OP-Print: Tracing Membership Imprints in On-Policy Self-Distillation

Qi Li; Xinchao Wang

Home/Archive/arXiv

arXiv · 2610.31616

OP-Print: Tracing Membership Imprints in On-Policy Self-Distillation

Qi Li·Xinchao Wang

View original source ↗Read source document ↗Export metadata ↓

Abstract

On-policy distillation has been widely adopted for alleviating the distribution mismatch of off-policy distillation. Self-distillation further removes the need for an external teacher by using the student's own outputs, enhanced with extra context or demonstrations, as supervision. This teacher-free design makes on-policy self-distillation practical, yet its privacy risks remain largely unexplored. In particular, using two coupled views of the same training example may strengthen its memorization. Motivated by this, we present the first study of membership inference attacks against on-policy self-distillation. We investigate both gray-box and black-box threat models and propose a unified attack framework, named OP-Print. OP-Print builds on our finding that the supervision imprint in on-policy self-distillation is sparse and structured, concentrating on uncertainty-sensitive correction sites rather than across the entire rollout. Exploiting this property, we construct attack signals tailored to the two access levels: in the gray-box setting, OP-Print directly aggregates the privileged teacher-student residual correction along the same rollout; in the black-box setting, it measures restart-based output-basin stability as an observable surrogate for the hidden correction process. Across diverse models and distillation schemes, all baseline attacks remain essentially at random guessing even under gray-box access, whereas OP-Print is broadly validated to be effective in both gray-box and black-box settings.

Explore related subjects

cs.LG cs.CR

Keep this discovery

Explore connections, maps & timelines

BibTeX RIS

Qi Li, Xinchao Wang. 2026-10-22. OP-Print: Tracing Membership Imprints in On-Policy Self-Distillation. https://arxiv.org/abs/2610.31616

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Are EEG Sequences Time Series? EEG Classification with Time Series Models and Joint Subject Training

As with most other data domains, EEG data analysis relies on rich domain-specific preprocessing. Beyond such preprocessing, machine learners would hope to deal with such data as with any other time series data. For EEG classification many models have been developed with layer types and architectures we typically do not see in time series classification. Furthermore, typically separate models for each individual subject are learned, not one model for all of them. In this paper, we systematically study the differences between EEG classification models and generic time series classification models. We describe three different model setups to deal with EEG data from different subjects, subject-specific models (most EEG literature), subject-agnostic models and subject-conditional models. In experiments on three datasets, we demonstrate that off-the-shelf time series classification models trained per subject perform close to EEG classification models, but that do not quite reach the performance of domain-specific modeling. Additionally, we combine time-series models with subject embeddings to train one joint subject-conditional classifier on all subjects. The resulting models are competitive with dedicated EEG models in 2 out of 3 datasets, even outperforming all EEG methods on one of them.

cs.LG↗

arXiv2026

The Fenchel-Young Generalization of Bayesian Principles

Conjugate Bayes plays a key role in machine learning, ensuring computationally simple posterior updates. We generalize the variational principle behind this computation by using the Fenchel-Young (FY) inequality, which lets us define a generalized evidence lower bound beyond the KL geometry, and at equality, characterizes new generalized posteriors. A generalized notion of conjugacy follows, defined as closure of prior-potential families that are affine under translation by the loss. We show that such families not only preserve additive canonical updating, but also posterior inference with parameter-dependent supports and tuneably heavy tails. This combination is not feasible with standard conjugate Bayes. We derive a new FY generalization of expectation maximization (EM), which recovers classical and Hard EM, and amortized versions. We show examples, including generalized Bayesian linear regression with closed-form bounded support and heavy-tailed posteriors, and a Gaussian mixture with sparse cluster assignments.

cs.LG↗

arXiv2026

Fragility-aware Classification for Risk Characterization and Robust Learning

Classification models play a central role in data-driven decision-making applications such as medical diagnosis, recommendation systems, and risk assessment. Traditional performance metrics, such as accuracy and AUC, quantify classification errors and pairwise ranking performance but do not account for the magnitude of errors, i.e., the risk of confident misjudgments. This limitation is particularly consequential in safety-critical and cost-sensitive settings, where overconfident errors can lead to severe outcomes. To address this issue, we propose the Fragility Index (FI), a novel performance metric that evaluates classifiers from a risk-averse perspective by capturing the tail risk of confident misjudgments. We formulate FI within a robust satisficing (RS) framework to quantify classifier sensitivity under distributional uncertainty. Building on this, we develop a tractable surrogate-based training framework and establish provable bounds connecting training fragility to ranking-error FI. We further derive tractable reformulations for a broad class of loss functions, including cross-entropy, hinge-type, and Lipschitz losses, and identify specific conditions under which these reformulations are exact. We also introduce an FI-induced regularizer for deep neural networks. Empirical results on real-world medical diagnosis tasks demonstrate that FI complements existing metrics by revealing error tail risk not reflected in accuracy or AUC. FI-based models achieve competitive predictive performance while generally attaining lower FI. In the simulated human--AI diagnostic workflow, they also achieve lower average operational costs than empirical risk minimization.

cs.LG↗