[D] Private dataset stealing via model distillation?

Are there any papers around the ethics/research of distillation on models trained on private datasets? (Or known occurrences where datasets have been stolen?)

it would seem that if you have a proprietary dataset and you train a model A on it, you might be able to "steal" the dataset by training a model B on model's A predictions. Could imagine this happening in industry, with the proliferation of proprietary models.

dataset distillation machinelearning model distillation