{"id":"f8b2d8c3-e09c-44ec-890a-e20f104f2996","arxiv_id":"2501.12619","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"A new evaluation framework claims to quantify LLM distillation using identity-jailbreak contradictions and response similarity, ranking most major LLMs as highly distilled except Claude, Doubao, and Gemini.","lead":"The paper proposes two probes, jailbreak-based identity checks and answer-similarity scoring, to measure how much one chatbot was trained on another's outputs, and reports most major models look heavily distilled except Claude, Doubao, and Gemini. The tools are a useful transparency start, but the paper does not prove that the signals it measures actually correspond to distillation.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"RSE's only validation is circular: the SFT check trains on the same evaluation prompts it then scores, so it cannot show that RSE tracks distillation rather than memorization.","rationale":"The reader's conditional verdict is appropriate. The paper is transparent about its limitations, releases code and data, manually verifies ICE samples, and includes known-distilled models in Tables 6-7, which are genuine positives. However, none of this closes the construct-validity gap. The RSE validation is confounded by training/evaluation overlap: the monotone improvement in Table 5 may simply show that a model can memorize the benchmark prompts and reference responses it was trained on. The ICE Hard Score results and the Limitations paragraph provide internal evidence that role-play and prompt induction account for most strict-score positives. A held-out split in the SFT validation, or a calibration study using known-distilled versus known-independent model pairs, would settle whether RSE tracks distillation or only surface similarity. As it stands, the headline conclusion that most major LLMs are highly distilled should be treated as an exploratory hypothesis, not a demonstrated measurement, which is exactly the conditional position the reader took.","tokens_in":18077,"tokens_out":8848,"duration_ms":95255,"concrete_test":"Re-run the SFT experiment in §4.2.2 with a strict train/eval split: fine-tune Qwen2.5-7B-Instruct on half of the ArenaHard/Numina/ShareGPT prompts (using GPT-4o-0806 responses as targets) and compute RSE on the held-out half. If the epoch-wise RSE gains are absent or much smaller on held-out prompts, the Table 5 trend is training-set memorization and RSE has no demonstrated sensitivity to distillation; if the gains persist, the circularity concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that RSE and ICE quantify distillation requires that observed similarity and identity contradictions are caused by training on a teacher model's outputs. The only direct evidence for RSE's sensitivity is the 'RSE Effectively Captures Distillation' experiment in §4.2.2, where Qwen2.5-7B-Instruct is fine-tuned for three epochs 'using the evaluation data from Subsection 4.1.2' and then scored with RSE. No train/eval split is reported; Table 5's monotone increase on ArenaHard, Numina, and ShareGPT is therefore consistent with memorizing the exact prompts and reference responses seen during SFT, not with a general property of distillation. This is training-evaluation leakage and it invalidates the paper's only non-circular calibration of RSE. The ICE side is similarly undercut by the paper's own Hard Score in Table 2: for DeepSeek-V3 the strict-score rate drops from 0.25 to 0.07, and for DeepSeek-R1 from 0.29 to 0.05, once prompts containing identity keywords are filtered out, while the Limitations section concedes that the jailbreak templates contain 'strong inductive guidance or role-playing elements.' Thus the high Loose/Strict rates that drive the headline ranking may reflect prompt-induced role-play and hallucination rather than inherited teacher identity. Without a ground-truth calibration separating known-distilled from known-independent models, RSE and ICE measure similarity to GPT-4o and susceptibility to identity jailbreaks, not distillation degree.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes two black-box metrics for quantifying LLM distillation: Response Similarity Evaluation (RSE), which uses an LLM judge to compare target-model responses with GPT-4o-0806 references across ArenaHard, Numina, and ShareGPT, and Identity Consistency Evaluation (ICE), which uses GPTFuzz to elicit identity-related contradictions under jailbreak prompts. The authors report that most closed- and open-source LLMs show high distillation degrees, with Claude, Doubao, and Gemini as exceptions, and that base models show higher scores than aligned models. The manuscript includes two complementary evaluations, a case study, and a public code/data release.","tokens_in":18332,"tokens_out":3109,"duration_ms":33359,"significance":"If the claims were well supported, RSE and ICE would provide a useful, low-cost auditing methodology for detecting