Extraction-Aware Training Techniques

• Extraction-aware training is a methodological framework that directly optimizes models for extraction-specific outputs using structured supervision and tailored loss functions.
• It improves extraction fidelity with schema-centered objectives and curriculum-aware strategies, yielding measurable gains in event extraction and table extraction metrics.
• In security contexts, the approach integrates anti-extraction objectives and watermark preservation, significantly reducing model stealability while maintaining performance.

“Extraction-aware training” denotes a family of training strategies in which extraction itself is treated as the primary optimization target rather than a downstream by-product. In current research, the term spans two closely related but distinct usages. In information extraction, multimedia extraction, document extraction, table extraction, and target-signal extraction, training is organized around extraction structure—schemas, event types, argument roles, JSON outputs, speaker identity, or extraction-quality estimates—rather than generic next-token prediction or generic multimodal alignment (Jin et al., 14 Feb 2026, Thomas et al., 17 Jun 2025, Godoy, 26 Sep 2025). In security and privacy, the same phrase refers to training procedures that explicitly account for model extraction, parameter extraction, watermark survival under theft, or data-extraction risk, modifying either objectives or evaluation protocols so that extraction attacks become part of the learning problem (Kurian et al., 20 Sep 2025, Khaled et al., 30 Dec 2025, Mei et al., 10 Jun 2026). The term is not yet fully standardized; some papers use it explicitly, while others instantiate the underlying idea without naming it.

1. Conceptual scope and recurring design pattern

A useful synthesis is that extraction-aware training replaces generic proxy objectives with supervision that is closer to the actual extraction criterion. In task-oriented settings, the model is trained on structured outputs, abstention conditions, or extraction fidelity; in security-oriented settings, the model is trained with anti-extraction regularization, theft simulation, or extraction-aware robustness criteria. RMPL explicitly notes that it does not use the exact phrase “extraction-aware training” as a formal technical term, yet both of its stages are organized around event-specific outputs, event/argument schemas, and auxiliary relation signals that directly support argument grounding and event structure learning (Jin et al., 14 Feb 2026).

Orientation	Training signal made explicit	Representative papers
Task-structured extraction	Event schemas, relation triples, predicate/argument tags, NOTA rejection, JSON fields	(Jin et al., 14 Feb 2026, Mei et al., 2018, Zhao et al., 2023, Godoy, 26 Sep 2025)
Weak/semi-supervised extraction	Remix consistency, scene-aware synthetic triples, predicted extraction quality	(Zhao et al., 2022, Xu et al., 6 Jul 2026, Thomas et al., 17 Jun 2025)
Security-oriented extraction-awareness	Neuron-similarity regularization, divergence-aware QAT, simulated stolen models	(Kurian et al., 20 Sep 2025, Khaled et al., 30 Dec 2025, Mei et al., 10 Jun 2026)

This suggests that extraction-aware training is less a single algorithm than a recurring methodological pattern: the supervision, loss, curriculum, or synthetic data pipeline is redesigned so that the model is optimized for the actual extraction behavior of interest, including failure modes that conventional training would ignore.

2. Structured supervision and schema-centered optimization

RMPL provides a canonical instance of extraction-aware training for multimodal information extraction. Multimedia Event Extraction is defined over a document $$\mathcal{D}=\langle \mathcal{S}, \mathcal{M}\rangle$$, with event mention identification and argument role extraction as the two main subtasks. RMPL’s Stage I is a unified-schema conditional generation problem,

$$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$

where $t,i,r$ select textual event extraction, visual event extraction, and multimedia relation extraction, respectively. Stage II then specializes the warmed-up backbone for event mention identification and argument role extraction with classification-style objectives (Jin et al., 14 Feb 2026). The framework uses ACE 2005, SWiG augmented with imSitu grounding, and MNRE in Stage I, then evaluates on M2E2, which has no training split. On Qwen2-VL-7B, full RMPL improves event mention F1 from $63.63/67.36/78.04$ to $77.07/75.80/88.21$ for text-only / image-only / multimedia, and argument role F1 from $27.01/18.59/22.33$ to $53.50/51.75/45.20$ (Jin et al., 14 Feb 2026). The training target is therefore event structure itself, not generic multimodal alignment.

Halo applies the same principle at the representation level for cross-lingual information extraction. Its target vocabulary is partitioned into predicate tokens $\mathcal{P}$ and argument tokens $\mathcal{A}$, and the auxiliary objective requires a perturbed hidden state $\mathbf{h}'_t$ to preserve the semantic structure tag of the gold token rather than the exact token identity: $$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$0 The full objective is

$$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$1

This is extraction-aware because nearby decoder states are regularized to remain stable with respect to predicate-versus-argument structure, not merely lexical identity (Mei et al., 2018).

