Distilled models carry a watermark in their weights
Reviewing Watermark Basins: Black-Box Detection of Distilled LLMs · Hongyan Chang, Hady Elsahar, Tom Sander et al.
Researchers show that a student model trained on a watermarked teacher's outputs carries a faint, key-specific mark in its weights, readable through its API alone. The mark survives compression and reinforcement-learning post-training, giving providers stronger evidence of distillation, though more training on clean data can hide it.
Train a model on someone else's API outputs and you inherit more than their answers. New research shows that a watermarked teacher leaves a faint, key-specific mark in the student's weights. That mark can be read back through the student's own API.
Start with how watermarking normally works. The provider uses a secret key to nudge the teacher's word choices, so some tokens become slightly more likely than chance. A student trained on that text learns the bias too. Detectors then query the suspect model and count how often the favoured tokens appear.
That count is fragile. If the distiller samples the teacher at low temperature, the teacher mostly picks its top token and the nudge barely shows. The best existing token-level detector caught 29% of distilled models at a strict 0.1% false-positive rate.
The researchers' detector, WM-Basin, looks somewhere else. It feeds text generated by the suspect into a fixed, clean probe model. Then it asks which way that text would push the probe's weights if the probe learned from it. Most of that push is ordinary maths learning, shared by every student. So the method strips out those common directions and checks whether what remains points towards the claimed key.
The claimed key is ranked against many random decoy keys. If it stands out, you get an exact p-value rather than a hunch. At the same false-positive rate, detection rises to 79%. In a harder watermark setting the old detector found almost nothing, while this one still caught nearly half.
What I find most interesting is why the mark persists. Quantisation, pruning and reinforcement-learning post-training mostly move weights along the task direction. The watermark sits roughly at right angles to it, so those operations leave it alone. The usual cheap laundering steps do not clean the model.
This is a defence, so the real question is what a distiller who knows about it does next. The paper partly answers that. Continued fine-tuning on clean data suppresses the signal in the suspect's text, even though the mark is still in the weights. Recovering it then needs white-box access, and a provider auditing a competitor's API rarely has that. Paraphrasing the traces before training is another obvious route.
There are practical conditions too. The teacher must have been watermarked from the start. The audit must probe the same capability the student was distilled on, so a maths fingerprint needs maths prompts. Building the bank of decoy keys is a heavy one-time cost.
I still think this is a real step for providers. Casual distillation now leaves calibrated evidence behind. Compression will not wash it out. More training on clean data might.
Further analysis
Problem
The paper studies the problem of proving that a black-box suspect model was distilled from a watermarked proprietary teacher model via API-based distillation. Token-level watermark detectors are fragile, especially when teacher outputs are sampled at low temperature or when exact token contexts do not recur, so providers need a more reliable, black-box method to obtain evidence of distillation for provenance, licensing and IP protection.
Approach
The authors identify a persistent parameter-space signature they call the watermark basin: fine-tuning on watermarked teacher traces displaces students along a faint, key-specific direction that is largely orthogonal to the ordinary task fine-tuning direction. They introduce Watermark Basin Alignment (WM-Basin), a black-box detector that queries the suspect model via its API only. WM-Basin maps generated text into gradients of a fixed clean probe model, averages gradients over prompts, projects out top principal components that capture shared task structure, and measures cosine alignment between the residual suspect gradient and a precomputed reference gradient for the claimed watermark key. The claimed key is ranked among many i.i.d. decoy keys to produce an exact non-parametric p-value. The verifier builds most artefacts offline (probe warm-up, reference bank per key, task subspace) and then audits suspects by sampling completions and scoring their residual gradients against the bank.
Key Findings
- WM-Basin substantially outperforms token-level black-box baselines: at a strict 0.1% false-positive rate it detects 79% of distilled models at n-gram=1 and 45% at n-gram=3, compared with 29% and 1.3% for the state-of-the-art token-level detector.
- The watermark basin is persistent: the key-specific component survives common post-distillation operations such as quantization, pruning and reinforcement-learning post-training; these operations mostly move weights along the task axis and not out of the watermark basin.
- WM-Basin is robust across many teachers, student architectures and watermark schemes: evaluations covered 24 student architectures (135M to 8.2B parameters), 44 teachers and 44 watermarking schemes, and the method still flags a large fraction of distilled students while the token-level baseline often fails.
- The detector is domain-sensitive: it requires the verifier to audit the same capability domain as the distillation traces. Continued supervised fine-tuning on clean data can suppress the text-level signal and reduce black-box detection power, although the basin remains present in weights and is recoverable with white-box access.
- Operational trade-offs: the method needs teacher traces under the claimed and many decoy keys to build the reference bank; high resolution p-values require many decoys and the bank construction is the dominant one-time compute cost, while per-suspect evaluation is cheaper but non-trivial.
Limitations
WM-Basin requires that the teacher actually embeds a keyed watermark and that the audited domain matches where the suspect carries the watermark. It depends on a probe model and on obtaining sufficient suspect text that reflects the teacher’s token distribution. Continued fine-tuning or aggressive paraphrasing of teacher traces before distillation can weaken or hide the black-box signal even though the basin may remain in weight space. The method is also computationally heavier to set up than token-level tests because of the reference bank and probe warm-up.
Implications
An attacker who distils from a watermarked teacher will likely leave a faint, key-specific parameter-space fingerprint that can be recovered via WM-Basin using only API access and a fixed probe. This enables model providers or authorised auditors to supply calibrated evidence that a suspect was trained on watermarked outputs, even when token-level signals are unavailable. Offensive implications include that adversaries cannot easily remove the radioactivity by simple compression or short post-training, but they could try prolonged or targeted continued fine-tuning, paraphrasing traces prior to distillation, or other adaptations that alter the suspect’s output distribution to evade black-box detection.
The paper title, authors and abstract
Watermark Basins: Black-Box Detection of Distilled LLMs
Proprietary language models and their reasoning traces are vulnerable to API-based distillation, where an adversary trains a student model on the teacher model's outputs. To obtain evidence of distillation, model providers can watermark the teacher's outputs, aiming to leave a radioactive signal in the student's outputs. Existing black-box detectors search for such radioactivity using token-level statistics of the suspect model's outputs. However, token-level signals are not always detectable, for instance when the distillation traces are sampled at a low temperature. In this work, we discover the watermark basin, a persistent signal that enables more reliable watermark detection: during fine-tuning, watermarked teacher traces embed a distinct, key-specific geometric signal in parameter space that lies orthogonal to the ordinary task-specific fine-tuning subspace. Building on this, we introduce Watermark Basin Alignment (WM-Basin), a black-box watermark detector that queries the suspect model through its API, without access to its weights or logits. WM-Basin maps generated text to gradient representations using a fixed clean probe model, projects out the ordinary fine-tuning task directions, and tests whether the residual gradient aligns with the watermark basin induced by the watermark key. We evaluate WM-Basin extensively across diverse teacher models and student architectures (from 135M to 8.2B parameters) distilled on mathematical reasoning. At a strict 0.1% false-positive rate, WM-Basin detects 79% of distilled models at n-gram=1 and 45% at n-gram=3, substantially improving over the state-of-the-art token-level baseline (29% and 1.3%, respectively). Because the watermark signal resides in a persistent basin, it survives post-distillation modifications including quantization, pruning, and reinforcement-learning post-training.
