{"id":"6533d32c-c826-4db9-af10-a7c58a547e98","arxiv_id":"2508.07054","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"All six tested knowledge distillation techniques transfer membership and memorization privacy risks from teacher to student LLMs, with the extent varying by method, data, and task.","lead":"This paper tests whether smaller AI models trained by distilling from larger models inherit the larger model's privacy leaks. Across six distillation techniques and seven tasks, the authors find that every approach transfers membership and memorization risks from teacher to student.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Universal claim 'all existing LLM KD approaches' is not supported by the finite sample of six techniques; overgeneralization risk.","rationale":"The reader identified the weakest assumption as the unproven representativeness of the evaluated sample for a universal claim. I agree. The central claim 'all existing' is a universal quantifier that cannot be established by testing six techniques. The abstract provides no completeness argument, no taxonomy, and no discussion of whether the six are representative of the entire space of LLM KD methods. Additionally, the privacy attack definitions are not specified, so the measured risks might be an artifact of the chosen attacks. This is a load-bearing concern because the paper's headline conclusion would fail if any non-evaluated KD technique avoids the risk. A reasonable fix is to condition the claim on the evaluated methods or supply a proof of coverage. Therefore, I recommend a conditional decision: the paper should be accepted only if the central claim is narrowed or supported by a completeness argument. The reader's verdict of UNVERDICTED is consistent, but I recommend moving to CONDITIONAL because the issue is not merely missing detail but an overgeneralized conclusion that requires explicit revision.","tokens_in":621,"tokens_out":4115,"duration_ms":41403,"concrete_test":"Build a comprehensive checklist of LLM KD methods from a recent survey (including at least contrastive KD, online KD, relational KD, and DP-based distillation). For each method not among the original six, train a student on a teacher fine-tuned on a private dataset and run the same membership-inference and memorization-extraction attacks. If any student shows no significant privacy leakage, the universal claim is refuted. Alternatively, ask the authors to supply a formal taxonomy proving the six methods cover the full design space of KD objectives and training-data regimes.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The paper's central claim is the universal statement that 'all existing LLM KD approaches carry membership and memorization privacy risks from the teacher to its students.' The evidence is an empirical study of six KD techniques, three teacher families, and seven instruction-tuning tasks. This finite sample cannot establish a universal claim without either (a) an exhaustive enumeration of existing methods or (b) a theoretical argument that all methods share the risk-conferring mechanism. Neither is provided in the abstract. Moreover, the attack definitions are unspecified; different membership/memorization attacks could yield different results. Known KD variants with privacy protections (e.g., differentially private teacher or PATE) might not exhibit the same leakage. Thus, the stated conclusion overreaches the evidence. This is not an internal inconsistency but a scope/induction problem: the paper should restrict the claim to the evaluated techniques or provide a coverage argument.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper reports an empirical study of membership-inference and memorization privacy risks in six large language model knowledge distillation (KD) techniques. Using three teacher families (GPT-2, LLAMA-2, OPT), seven instruction-tuning tasks, and students of various sizes, the authors claim that all existing LLM KD approaches carry such risks from teacher to student, with risk levels varying across KD objectives, training data, and tasks. They further report a disagreement between memorization and membership risk rankings and characterize per-block variation in privacy risk.","tokens_in":844,"tokens_out":1266,"duration_ms":14264,"significance":"If the empirical findings hold, the paper makes a useful contribution by extending privacy-leakage analysis to LLM KD pipelines and by showing that risk is not uniform across KD components or transformer blocks. The breadth of the evaluation—multiple teachers, tasks, and student sizes—is a genuine strength, as is the attempt to disentangle membership and memorization risk. However, the central claim is stated as a universal law ('all existing LLM KD approaches'), which is not supported by the finite sample of six techniques and lacks a theoretical mechanism or coverage argument. The paper also does not specify the attack definitions in the abstract, leaving the validity of the privacy measures unverifiable from the presented text.","major_comments":[{"comment":"The sentence 'we demonstrate that all existing LLM KD approaches carry membership and memorization privacy risks from the teacher to its students' is a universal claim. The evidence, as described, is six KD techniques, three teacher families, and seven tasks. This finite sample cannot support a universal conclusion without either an exhaustive enumeration of existing methods or a theoretical argument that every KD method shares the mechanism that transfers these risks. I recommend restricting the claim to the evaluated set ('the six KD techniques studied here') or providing a coverage argument in the full