possible distillation and homogenization in black-box LLMs, and the observed cross-model rankings would be of broad interest to the community. The paper has several strengths: it releases code and data, it evaluates on multiple benchmarks, and it includes a human-LLM consistency check for the ICE judge (Table 1). However, the central measurement claim currently rests on a circular validation for RSE and on jailbreak-induced identity responses for ICE, so the headline conclusions are not yet established.","major_comments":[{"comment":"The 'RSE Effectively Captures Distillation' experiment fine-tunes Qwen2.5-7B-Instruct for three epochs on the evaluation data from §4.1.2 (ArenaHard, Numina, and ShareGPT) and then measures RSE on the same data. No train/eval split is reported. The monotone increase in Table 5 is therefore equally consistent with memorization of the exact prompts and reference responses seen during SFT, and it does not establish that RSE tracks distillation in general. Please re-run the validation on a held-out prompt set or on models with publicly known distillation provenance (for example, the DeepSeek-R1-Distill series used in Table 7), and report the split explicitly.","section":"§4.2.2, Table 5"},{"comment":"The ICE results are undercut by the Hard Score, which filters out prompts containing identity-related keywords: for DeepSeek-V3 the Strict Score of 0.25 drops to Hard Score 0.07, and for DeepSeek-R1 the drop is from 0.29 to 0.05. The Limitations section concedes that the jailbreak templates contain 'strong inductive guidance or role-playing elements.' These observations indicate that the high Loose/Strict rates may reflect prompt-induced role-play rather than inherited teacher identity. The paper should report Hard Score for all models, not just the two DeepSeek variants, and should include a human-validation check for Hard Score analogous to Table 1.","section":"§4.1.1, Table 2, Limitations"},{"comment":"The central claim that RSE and ICE quantify distillation from a particular teacher requires ruling out alternative causes. High RSE similarity to GPT-4o could arise from shared pretraining corpora, common response formatting conventions, or benchmark-specific style, and the paper itself acknowledges in the Hallucination subsection that identity inconsistencies can arise without distillation. The manuscript currently lacks a ground-truth calibration set of known-distilled versus known-independent models; without such a control, the observed scores measure similarity to GPT-4o and susceptibility to identity jailbreaks, but not distillation degree. Adding a calibration experiment with public distillations (e.g., DeepSeek-R1-Distill-Qwen/Llama) and diverse non-GPT teachers would directly address this concern.","section":"§3.2 and §5 (Hallucination)"}],"minor_comments":[{"comment":"The caption of Figure 18 says 'High-score example that appears similar to humans,' but the surrounding text (Appendix F) describes this as a low-RSE case; the caption and text should be aligned.","section":"Appendix F, Figure 18"},{"comment":"The notation for GPTFuzz, e.g., P_TS_i = {ptS_i,j} and P_G_i = P_G_{i-1} + F_G(P_TS_i), is hard to parse; the plus sign should be defined explicitly as set union or concatenation, and the subscript/superscript styling should be made consistent.","section":"Section 2"},{"comment":"The header 'Qwen 2.5 / Qwen Llama 3.1' is confusing, especially for the 'Max' column; please split the table or use a clearer two-level header that distinguishes the Qwen and Llama series.","section":"Table 3"},{"comment":"Several references appear to be placeholders or incomplete (e.g., 'Doe and Smith, 2024' with no venue information and 'Lee and Patel, 2024' without full bibliographic details); they should be completed or removed.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper's core idea is interesting and the public release is commendable, but the validation of RSE is circular as written, and ICE's Hard Score raises serious concerns about prompt-induced artifacts. These are fixable with additional experiments, so I recommend major revision rather than rejection. Please also check whether the 'Doe and Smith' citation indicates an incomplete manuscript review process."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. First, the paper's basic idea is worth a look: it uses jailbreak prompts to probe identity leaks plus an LLM-judged response-similarity score as a cheap black-box indicator of whether a model was trained on another model's outputs. Second, the only experiment that directly validates the similarity score is circular, so the ranking that comes out of it is not a measured distillation degree; at best it is a suspicion score.