Open-set relation extraction via unknown-aware training extends the idea from structured prediction to structured rejection. The model decomposes into a classifier over known relations $$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$2 and a NOTA detection score $$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$3, with pseudo-unknown negatives synthesized by adversarially chosen token substitutions. The open-set prediction rule is thresholded: $$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$4 The full training objective,

$$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$5

teaches the extractor not only to classify known relations but also to reject realistic near-boundary pseudo-unknowns (Zhao et al., 2023). On FewRel, the method achieves ACC $$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$6, AUROC $$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$7, and FPR95 $$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$8; on TACRED, ACC $$p_\theta\!\left(Y \mid \mathcal{D}, \tau\right) = \prod_{n=1}^{|Y|} p_\theta\!\left(y_n \mid y_{<n}, \tau\right), \quad \tau \in \{t,i,r\},$$9, AUROC $t,i,r$0, and FPR95 $t,i,r$1 (Zhao et al., 2023). A common misconception is that extraction awareness always means stronger positive extraction; here it also means learning when not to force an input into the ontology.

3. Data-centric and quality-centric extraction-aware training

A second major lineage makes extraction awareness a property of the data pipeline rather than only the loss. SAYRE is exemplary: it generates document–schema–annotation triples $t,i,r$2 from a few exemplar documents by inferring content description $t,i,r$3 and layout description $t,i,r$4, then synthesizing structured output first and document appearance second (Xu et al., 6 Jul 2026). It also introduces error-driven generation from real-world failure cases by converting failure documents into HTML templates, rewriting text while preserving structure, and updating annotations consistently. The framework produces 1M data instances, augments them with realistic optical noise, and fine-tunes Qwen3-VL backbones. Qwen3-VL-2B improves from 60.34 to 70.47, and Qwen3-VL-4B from 64.25 to 72.92 average field-level F1 on UniKIE; field-level errors are reduced by 17.8%, especially on line-item fields, business identifiers, and contract clauses (Xu et al., 6 Jul 2026). The extraction-aware element is that the synthetic objects are not generic documents but explicit schema-conditioned supervision triples.

QUEST makes semi-supervised table extraction extraction-aware by changing how pseudo-labels are selected. Instead of trusting detector confidence, it trains an XGBoost quality model $t,i,r$5 to predict actual table-level F1 from a 108-dimensional feature vector comprising structural, contextual, and confidence features. Pseudo-labels are retained only when

$t,i,r$6

with $t,i,r$7, and diversity is enforced with DPP, Vendi Score, and IntDiv (Thomas et al., 17 Jun 2025). On the private business dataset, confidence/F1 correlation is only $t,i,r$8, whereas QUEST’s quality predictor reaches $t,i,r$9; F1 improves from 64% to 74%, and empty predictions fall from 12% to 6.5%. On DocILE, F1 increases from 42% to 50%, and empty predictions decrease from 27% to 22% (Thomas et al., 17 Jun 2025). This is extraction-aware training in a strict sense: the SSL loop is driven by predicted extraction fidelity rather than by model certainty.

Extract-0 pushes the data-centric view further by combining memory-preserving synthetic generation, LoRA-based SFT, and GRPO with an extraction-specific semantic reward. Documents are chunked, processed sequentially with a memory variable,

$63.63/67.36/78.04$0

and augmented into combined-schema tasks. The pipeline yields 281,128 synthetic examples, with 1,000 held out before training and 280,128 used for training. LoRA modifies only 40.4M of 7.66B parameters, or 0.53%, and RL uses a field-wise reward

$63.63/67.36/78.04$1

with zero reward for invalid JSON or missing required fields (Godoy, 26 Sep 2025). The base model scores 0.232 mean reward with 42.7% JSON validity; SFT raises this to 0.507 and 79.9%; SFT+GRPO reaches 0.573 and 89.0%, outperforming GPT-4.1 (0.457), o3 (0.464), and GPT-4.1-2025 (0.459) on the 1,000-task benchmark (Godoy, 26 Sep 2025). The reward design is explicitly extraction-aware because it encodes field validity, list matching, numeric similarity, date similarity, and schema compliance.