text. Otherwise, the central assertion overreaches the evidence.","section":"Abstract"},{"comment":"The abstract does not define the membership inference and memorization attacks used. Different attack definitions can yield materially different conclusions; for example, a weak attack may report no risk while a stronger attack reports risk. The paper must state the threat model, the exact attack(s), and whether they use external ground truth or self-defined measures. Without this, the finding 'all KD approaches carry risks' is not reproducible or falsifiable. Please add this information to both the abstract and the experimental section.","section":"Abstract, methodology unspecified"},{"comment":"The claim that 'the extent of privacy risks varies across different KD techniques' is made without any effect sizes, confidence intervals, or error bars in the abstract. Given the small number of techniques and tasks, sampling variability could be substantial. The paper should report variance across seeds or task splits and show where differences are significant, or soften the language to 'varies in our experiments'.","section":"Abstract, statistical reporting"}],"minor_comments":[{"comment":"The phrase 'carry membership and memorization privacy risks from the teacher to its students' is ambiguous: does it mean that privacy leakage is always present, or that a risk exists in principle? Clarify the strength of the claim.","section":"Abstract"},{"comment":"Please enumerate the six KD techniques explicitly in the abstract or state that they are listed in Section 2. Similarly, name the seven NLP tasks or refer to the table where they are defined.","section":"Abstract"},{"comment":"The per-block privacy risk analysis is interesting but the abstract gives no detail. Please specify what 'block' means (e.g., transformer layer group) and how the per-block risk is computed.","section":"General"}],"recommendation":"major_revision","confidential_remarks":"This is an abstract-only review, so my confidence is limited. The main issue is the universal-claim language in the abstract, which is likely fixable by rewording or by adding a coverage/theoretical argument in the full text. If the full text already contains such an argument, the authors should make it explicit in the abstract. I would not reject on this basis alone, but the current abstract as written overstates the evidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nHere's the take: the paper reports a systematic empirical study of membership and memorization leakage in six LLM knowledge distillation techniques, across three teacher families and seven instruction tasks. That is a genuinely useful thing to have done, and the finding that risk varies by KD objective, student data, and task is plausible and worth pinning down. The claim that 'all existing LLM KD approaches' leak is not supported by the evidence presented, and it's the one sentence that will get the paper into trouble if it goes out like that.\n\nWhat's new: the breadth of the comparison seems real. Most prior work looks at one or two KD methods in isolation. Here you have a common evaluation across several methods, which lets you make relative statements about which components matter. The per-block analysis is also a nice touch; it's the kind of granular result that helps practitioners decide where to intervene.\n\nWhere it's soft: the central claim is a universal, and the evidence is a finite sample. Six techniques, even chosen carefully, don't establish that every existing approach leaks, unless the authors show a coverage argument (for example, that these six span the design space of objectives, training data, and teacher architectures). The abstract doesn't give that. Also, the attack definitions are unspecified. Membership and memorization are measured differently across the literature; without knowing the threshold, the calibration of the attacks, and the baseline, the numbers are hard to interpret. And there are no error bars in the abstract, which matters for a comparative study across tasks and models. These are fixable, but they need to be addressed in the full paper.\n\nNone of this is fatal to the empirical core. The relative risk comparison is valuable even if the universal statement is scaled back. I'd tell the authors to tone down the first claim, add a coverage or theoretical argument, and spell out the attack setup. The rest of the empirical work can stand on its own.\n\nWho is this for? People working on privacy-preserving distillation, and anyone deploying small distilled models on sensitive data. It deserves a serious referee: the topic is timely, the sweep is broad, and the relative claims are testable. Send it to review, but expect the reviewers to ask for a significant revision of the scope of the conclusions.\n\nBest.","headline":"Useful empirical sweep of KD privacy risks, but the abstract's universal claim overreaches; worth refereeing if the authors narrow the scope.","tokens_in":1214,"tokens_out":2317,"would_cite":false,"duration_ms":22242,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Knowledge distillation passes a teacher LLM's privacy leaks to its students.","keywords":["knowledge distillation","large language models","membership inference","memorization","privacy risk","teacher-student","instruction tuning"],"falsifier":"A concrete counterexample would be a knowledge-distillation technique—such as one using differentially private teacher outputs or output aggregation—where a standard membership-inference attack trained on student outputs cannot distinguish between teacher members and non-members, and a memorization extraction attack fails to recover any training