Can LLM Safety Be Distilled? What an Inherited Alignment Audit Must Prove

Safety can apparently travel with a distilled model, but nobody should sign off on that inheritance without re-testing the student. A recent preprint, SafePre-OnDistill (arXiv 2610.27555), reports (author-reported, not independently replicated) that a 1.7B-parameter safety-pretrained teacher can harden larger students from a different model family, and that the transferred safety survives subsequent fine-tuning. If that holds, it changes the economics of derivative models: the expensive path is a full safety-training program for every fine-tune, distilled student, or compressed variant, and a credible inheritance mechanism would shrink it. But the same literature that makes inheritance plausible also documents how it fails: off-policy distillation can leave a student less safe, benign fine-tuning erodes alignment, and text-level refusal scores say nothing about what a model does when it can call tools. The practical answer for a reviewer is a two-gate audit. First, confirm the pipeline is one the evidence can even support. Second, verify safety on the student itself, on its own distribution, after every subsequent modification.

What the paper actually claims

The preprint defines the property under study carefully, and the definition matters for any audit. “We refer to this deeply embedded and adaptation-resilient property as native safety: safety acquired during pretraining, characterized not only by safe behavior at the current checkpoint, but also by robustness to subsequent fine-tuning” (arXiv 2610.27555). That is a stronger claim than “the student refuses harmful prompts today.” It is a claim that the safety survives the exact downstream operations, fine-tuning especially, that derivative models exist to receive.

The headline configuration, all author-reported: the teacher is the base SafeLM-1.7B checkpoint before instruction tuning, and “In our study, this allows the small SafeLM-1.7B teacher (Maini et al., 2026) to improve larger students from another model family, including Llama-3.2-3B and Llama-3-8B (Grattafiori et al., 2024).” The method uses on-policy distillation for the same-tokenizer student and GOLD, a cross-tokenizer on-policy variant, for the cross-family Llama students, with distillation weight α=0.7 for every student. Safety is measured as attack success rate (ASR) on four harmful-request benchmarks including HarmBench. On the paper’s own accounting, subsequent fine-tuning raises the 1.7B student’s average ASR “by only 5.00%, compared with 11.58% for safety post-training” (arXiv 2610.27555), while its average utility of 48.20% exceeds the aligned teacher’s 27.42%. The paper also claims the same reuse extends to machine-unlearning robustness and to multimodal safety, where a language-based teacher improves a vision-language model without touching its visual components.

Two cautions belong next to every one of those sentences. First, the reported transfer is partial, and the paper’s own tables quantify the gap (arXiv 2610.27555): the same-family student’s average ASR goes from 0.16 before fine-tuning to 5.16 after, versus 0.16→0.80 for the safety-pretrained teacher itself, while the cross-family students land at 1.70→11.57 (Llama-3.2-3B) and 0.44→11.86 (Llama-3-8B). The authors state the limit themselves: “a gap remains under cross-family transfer, and the advantage over safety post-training vanishes under heavily harmful fine-tuning.” Second, nothing here has been independently replicated. Treat the preprint as a plausible mechanism with a reproducibility debt, not a settled result.

Gate 1: does the pipeline even qualify for inheritance?

The inherit gate asks whether the distillation setup matches the conditions under which transfer is claimed, and where the evidence says it breaks.

Distillation regime. The paper itself flags the sharpest dividing line: “although off-policy distillation from an aligned teacher may yield a less safe student (Zhang et al., 2025; Jahan and Sun, 2025)” (arXiv 2610.27555). On-policy supervision, where the student generates and the teacher corrects the student’s own outputs, is the regime the positive results rest on. A derivative built by training on logged teacher outputs sits in the regime with documented downside. If a vendor cannot say which regime produced the student, that is an audit finding, not a footnote.

Family and tokenizer match. Conventional on-policy distillation typically requires a same-family teacher and student; SCoRe (arXiv 2509.14257) states this constraint when explaining its teacher choice. SafePre-OnDistill’s cross-tokenizer GOLD path claims to break it; GOLD itself is adopted from prior cross-tokenizer distillation work, so what is new and unreplicated is its use to transfer native safety to cross-family students. A same-tokenizer transfer rests on firmer ground than a cross-family one, and the audit should record which path was used.

Capacity ratio. SafePre-OnDistill’s striking claim runs uphill, a 1.7B teacher hardening 3B and 8B students. Elsewhere in the distillation literature, capacity interacts with transfer in non-obvious ways: InherNet (arXiv 2602.09509) reports that “Distillation benefits small-scale InherNet, but harms the performance of large-scale InherNet.” That result comes from a different inheritance method and domain, so it transfers by analogy rather than direct test, but it is enough to make capacity ratio a recorded audit field rather than an assumption. A student much larger than its safety teacher is a configuration the paper claims to introduce, with its survey finding little prior work on distillation from safety-pretrained models, and with reported student robustness below the teacher’s.

Gate 2: verify on the student, not the teacher

The verify gate exists because a teacher’s eval record cannot stand in for the student’s. Every component below is a re-run on the student artifact, on the distribution the student will actually face.

Student-side ASR on the student’s own distribution. The paper’s own yardstick is student-side attack success rate, which sets the right precedent: the audit should reproduce harmful-request evals against the shipped checkpoint, not cite the teacher’s HarmBench numbers. JBDistill (arXiv 2505.22037) adds the reproducibility discipline this requires: as it notes, citing Beyer et al., small changes in attack setup, hyperparameters or chat templates produce large swings in measured attack success, so fixed prompt sets and disclosed attack and judge configurations are what make two runs comparable. A vendor report without those disclosures is not portable evidence.

