When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need

Ziming Hong, Runnan Chen, Zengmao Wang, Bo Han, Bo Du, Tongliang Liu

Abstract: Data-free knowledge distillation (DFKD) transfers knowledge from a teacher to a student without access the real in-distribution (ID) data. Its common solution is to use a generator to synthesize fake data and use them as a substitute for real ID data. However, existing works typically assume teachers are trustworthy, leaving the robustness and security of DFKD from untrusted teachers largely unexplored. In this work, we conduct the first investigation into distilling non-transferable learning (NTL) teachers using DFKD, where the transferability from an ID domain to an out-of-distribution (OOD) domain is prohibited. We find that NTL teachers fool DFKD through divert the generator's attention from the useful ID knowledge to the misleading OOD knowledge. This hinders ID knowledge transfer but prioritizes OOD knowledge transfer. To mitigate this issue, we propose Adversarial Trap Escaping (ATEsc) to benefit DFKD by identifying and filtering out OOD-like synthetic samples. Specifically, inspired by the evidence that NTL teachers show stronger adversarial robustness on OOD samples than ID samples, we split synthetic samples into two groups according to their robustness. The fragile group is treated as ID-like data and used for normal knowledge distillation, while the robust group is seen as OOD-like data and utilized for forgetting OOD knowledge. Extensive experiments demonstrate the effectiveness of ATEsc for improving DFKD against NTL teachers.

Lay Summary: We present the first study on distilling non-transferable learning (NTL) teachers using data-free knowledge distillation (DFKD). We show that NTL teachers can mislead DFKD by diverting its focus from meaningful in-distribution (ID) knowledge to misleading out-of-distribution (OOD) knowledge (i.e., OOD trap effect), raising broader concerns about the trustworthiness, safety, and robustness of existing DFKD methods. To tackle this issue, we propose Adversarial Trap Escaping (ATEsc)—a plug-and-play module that identifies and filters out OOD-like synthetic samples, thereby calibrating DFKD to focus on learning correct ID knowledge. Experimental results demonstrate that ATEsc significantly improves the performance of DFKD when applied to NTL teachers.

Link To Code: https://github.com/tmllab/2025_ICML_ATEsc

Primary Area: General Machine Learning->Transfer, Multitask and Meta-learning

Keywords: Data-free Knowledge Distillation, Non-Transferable Learning

Submission Number: 408