text.","tokens_in":601,"feed_emoji":"🧠","tokens_out":1500,"duration_ms":16615,"temperature":0.7,"pith_summary":"This paper tries to establish that every existing knowledge-distillation method for large language models lets a student model inherit the membership and memorization privacy risks of its teacher. The authors test six distillation techniques across three teacher model families and seven instruction-tuning tasks, and find that in every configuration the student leaks information about whether a record was in the teacher's training data. They also show that the size of the leak depends on the distillation objective, the student's training data, and the task, and that memorization and membership risks do not track each other. If true, this means distilling a private model to save cost does not erase its privacy obligations.","feed_headline":"Distilled LLMs inherit teacher privacy leaks","feed_subtitle":"Membership and memorization risks survive across six KD techniques and three teacher models.","key_machinery":"The central mechanism is the knowledge-distillation pipeline itself: a student model is trained on outputs generated by a teacher that was trained on private data. The teacher's outputs encode not only general knowledge but also traces of specific training examples, and the student absorbs those traces. The paper's analytic machinery decomposes risk by three components—KD objective function, student training data, and NLP task—and measures both membership inference (whether a data point was in the teacher's training set) and memorization (whether training text is recoverable from outputs).","core_discovery":"The paper demonstrates that all existing LLM knowledge-distillation approaches carry membership and memorization privacy risks from the teacher to its students. Using six KD techniques, teacher models from GPT-2, LLAMA-2, and OPT families, and students of various sizes, the authors show that a student trained on teacher outputs can be used to infer whether a given example was in the teacher's training set, and to extract verbatim training content. The extent of risk varies by KD objective, student training data, and NLP task, and there is a significant disagreement between memorization and membership privacy risks for the same KD technique. Per-block analysis further shows that privacy risk","pith_inferences":["The paper's 'all existing' claim is a strong universal statement supported only by a sample of six techniques; a natural extension is a broader survey to test whether any KD method avoids risk entirely.","The per-block risk variation hints that a fine-grained attribution of which teacher outputs cause leakage could enable targeted sanitization of only the riskiest blocks.","A testable extension would be to see whether the same leakage appears when the teacher is trained with differential privacy; if so, KD may partially cancel those protections.","The disagreement between memorization and membership risks suggests that current attack definitions capture different underlying phenomena, and a unified privacy metric for LLM distillation may need to combine both."],"forward_implications":["If the claim holds, any organization using KD to compress a private teacher model must treat the student as carrying the same membership and memorization risks as the teacher.","Distillation technique choice matters: the paper shows risk varies meaningfully across KD objectives, so some methods leak more than others, though none leaks zero.","The observed disagreement between memorization and membership risk means a defense that mitigates one may not mitigate the other; both need separate evaluation.","Per-block variation suggests that pruning or modifying high-risk transformer blocks could reduce leakage without retraining the whole student.","Privacy-preserving distillation, such as adding noise or restricting teacher outputs, would need to be validated against both membership and memorization attacks, not just one."],"supporting_citations":[],"fun_headline_variants":["All LLM distillation methods leak training data","Privacy leaks survive every knowledge distillation method","Knowledge distillation passes on teacher's privacy risks","Distillation can't hide membership and memorization leaks","Student LLMs inherit teacher's privacy leaks"],"cache_read_input_tokens":2816,"weakest_assumption_plain":"The evaluated set of six distillation techniques, three teacher families, and seven tasks is assumed to represent all existing LLM knowledge-distillation approaches.","fun_headline_variants_meta":{"raw":{"variants":["All LLM distillation methods leak training data","Privacy leaks survive every knowledge distillation method","Knowledge distillation passes on teacher's privacy risks","Distillation can't hide membership and memorization leaks","Student LLMs inherit teacher's privacy leaks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000151,"raw_usage":{"total_tokens":1014,"prompt_tokens":699,"completion_tokens":315,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":443,"completion_tokens_details":{"reasoning_tokens":248}},"tokens_in":443,"tokens_out":315,"duration_ms":3307,"temperature":1.0,"reasoning_tokens":248,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T22:20:10.032126+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete counterexample would be a knowledge-distillation technique—such as one using differentially private teacher outputs or output aggregation—where a standard membership-inference attack trained on student outputs cannot distinguish between teacher members and non-members, and a memorization extraction attack fails to recover any training text.","supporting_citations":[],"review_version":1}