\n\nWhat is actually new: the specific pairing of GPTFuzz identity jailbreaks with a five-level LLM-judged similarity metric, applied to a current lineup of models. The empirical observations—base models scoring higher than instructed ones, larger distilled models being more similar to their teacher, Qwen-Max occasionally claiming to be Claude—are interesting and worth replicating. The human-LLM agreement check on ICE (Table 1) is a step in the right direction, and the authors are upfront about the role-playing contamination in their jailbreak templates in the Limitations section.\n\nSoft spots, in order of severity. The RSE validation in §4.2.2 fine-tunes Qwen2.5-7B-Instruct on the very evaluation sets used to compute RSE and then measures RSE on those same sets. The monotone score increase across epochs is exactly what you'd expect from memorization. There is no train/eval split and no ground-truth pair of known-distilled and known-independent models to calibrate against. This is load-bearing, because it is the paper's only non-circular-looking evidence that RSE tracks distillation rather than general similarity. Second, the ICE signal is substantially weakened by the paper's own Hard Score: DeepSeek's strict score drops from 0.25 to 0.07 once prompts containing identity keywords are filtered out. Combined with the conceded role-play elements, high loose/strict rates look more like prompt-induced hallucination than inherited teacher identity. Third, judge reliability and score uncertainties are not reported anywhere, so all between-model differences in Tables 4–7 lack error bars.\n\nI don't think the framework is dead. The authors have a plausible probe, and the flaws are fixable: add a proper calibration study on models with known distillation status, use separate train/eval sets, report judge agreement and confidence intervals, and soften the causal language from 'distillation degree' to 'distillation suspicion.' As written, the headline claim that most major LLMs are highly distilled is an exploratory hypothesis.\n\nWho it's for: people working on data contamination, model provenance, and homogenization. It's a useful discussion piece, not yet a reliable measurement tool. I would send it to review—the problem is real, the method is transparent, and a good referee can push it to a much stronger revision—but I wouldn't cite the quantitative results in their current form.","headline":"A promising black-box probe for distillation suspicion, but its only direct validation is circular and the headline ranking should be treated as exploratory, not measured.","tokens_in":18968,"tokens_out":2882,"would_cite":false,"duration_ms":30586,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Two black-box probes quantify how much an LLM was distilled from another, ranking most major models as heavily distilled except Claude, Doubao, and Gemini.","keywords":["large language models","model distillation","distillation quantification","response similarity evaluation","identity consistency evaluation","jailbreak prompts","model homogenization","automated jailbreak"],"falsifier":"Run the exact RSE and ICE protocols on a model whose training data is documented to contain no text generated by the reference model or any tested teacher; if it still scores near the paper's high-distillation thresholds, the signals are measuring something other than distillation, and the interpretation collapses.","tokens_in":17810,"feed_emoji":"🔍","tokens_out":8553,"duration_ms":74606,"temperature":0.7,"pith_summary":"This paper claims that two black-box probes can quantify how much one large language model was trained on another model's outputs, without any access to training data or weights. The first probe, Response Similarity Evaluation, scores how closely a test model's answers match a reference model across style, logic, and content. The second, Identity Consistency Evaluation, uses automated jailbreak prompts to expose cases where a model falsely claims to be a different developer's model, which the authors read as leaked teacher identity. Applied to current models, the two probes rank most major LLMs as heavily distilled, with Claude, Doubao, and Gemini as exceptions, and show base models carry stronger distillation traces than instruction-tuned versions. If the probes really measure distillation, they give outsiders a tool to make model training practices more transparent.","feed_headline":"Two black-box probes rank most LLMs as heavily distilled","feed_subtitle":"Response similarity and jailbreak identity leaks reveal which models trained on others' outputs.","key_machinery":"The machinery is a pair of complementary metrics. RSE is a similarity scoring pipeline that uses a judge language model to compare test responses to a reference model's responses on three axes—style, logic, and content—over general, mathematical, and instruction-following prompt sets. ICE is a jailbreak-driven identity probe built on an automated jailbreak tool: it iteratively mutates identity questions to bypass the model's self-identification guardrails, then uses a judge language model and keyword filters to count contradictions against a fact set of known developer identities. The