A safety-aligned but backdoored teacher passes its backdoor to a clean student through on-policy distillation, reaching up to about 70% trigger attack success at a 3% poisoning rate
This work studies whether on-policy distillation (OPD) for safety can propagate backdoors: the authors build safety-aligned but backdoored teachers with bi-GRPO and distill initially clean students through OPD, finding that a 3% poisoning rate yields up to about 70% trigger attack success, that more training epochs (67% after 16 epochs with only 10 poisoned samples) and top-K KL both accelerate backdoor transfer, and that a KL-reward-clipping method, Lazy Defense, delays this transfer.