Post-Generation Response Transformation Against Unauthorized Model Distillation: An Empirical Case Study

Unauthorized model distillation creates a growing security problem for language-model providers: an attacker can collect API responses at scale and use them as supervision for a smaller local model. This work investigates a deployment-separable defense in which the protected teacher model remains unchanged while an external, risk-gated layer transforms the visible response after generation. The study examines two prototype approaches. ITRO applies adaptive, domain-aware reasoning obfuscation, while SPECTRE introduces a more consistent false-start structure intended to reduce the training value of collected reasoning traces. On the finalized GSM8K evaluation, the clean-distillation student achieved 39.6% accuracy, the ITRO student 39.0%, the SPECTRE student 34.8%, and a no-rationale student 37.0%. The recorded average training losses were 0.1637 for clean training, 0.2555 for ITRO, and 0.3512 for SPECTRE. These results are descriptive rather than definitive: the experiments consist of single historical runs, and the observed degradation has not yet been replicated across seeds, harder benchmarks, or adaptive attackers. The findings nevertheless suggest that post-generation transformation remains a useful research direction, particularly if future methods can preserve natural and semantically correct explanations for legitimate users while systematically reducing their value as distillation supervision. The work therefore motivates further research on semantic verification, adaptive sanitization, human utility, reproducibility, and the economics of response-layer anti-distillation defenses.