4. Output-aware and curriculum-aware training for target extraction

In target speaker extraction, extraction-aware training often means supervising properties of the extracted signal itself rather than only optimizing generic signal reconstruction. SAMoM is a weakly supervised example. A speaker-aware mixture $63.63/67.36/78.04$2 is a mixture containing multiple speakers with known identities and enrollment utterances, and a mixture of mixtures is formed as

$63.63/67.36/78.04$3

For each enrolled speaker, the extractor computes

$63.63/67.36/78.04$4

then reconstructs the original speaker-aware mixture by identity-aware remixing,

$63.63/67.36/78.04$5

and optimizes SI-SDR between $63.63/67.36/78.04$6 and $63.63/67.36/78.04$7 (Zhao et al., 2022). This replaces unavailable clean-source supervision with extraction-specific identity consistency. On Libri2Mix, SAMoM reaches 8.97 dB SI-SDRi, and 11.06 dB SI-SDRi with adaptation, compared with 5.72 dB for unsupervised MixIT. In cross-domain evaluation on aishell1-2mix, SAMoM-init + Adaptation reaches 5.86 dB SI-SDRi, exceeding Sup-init + Adaptation at 4.56 dB (Zhao et al., 2022).

SC-TSE makes speaker identity of the extracted waveform a direct training target. It computes an embedding from enrollment speech $63.63/67.36/78.04$8 and from extracted speech $63.63/67.36/78.04$9, then imposes a centroid-based speaker consistency loss

$77.07/75.80/88.21$0

combined with SI-SDR and, when applicable, speaker classification loss (Wu et al., 13 Jul 2025). Conditional Loss Suppression gates this auxiliary loss when speaker similarity is already high. On BSRNN with pretrained ECAPA, baseline SI-SDR / Acc. / Sim. are 13.34 / 91.08 / 84.28; adding $77.07/75.80/88.21$1 yields 13.85 / 92.10 / 86.92; adding CLS further reaches 14.29 / 95.15 / 86.83 (Wu et al., 13 Jul 2025). The extracted speech is thus trained not only to sound clean, but to remain recognizably the target speaker.

Training Dynamics-Aware Multi-Factor Curriculum Learning extends extraction awareness from outputs to optimization order. It argues that TSE difficulty is jointly determined by SNR, number of interfering speakers, overlap ratio, and interference source type. A handcrafted three-stage curriculum uses

$77.07/75.80/88.21$2

for $77.07/75.80/88.21$3, and TSE-Datamap further partitions samples into easy, ambiguous, and hard regions via per-sample mean and standard deviation of $77.07/75.80/88.21$4SNR over epochs (Liu et al., 5 Mar 2026). The best ordering is Easy $77.07/75.80/88.21$5 Ambiguous $77.07/75.80/88.21$6 Hard. Random sampling yields iSDR 12.38 / 8.56 / 7.16 on 2spk / 3spk / 4spk mixtures; the handcrafted multi-factor curriculum improves this to 13.22 / 10.08 / 9.21; the datamap-guided E/A/H schedule reaches 13.15 / 9.85 / 9.32 (Liu et al., 5 Mar 2026). A plausible implication is that extraction-aware curricula should be defined by observed extraction dynamics rather than by static metadata alone.

5. Security-oriented extraction-aware training

In security-oriented work, extraction-aware training denotes training that anticipates model theft or parameter recovery. The most explicit example is “Extraction-Aware Training (EAT)” for cryptanalytic parameter extraction. Its core idea is to eliminate the neuron uniqueness required by cryptanalytic attacks by adding a similarity-promoting regularizer: $77.07/75.80/88.21$7 The layer-wise penalty minimizes squared differences between neuron parameters within a layer, and the paper argues that defending only the first layer may suffice because later-layer extraction depends on correctly recovering first-layer outputs (Kurian et al., 20 Sep 2025). Retrained models incur less than 1% accuracy change, while prior attack settings that extracted unprotected models in roughly 14 minutes to 4 hours fail to extract protected models within 48 hours. For MNIST784-16x8-1 (s2), the attack success probability falls from 0.74 to 0.0017, a $77.07/75.80/88.21$8 reduction (Kurian et al., 20 Sep 2025). Here extraction awareness is a property of the objective itself.

DivQAT applies the same principle to soft-label model stealing of quantized CNNs. It modifies QAT by maximizing divergence from the full-precision model while retaining label accuracy: $77.07/75.80/88.21$9 The goal is to make the deployed quantized model less informative to extraction attacks that rely on probability vectors (Khaled et al., 30 Dec 2025). Relative to QAT, DivQAT raises adversary classification error by 1.30% to 11.75% for KnockoffNets, 9.76% to 77.17% for DFME, and 4.64% to 85.06% for MAZE. It is especially strong against data-free attacks, though the utility trade-off is dataset-dependent (Khaled et al., 30 Dec 2025). This directly counters a common assumption that anti-extraction defenses must be post hoc output perturbations.

