Meta paper shows watermarks can expose distilled AI models

Copying a large language model has evolved from requiring theft of its weights to potentially being accomplished through extensive querying and training a smaller model on the responses. Researchers at Meta believe they've developed a superior method to detect this practice. Their paper introduces WM-Basin, a black-box technique that identifies models distilled from watermarked teacher models, significantly outperforming previous detection methods in testing.

The study, titled "Watermark Basins: Black-Box Detection of Distilled LLMs," was published on October 27, 2026 under arXiv:2610.37266. It focuses on a specific scenario where someone queries a watermarked model through an API, collects the outputs, and trains a "student" model on them.

Detection breakthrough

The headline result shows WM-Basin achieving a 79% true-positive rate at a false-positive rate of just 0.1%, using n-gram=1. This represents a significant improvement over the previous best black-box token-level detector, which only managed a 29% true-positive rate under the same conditions. According to the authors, the performance gap widens further at stricter detection thresholds and with larger n-gram windows.

The evaluation was comprehensive, testing 1,200 student models ranging from 135 million to 8.2 billion parameters. These students were trained on mathematical reasoning traces from OpenR1-Math, across six student architecture families, multiple teachers, and several watermarking schemes.

How WM-Basin operates

WM-Basin works by feeding the suspect model's generated text into a fixed, clean probe model and converting that text into gradient representations. Essentially, it analyzes how the text would influence the probe model's parameters if the probe were trained on it. The method then distinguishes ordinary fine-tuning directions from alignment with what the authors term a key-specific "watermark basin" in parameter space.

A crucial practical advantage is that the tool only requires text outputs from the suspect model via API, eliminating the need for access to weights or logits. This makes it more accessible for real-world applications where such access might be restricted.

Robustness and limitations

The researchers report that the detection signal survives several common post-distillation modifications, including quantization (which compresses a model to run cheaper), pruning (which strips out parameters), and reinforcement learning. WM-Basin also proves more reliable when token-level signals fade, such as during low-temperature sampling.

This development comes as Meta continues to invest heavily in AI research, with the company reporting annual revenue of $201.0 billion USD for the fiscal year ended 2025-12-31, representing a 22.2% increase from the previous year.