Meta Platforms researchers have unveiled a technique capable of identifying large language models trained on the outputs of a watermarked "teacher" model — far more reliably, they report, than existing token-counting methods. The approach, called WM-Basin, targets model distillation via APIs, a practice that has lowered the bar for replicating proprietary AI systems.

Copying a large language model once required stealing its weights. Now, it can arguably be done by querying a model extensively and training a smaller "student" model on the answers. Distillation itself is not inherently illicit — AI developers routinely use it to build smaller, cheaper models from larger ones — which is precisely what makes telling unauthorized copies apart from ordinary practice difficult. Researchers at Meta's FAIR and Superintelligence Labs say they have a better way to catch that. In testing, their black-box technique beat the prior state-of-the-art token-level detector by a wide margin.

What the paper found

The study, titled “Watermark Basins: Black-Box Detection of Distilled LLMs,” was published on October 27, 2026 under arXiv:2610.37266. It focuses on a specific scenario: someone queries a watermarked model through an API, collects the outputs, and trains a student model on them. Watermarking, in this setting, means embedding statistical patterns tied to a secret key into a model's text — invisible to ordinary readers, but recoverable with the right detection method.

The headline result is a 79% true-positive rate at a false-positive rate of just 0.1%, using n-gram=1. The previous best black-box token-level detector managed a true-positive rate of only 29% under the same conditions. According to the authors, the gap between the two methods widens further at stricter detection thresholds and with larger n-gram windows.

The evaluation was substantial in scale. The team tested 1,200 student models, ranging from 135 million to 8.2 billion parameters, that were trained on mathematical reasoning traces from OpenR1-Math. The experiments spanned six student architecture families, multiple teachers, and several watermarking schemes.

How WM-Basin works

WM-Basin feeds text generated by a suspect model into a fixed, clean probe model and converts that text into gradient representations. Put simply, it asks how the text would push the probe model's parameters if the probe were trained on it.

From there, the method separates ordinary fine-tuning directions from alignment with what the authors call a key-specific "watermark basin" in parameter space. A watermark leaves a directional signature, and WM-Basin looks for that direction rather than for individual telltale words.

A crucial practical detail: the tool needs only text outputs from the suspect model, obtained via API. It does not require access to the model's weights or logits.

Where the signal holds — and where it breaks

The researchers report that the detection signal survives several common post-distillation modifications. These include quantization, which compresses a model to run more cheaply; pruning, which strips out parameters; and reinforcement learning. WM-Basin also proved more reliable in situations where token-level signals fade, such as during low-temperature sampling.

The paper is candid about its limits, however. Extensive fine-tuning on clean data can degrade the signal. The authors flag continued supervised fine-tuning on unwatermarked data, as well as paraphrasing the teacher's traces, as potential evasion vectors.

What it means for AI developers

For anyone weighing enforcement action, the 0.1% false-positive rate is arguably the more important number. Any legal or contractual claim built on watermark evidence would face scrutiny over wrongful accusations. A method that holds a low false-alarm rate while catching 79% of copies is far more defensible than one catching 29%.

The enforcement landscape is also largely contractual rather than technical: major model API providers generally write terms of service that bar using outputs to train competing models, so the practical weight of a dispute tends to rest on exactly this kind of detection evidence.

Open questions remain. The evaluation centered on mathematical reasoning traces, so performance on other kinds of content is unresolved based on the data presented. Real-world copiers may also combine several evasion tactics at once, including the paraphrasing and clean-data fine-tuning the authors themselves identified.

Source: Meta paper shows watermarks can expose distilled AI models — CryptoBriefing, October 30, 2026. Original article edited by Diego Almada Lopez.