Watermark Basins: Black-Box Detection of Distilled LLMs
AuthorsHongyan Chang, Hady Elsahar, Tom Sander, Pierre Fernandez, Saeed Mahloujifar, Sylvestre-Alvise Rebuffi, Tomáš Souček, Tuan Tran, Valeriu Lacatusu, Surya Parimi, Rashel Moritz, Vanessa Stark, Alexandre Mourachko
AffiliationsFAIR, Meta Superintelligence Labs
A new black-box method detects when an LLM may have been distilled from watermarked outputs by looking for a persistent signal in how its responses relate to model gradients.
Key results
Detection rate at 0.1% false-positive rate across 1,200 distilled models.
Detection rate at 0.1% false-positive rate across 1,200 distilled models.
Detection rate at 0.1% false-positive rate, compared with WM-Basin.
Detection rate at 0.1% false-positive rate, compared with WM-Basin.
Students evaluated across architectures for the main detection comparison.
What the paper found
In a study from Meta, researchers introduce WM-Basin, a black-box method for detecting whether a competing model was distilled from a watermarked language model. Instead of counting watermark-favored tokens, WM-Basin converts the suspect’s API-generated text into gradients using a fixed clean probe model, removes shared task directions with PCA, and checks whether the remaining gradient aligns with the claimed watermark key more strongly than with decoy keys. A rank test provides finite-sample false-positive control without access to the suspect’s weights or logits. Across 1,200 students distilled from DeepSeek-R1-Distill-Qwen-14B on OpenR1-Math, WM-Basin detected 79% of models at n-gram=1 and 45% at n-gram=3, with a 0.1% false-positive rate; the token-level baseline detected 29% and 1.3%, respectively. Tests covered student architectures from 135M to 8.2B parameters, four teachers, and four watermark schemes. Detection persisted after quantization, pruning, and reinforcement-learning post-training, though continued clean-data fine-tuning could weaken the signal visible in generated text. The central finding is that watermarked distillation leaves a persistent, key-specific direction in the student’s parameter-space geometry, which can be inferred indirectly from its outputs.
Original abstract
Proprietary language models and their reasoning traces are vulnerable to API-based distillation, where an adversary trains a student model on the teacher model's outputs. To obtain evidence of distillation, model providers can watermark the teacher's outputs, aiming to leave a radioactive signal in the student's outputs. Existing black-box detectors search for such radioactivity using token-level statistics of the suspect model's outputs. However, token-level signals are not always detectable, for instance when the distillation traces are sampled at a low temperature. In this work, we discover the watermark basin, a persistent signal that enables more reliable watermark detection: during fine-tuning, watermarked teacher traces embed a distinct, key-specific geometric signal in parameter space that lies orthogonal to the ordinary task-specific fine-tuning subspace. Building on this, we introduce Watermark Basin Alignment (WM-Basin), a black-box watermark detector that queries the suspect model through its API, without access to its weights or logits. WM-Basin maps generated text to gradient representations using a fixed clean probe model, projects out the ordinary fine-tuning task directions, and tests whether the residual gradient aligns with the watermark basin induced by the watermark key. We evaluate WM-Basin extensively across diverse teacher models and student architectures (from 135M to 8.2B parameters) distilled on mathematical reasoning. At a strict 0.1% false-positive rate, WM-Basin detects 79% of distilled models at n-gram=1 and 45% at n-gram=3, substantially improving over the state-of-the-art token-level baseline (29% and 1.3%, respectively). Because the watermark signal resides in a persistent basin, it survives post-distillation modifications including quantization, pruning, and reinforcement-learning post-training.
Read the original paperMore in Large Language Models
Browse all 93 papers →Advancement or Acceleration? How Data Curation Improves LLM Training
Jiaxing Wang, Zicheng Zhang, Deping Xiang, Jin Xu, Yong Li, Chao Liu, Pengzhang Liu, Qixia Jiang
This paper asks whether better-curated data helps LLMs learn more or simply helps them learn the same things faster.
S3AC: Stabilized, Selective, and Scalable Actor-Critic for LLM Reasoning
Shuo Shen, Guangran Cheng, Chengqi Lyu, Xiangsen Wang, Yanan Sun, Wenwei Zhang
S3AC trains a critic to improve token-level feedback for LLM reasoning and uses it to select more useful prompts, aiming to make reinforcement learning more effective and efficient.
Belief-Trajectory Energy: Measuring the Path to a Prediction
Jiahao Ying, Wei Tang, Boxian Ai, Yaoning Wang, Haotian Chen, Wenhe Sun, Caijun Xu, Haozhan Cai, Changyi Xiao, Yixin Cao
Belief-Trajectory Energy tracks how an LLM’s predictions change across layers to reveal information that its final answer alone can miss.