paper's evidence that the metrics trace distillation comes from a control experiment: fine-tuning Qwen2.5-7B-Instruct on reference-model outputs for three epochs raises RSE monotonically with each epoch.","core_discovery":"The central discovery is a measurement framework: RSE assigns a 1–5 similarity score per response, judged by a language model across response style, logical structure, and content detail, using GPT-4o-0806 as the reference teacher; ICE runs jailbreak prompts against identity questions and flags any answer where a model logically contradicts its known developer identity, with loose, strict, and hard scoring variants. Combining these, the paper finds that closed- and open-source models such as DeepSeek-V3, Qwen-Max-0919, and GLM4-Plus show high distillation levels, while Claude3.5-Sonnet, Doubao-Pro-32k, and Gemini-2.0-Flash remain low, and that base (pre-alignment) models score higher than their aligned counterparts.","pith_inferences":["The authors leave implicit that the same probes could serve as an audit tool for derivative-model disclosure, since identity leakage under jailbreak is a behavioral fingerprint of the teacher.","A testable extension: if distillation is the cause, a model's RSE rank should track its documented training lineage; probing a model known to be designed around a particular teacher but with carefully curated identity data shows the two metrics can diverge, suggesting they measure different aspects of distillation.","The identity-contradiction signal could be confounded by models that learned about other assistants from ordinary web text; one could test this by comparing contradiction rates for fictional versus real assistant names, since real-name leakage should be stronger under the distillation story."],"forward_implications":["External auditors can rank models by distillation degree using only API access, without training data or weights.","High RSE and ICE scores become a transparency signal that a model may be homogenized toward a single teacher, warning of reduced robustness on novel tasks.","The finding that base models score higher than aligned models implies that distillation traces are set during pretraining and partially overwritten by alignment tuning.","Because the framework works with any chosen reference model, the authors extend it to reasoning models by using different references.","Publishing RSE and ICE scores in technical reports would let the community compare how independently models are developed."],"supporting_citations":[{"why":"supplies the automated jailbreak method that generates and mutates identity prompts for ICE.","marker":"Yu et al., 2024"},{"why":"documents the reference model (GPT-4o) whose outputs serve as the teacher for RSE comparisons.","marker":"OpenAI, 2024"},{"why":"provides the Numina mathematical reasoning prompt set used in RSE.","marker":"Li et al., 2024a"},{"why":"provides the ArenaHard general reasoning prompt set used in RSE.","marker":"Li et al., 2024b; Li* et al., 2024"},{"why":"supplies the open model (Qwen2.5-7B-Instruct) used in the fine-tuning control experiment that validates RSE rises with distillation epochs.","marker":"Qwen, 2025"}],"fun_headline_variants":["Two probes expose most LLMs as heavily distilled","Jailbreak and similarity probes rank LLM distillation","Most LLMs show high distillation, new probes reveal","Base models more distilled than aligned, probes find","Quantifying LLM distillation: two probes, one verdict"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing assumption is that high response similarity to a chosen reference model and identity contradictions under jailbreak are caused by that model's outputs being used as training data, rather than by shared pretraining corpora, hallucination, role-play induction, or common formatting conventions.","fun_headline_variants_meta":{"raw":{"variants":["Two probes expose most LLMs as heavily distilled","Jailbreak and similarity probes rank LLM distillation","Most LLMs show high distillation, new probes reveal","Base models more distilled than aligned, probes find","Quantifying LLM distillation: two probes, one verdict"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000252,"raw_usage":{"total_tokens":1544,"prompt_tokens":912,"completion_tokens":632,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":528,"completion_tokens_details":{"reasoning_tokens":557}},"tokens_in":528,"tokens_out":632,"duration_ms":6522,"temperature":1.0,"reasoning_tokens":557,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T16:58:54.999766+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the exact RSE and ICE protocols on a model whose training data is documented to contain no text generated by the reference model or any tested teacher; if it still scores near the paper's high-distillation thresholds, the signals are measuring something other than distillation, and the interpretation collapses.","supporting_citations":[],"review_version":1}