Model Distillation Evidence

Definition

Model distillation evidence is the evidence-quality standard for deciding whether a model team systematically used another model’s outputs or behavior to train a student model.

Current Synthesis

The sources distinguish weak public clues from stronger provenance evidence. A model calling itself GPT or Claude can reflect public-output contamination, prompting, or generic behavior and does not prove distillation. Better evidence combines controlled behavior comparisons with provider-side access traces: repeated query families, concurrency, cross-account coordination, answer and refusal distributions, code style, and known training or procurement records. Traffic can justify investigation or access enforcement without by itself proving what entered a training set, who directed the activity, or whether the resulting model learned from it.

Key Claims

• Identity confusion is a warning sign about data pollution or prompt conditioning, not standalone provenance proof.
• Behavior-level comparisons need scale, controls, and alternative explanations because independently trained models can converge.
• Provider logs, account traces, repeated prompts, concurrency, and cross-account relationships are stronger than isolated screenshots.
• Suspicious traffic supports an inference about access behavior, not automatically a conclusion about training use or organizational responsibility.
• Public accusations should distinguish policy violation, attempted extraction, successful dataset construction, and measurable student-model learning.
• Evidence standards matter because allegations affect legal exposure, model access, geopolitics, investment, hiring, and research credibility.

Evidence

Weak and stronger provenance signals:

• 179: 蒸馏风暴：一场无人公开谈论的技术竞赛 rejects model self-identification as proof and proposes distributional, refusal, code-style, call-trace, and account evidence as stronger signals.

Traffic-shape interpretation:

• Anthropic口中的AI安全，为什么听起来像一场生意保卫战？ says suspected extraction may appear as high-volume concurrent queries with little topical continuity, while ordinary work more often develops coherent threads.

Enforcement-versus-proof boundary:

• 179: 蒸馏风暴：一场无人公开谈论的技术竞赛 and Anthropic口中的AI安全，为什么听起来像一场生意保卫战？ describe provider-side classification and incomplete public evidence, supporting investigation and controls while keeping accusations source-scoped.

Counterevidence & Qualifications

Neither source supplies raw logs, classifier thresholds, false-positive rates, controlled model comparisons, or a documented chain from queries to training data and student capability. Prompt diversity, batch evaluation, security research, education, or legitimate automation may resemble extraction traffic. Provider evidence can be privileged and useful while still requiring independent review before public attribution.

What Changed

• Migrated the page to the synthesis-v1 evidence structure.
• Added concurrency and topic coherence as possible traffic signals.
• Clarified that enforcement evidence is not automatically proof of successful distillation.

Related Concepts

• Model Distillation / 模型蒸馏 - technical practice whose provenance is being evaluated.
• Model Identity Data Pollution / 模型身份数据污染 - alternative explanation for model self-identification.
• AI Model Distillation Governance - legal and organizational consequences of the evidence judgment.
• AI Platform Behavioral Enforcement / AI平台行为式风控 - operational system that acts on traffic signals before public proof is complete.
• Frontier Model Access Restrictions - access-control layer that providers can apply to suspected extraction.
• AI Verification - broader discipline of matching claims to reproducible evidence.