Meta FAIR's WM-Basin flags 79% of distilled models at 0.1% false-positive rate
dair_ai · x · 2026-10-29
Meta FAIR published "Watermark Basins: Black-Box Detection of Distilled LLMs," a stronger defense against API-based distillation attacks.
Key ideas and results:
- When a student trains on watermarked teacher traces, the watermark key leaves a distinct geometric direction in the student's weights, orthogonal to normal fine-tuning directions — persisting even when no token-level trace remains.
- WM-Basin needs only API access: it maps the suspect model's outputs to gradients on a clean probe model, removes task directions, and checks the residual against the watermark-basin direction.
At a strict 0.1% false-positive rate it detects 79% of distilled models (45% at n-gram=3), versus 29% / 1.3% for the best token-level baseline. The signal survives quantization, pruning, and RL post-training; students range from 135M to 8.2B parameters.
More from Safety
- Orange Tsai's exploit chain pops browser from calculator, hailed as peak hacking — rez0__ · 2026-10-29
- Independent eval finds DeepSeek V4.1 Flash-1017 near-parity with closed models on safety — FangcunAI · 2026-10-29
- Cryptographer Matthew Green: clever claimed subexponential ECDLP algorithm has zero practical implications — matthew_d_green · 2026-10-29
- Why AI sandbox escapes mostly happen in training: alignment must live in RL environments, not rewards — DimitrisPapail · 2026-10-29
- NYT: Chinese spy suspect cultivated close ties with Nvidia CEO Jensen Huang — almmaasoglu · 2026-10-29
- Matthew Green: harsh vuln triage policies entitle researchers to public disclosure — matthew_d_green · 2026-10-29