A measured transfer gap, with fidelity metrics. Headline ASR can hide the fact that the student learned something other than the teacher’s behavior. The CIFAR-10 capacity study (arXiv 2605.31191) cites prior work observing that “students often fail to match their teachers even when distillation improves generalization, arguing that agreement and predictive divergence should be reported alongside accuracy,” and its own result lands on the same principle: top-1 teacher-student agreement is flat across all pairs even where accuracy gains concentrate. The authors themselves caution this is “a directionally consistent finding rather than a definitive claim,” from two student sizes on one dataset, but the measurement principle is cheap to adopt: report teacher-student agreement and divergence on safety-relevant inputs alongside ASR. There is also direct evidence that distilled models can pass evals via shortcuts. CV-OPD (arXiv 2610.13264) documents a distilled vision-language model that “can handle questions without visual evidence,” producing correct answers without the underlying capability. A student that matches the teacher’s refusal rate by pattern-matching refusal phrasing, rather than by the teacher’s actual decision boundary, is the kind of student most likely to diverge when the distribution shifts.

The tool-call surface. This is where inherited-alignment claims are most likely to be hollow. Mind the GAP (arXiv 2602.16943) tested six frontier models across six regulated domains and three system prompt conditions, and reports a conditional GAP rate as high as 79.3% under adversarial conditions (Mind the GAP): “text-level alignment can be nearly entirely bypassed through tool-call pathways.” Their conclusion is blunt: “text-safety benchmark scores may be actively misleading—a model that scores well on refusal evaluations can simultaneously be unsafe in its actions, creating false confidence in deployment readiness.” SafePre-OnDistill’s own evals are text-level harmful-request ASR, so even taken at face value they certify only the text surface. If the derivative model will run with tools, code execution, or retrieval, the audit needs adversarial tool-call evals on the student. A clean refusal benchmark is not evidence about that surface.

Re-checks after every subsequent modification. Inheritance is per-checkpoint, and the preprint quantifies its own ceiling. When unsafe BeaverTails samples replace part of the fine-tuning data, the distilled student stays ahead of safety post-training through 10% harmful content, with ASRs of 51.00% versus 57.40% at that point (arXiv 2610.27555). “At 20% and above, however, their performance converges,” and the teacher remains substantially safer. Safety Layers (arXiv 2408.17003) shows the fine-tuning procedure matters in its own right: with backdoor datasets on alpaca-clean, its safe partial-parameter method (SPPFT) produced “only an average harmful rate increase of 3.74%.” HyperSafe (arXiv 2607.11475) reports the same fragility from the defense side: even benign task adaptation can increase harmful compliance, which is why it proposes post-hoc recovery that avoids re-running alignment. Compression is not exempt either, and it is not predictably negative: Pruning for Protection (arXiv 2401.10862) found that “pruning at 30% target sparsity induces statistically significant safety improvements,” with benefits correlated to the model’s initial safety level. The direction of the effect is method- and checkpoint-dependent, which is exactly why compressed variants need their own evals rather than an assumption in either direction.

The two-gate audit, as a checklist

One teacher, many students: the cascade cuts both ways

Inheritance concentrates risk. If a safety-pretrained teacher becomes the foundation of a fleet of derivative models, a safety failure discovered in that teacher later is no longer one model’s problem; it is a recall question for every student built on it. The governance layer is what makes that traceable. EvalSafetyGap (arXiv 2606.30219) frames it directly: “Governance is therefore an assurance layer, not a behavioral safety score. Versioned model records, transparent evaluation protocols, independent access where feasible, and disclosure of attack budgets and judge configurations make safety claims more inspectable.” The compliance surface already exists in draft form: the EU AI Act’s GPAI Code of Practice Safety and Security section comprises Commitments II.1 through II.16, per an Oxford Martin AI Governance Initiative mapping of those commitments against current company practices, based on its abstract. And the supply-chain mechanism for propagating requirements downstream has been set out in the safety-critical software literature: a contract-based approach for deriving verifiable technical requirements is precisely the shape an inherited-alignment warranty would need.

Distillation is also dual-use, and the counter-demonstration is uncomfortably efficient. Adversarial Prompt Distillation (arXiv 2506.17231) distilled jailbreak capability from LLMs into a 109M-parameter BERT student, and reports (author-reported) that the student’s attack success rate against GPT-4 exceeded its teacher’s, 63.0 versus 54.5 in its Table 2. Their conclusion: “This validates our core hypothesis: effective jailbreaking capability can be distilled into lightweight models through careful alignment of distributions and dynamic temperature control.” If capability this adversarial transfers this cheaply, the audit cannot treat “it is a small distilled model” as a risk-reducing property in either direction.

What this evidence does not establish

The honest scope of the affirmative case is narrow. Every positive transfer result cited here comes from one author-reported preprint with no independent replication, and its own tables show the inheritance is partial: post-fine-tuning ASR of 5.16% (same-family student), 11.57% and 11.86% (cross-family students), and 0.80% for the safety-pretrained teacher (arXiv 2610.27555). The paper’s evals are text-level, which the GAP result shows can miss action-level failure entirely. The fine-tuning, pruning, capacity, and fidelity findings come from different model families and domains and inform the audit by analogy, not by direct test of safety distillation. And the EU AI Act material establishes a governance frame, not derivative-model obligations.

My recommendation, bounded accordingly: admit inherited safety into a safety case only through both gates, and treat Gate 1 as a screening question rather than evidence. A pipeline that matches SafePre-OnDistill’s conditions earns the student a cheaper verification program, not an exemption from one. If the vendor’s evidence is the teacher’s eval record, or the student was distilled off-policy, or the deployment includes tool use that was never adversarially tested on the student, the inherited-alignment claim should not pass review today. The preprint’s contribution is real but provisional: it sketches a mechanism by which safety training could stop being a per-model cost. Proving that any particular student received the inheritance remains, for now, a per-model job.