T2S addresses a different security problem: making watermarks survive model extraction. It inserts a simulated stolen model into training, updates that simulated model by distillation from the target, computes its watermark loss on a trigger set, and backpropagates that loss through the simulated extraction step into the target model: $27.01/18.59/22.33$0 This is explicitly rehearsal-based and second-order (Mei et al., 10 Jun 2026). On CIFAR-10, stolen-model watermark success rate reaches 99.87% under Knockoff soft-label and 97.56% under Knockoff hard-label; on CIFAR-100, the corresponding numbers are 95.42% and 68.68% (Mei et al., 10 Jun 2026). The paper is notable because it shows that extraction-aware training can target not only resistance to theft, but also transferability of desired behavior through theft.

6. Adversarial evaluation, attack-side training, and unresolved tensions

Several papers use extraction-aware training offensively or redefine how it should be evaluated. LoRD is an extraction algorithm for aligned LLMs that argues conventional MLE and KD are inconsistent with RLHF-style alignment. It replaces direct imitation with locality-reinforced preference optimization over the local model’s own sampled responses. On PIQA, victim accuracy is 0.828, MLE reaches 0.760 ± 0.02, KD 0.759 ± 0.02, and LoRD 0.785 ± 0.01; the paper further reports that required query numbers are reduced by about 87% relative to MLE (Liang et al., 2024). DMRL similarly treats data extraction as a learned optimization problem: it builds a demonstration dataset, trains category-specific shadow reward models by inverse RL, and optimizes the extraction policy with GRPO using data- and model-hardness coefficients. On GPT-2 Large, DMRL reaches 21.71 PII reconstruction on ECHR versus 18.25 for AL-PII, and 15.41 on Enron versus 12.72 for AL-PII (Wang et al., 7 May 2025). These works show that extraction-aware training is not exclusively defensive; it can also mean training the extractor itself.

The evaluation literature sharpens this picture. “Careful What You Wish For” shows that adversarially trained vision models are more extractable than naturally trained ones in a probability-output black-box setting, with surrogates achieving up to $27.01/18.59/22.33$1 higher accuracy and agreement using less than $27.01/18.59/22.33$2 of the queries; extracted surrogates also inherit some adversarial robustness (Khaled et al., 2022). “Towards More Realistic Extraction Attacks” argues that extraction risk composes across prompt variants, model sizes, and checkpoints, and reports up to $27.01/18.59/22.33$3 higher extraction risk by combining attack surfaces, with 3–4× higher extraction than the base setup when multiple axes are composed (More et al., 2024). These papers imply that extraction-aware training should be evaluated against unions of attack surfaces rather than single canonical attacks.

A comparable lesson appears for diffusion LLMs. “Extracting Training Data from Diffusion LLMs via Infilling” defines infilling extraction

$27.01/18.59/22.33$4

for arbitrary binary masks $27.01/18.59/22.33$5, and shows that prefix-only audits are incomplete. Edge-conditioned masks extract up to three times more verbatim sequences than prefix-conditioned ones, and targeted infilling can recover redacted email addresses with higher recall than scale-matched autoregressive models under the paper’s realistic redaction threat model (Wang et al., 22 May 2026). A follow-up supervised finetuning stage does not eliminate the prior memorization (Wang et al., 22 May 2026). This suggests that extraction-aware training must be architecture-specific: for autoregressive models, prefix continuation is central; for diffusion LLMs, arbitrary-mask conditional reconstruction is the relevant leakage channel.

Taken together, these lines of work establish a broad but coherent principle. Extraction-aware training replaces generic optimization targets with supervision that reflects either the structure of the extraction output or the structure of the extraction threat. Its success often comes from making latent assumptions explicit: that events have arguments and roles, that unknown relations should be rejected, that pseudo-label quality should track extraction F1 rather than confidence, that extracted waveforms must preserve speaker identity, that watermark knowledge must survive distillation, or that probability outputs themselves are an extraction surface. The unresolved issues are correspondingly structural: there is no unified standard definition, trade-offs with utility or robustness remain domain-dependent, and several methods rely on schema harmonization, synthetic data design, or evaluation assumptions that may not transfer automatically. A plausible implication is that future work will need a more unified theory of extraction-aware optimization across structured prediction, weak supervision, and security, but the existing literature already shows that treating extraction as the primary object of training changes both performance and failure modes in measurable ways.