Black-box vs white-box distillation

The distinction determines how much information each teacher query yields, and therefore how many queries a serious distillation effort requires.

White-box

You can see inside the teacher: full output distributions, often intermediate activations, sometimes weights. Every query returns a probability across the whole vocabulary rather than one sampled token.

This is enormously more informative. A single forward pass gives you the teacher's complete assessment of every option it considered, which is exactly the dark knowledge that makes distillation efficient. You can use KL divergence directly, apply temperature scaling meaningfully, and add feature-matching terms.

In practice this is available when you own the teacher, when it is an open-weights model you have downloaded, or in a research setting.

Black-box

You get text. That is all. You send a prompt, you receive a completion, and everything about how the teacher arrived there is hidden.

Training then becomes sequence-level: you assemble prompt and response pairs and fine-tune the student on them as ordinary supervised data. The teacher's distribution is present only implicitly, in which continuations it happened to produce.

What black-box costs you

• Data volume. Far more queries are needed for equivalent transfer, because each one carries less signal.
• No temperature machinery. The soft-target apparatus assumes distributions you cannot see.
• Sampling noise. A sampled response is one draw from a distribution, not the distribution.
• No feature matching. Internal representations are unavailable, so response-based methods are the only ones on the table.

You can partially compensate by sampling many responses per prompt, which approximates the distribution by brute force. It is coarse, and it multiplies the query count further.

Why this shaped the 2026 dispute

The scale of the reported extraction campaigns is a direct consequence of black-box constraints. Figures like 28.8 million exchanges are what black-box transfer of broad capability looks like arithmetically. With white-box access the same transfer would need a small fraction of that traffic.

Which is why restricting logprob access is a rational defence. It does not prevent distillation. It makes it expensive and, critically, conspicuous: millions of queries are visible in a way that a few thousand would not be. The detection evidence that actually worked in 2026 was traffic analysis, and black-box constraints are what generated enough traffic to analyse.

Common questions