Watermark basin method detects stolen language models reliably
Watermark Basins: Black-Box Detection of Distilled LLMs
Cryptography and SecurityComputation and LanguageMachine Learning
Summary
Some companies worry that their language models are copied by others training new models on their outputs, which is called distillation. The authors found a hidden signal inside the copied models' inner workings that hints at this copying, even when usual clues in the words are hard to see. They created a new method called Watermark Basin Alignment that can detect if a model was copied just by asking it questions through its normal interface. Their tests show this method is much better at spotting copied models than older techniques, and the signal stays after some model changes.
What this means in practice
- •For ai service providers: Detect whether publicly available language models were illicitly copied by examining only their output through APIs, improving intellectual property protection.$Commercial implications: Enables AI companies to build products that prove unauthorized model copying from their services, protecting proprietary technology and licensing.
- •For security teams at software companies: Identify unauthorized reuse or modification of language models in deployed software by detecting watermark signals without needing access to model internals.
Authors
Hongyan Chang, Hady Elsahar, Tom Sander, Pierre Fernandez, Saeed Mahloujifar, Sylvestre-Alvise Rebuffi, Tomáš Souček, Tuan Tran, Valeriu Lacatusu, Surya Parimi, Rashel Moritz, Vanessa Stark, Alexandre Mourachko
Abstract
Proprietary language models and their reasoning traces are vulnerable to API-based distillation, where an adversary trains a student model on the teacher model's outputs. To obtain evidence of distillation, model providers can watermark the teacher's outputs, aiming to leave a radioactive signal in the student's outputs. Existing black-box detectors search for such radioactivity using token-level statistics of the suspect model's outputs. However, token-level signals are not always detectable, for instance when the distillation traces are sampled at a low temperature. In this work, we discover the watermark basin, a persistent signal that enables more reliable watermark detection: during fine-tuning, watermarked teacher traces embed a distinct, key-specific geometric signal in parameter space that lies orthogonal to the ordinary task-specific fine-tuning subspace. Building on this, we introduce Watermark Basin Alignment (WM-Basin), a black-box watermark detector that queries the suspect model through its API, without access to its weights or logits. WM-Basin maps generated text to gradient representations using a fixed clean probe model, projects out the ordinary fine-tuning task directions, and tests whether the residual gradient aligns with the watermark basin induced by the watermark key. We evaluate WM-Basin extensively across diverse teacher models and student architectures (from 135M to 8.2B parameters) distilled on mathematical reasoning. At a strict 0.1% false-positive rate, WM-Basin detects 79% of distilled models at n-gram=1 and 45% at n-gram=3, substantially improving over the state-of-the-art token-level baseline (29% and 1.3%, respectively). Because the watermark signal resides in a persistent basin, it survives post-distillation modifications including quantization, pruning, and reinforcement-learning post-training.