# Meta paper proposes black-box detection of distilled LLMs via watermark basins

> Original title: New Meta paper finds that a model distilled from watermarked API outputs keeps a hidden, key-specific trace in its weights, and that trac...

- Source: Rohan Paul
- Published: 2026-10-30T08:05:00.000Z
- Bad Influence: https://badinfluence.news/items/k1yqp41dwmbpc013yni5n9i17
- Original: https://x.com/rohanpaul_ai/status/2116078904662462729

## Summary

Meta researchers report a method called WM-Basin that detects distilled LLMs through their API outputs, without access to weights or logits. Across 1,200 distilled models at a 0.1% false-positive rate, it detected 79% of copies with n-gram=1 watermarks, versus 29% for token counting. The trace survived quantization, light pruning and RL post-training, though more fine-tuning on clean data weakened it.

## Post

New Meta paper finds that a model distilled from watermarked API outputs keeps a hidden, key-specific trace in its weights, and that trace can be read from the copy's text alone.

Today's detector counts watermark tokens in the suspect's text and misses most copies made with low-temperature sampling. 

They found that watermarked traces push a student's weights in a faint, key-specific direction. WM-Basin turns the suspect's API outputs into gradients of a fixed probe model and tests if they match the real key over decoys.

Across 1,200 distilled models at a 0.1% false-positive rate, it caught 79% with n-gram=1 watermarks, against 29% for token counting. Quantization, light pruning and RL post-training did not remove the trace, though more fine-tuning on clean data weakened it.

– arxiv. org/abs/2610.37266

Title: "Watermark Basins: Black-Box Detection of Distilled LLMs"

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHV3EyIKbYAArYKh.jpg&mode=thumb&exp=1793577600&sig=1ddafa72a8cee901)