty-sensitive tokens. Its gray-box attack aggregates those residual corrections; its black-box version measures how stable restarted outputs remain around the same basin. In the reported experiments, standard attacks stayed near random guessing even with gray-box access, while OP-Print was effective across multiple models and distillation schemes. The work demonstrates a privacy risk under its access assumptions, not a measured leak in every self-distilled model.
Why it matters
OP-Print targets uncertainty-sensitive correction sites rather than averaging a privacy signal across the whole generated rollout.
Limits and context
- Its gray-box attack aggregates those residual corrections; its black-box version measures how stable restarted outputs remain around the same basin.
- The work demonstrates a privacy risk under its access assumptions, not a measured leak in every self-distilled model.
Key claims
OP-Print targets uncertainty-sensitive correction sites rather than averaging a privacy signal across the whole generated rollout.
Qualification: Its gray-box attack aggregates those residual corrections; its black-box version measures how stable restarted outputs remain around the same basin.
Evidence: source-2026-10-23-012
Sources
- arXiv preprint 2610.31616, original v1arXiv · primary research
Corrections
No corrections have been recorded for this story.