PaperlayerView exact revision on arXiv

Source-linked AI summary

Watermark Basins: Black-Box Detection of Distilled LLMs

Hongyan Chang, Hady Elsahar, Tom Sander, Pierre Fernandez, Saeed Mahloujifar, Sylvestre-Alvise Rebuffi, Tomáš Souček, Tuan Tran, Valeriu Lacatusu, Surya Parimi, Rashel Moritz, Vanessa Stark, Alexandre Mourachko

arXiv:2610.37266v1cs.CRcs.CLcs.LG

TL;DR

API-based distillation threatens proprietary models, while token-level watermark detection can lose power when watermark-conditioned contexts do not recur. WM-Basin detects a persistent key-specific signal by comparing probe-gradient alignment after removing common task directions. It outperforms the token-level baseline in the reported detection results and remains effective after several post-training modifications.

  • Problem

    API-based distillation threatens proprietary models, and token-level watermark detection loses power when watermark-conditioned contexts do not recur, including under low-temperature sampling.

    Source: §1 · p. 2

  • Method

    WM-Basin maps suspect and keyed-teacher text to gradients of a fixed clean probe model, removes shared task variation, and ranks residual alignment against decoy keys.

    Source: §1 · p. 2, §2.3 · p. 5

  • Results

    At 0.1% false-positive rate, WM-Basin detects 79% of distilled models at n-gram=1 and 45% at n-gram=3, versus 29% and 1.3% for the token-level baseline.

    Source: §1 · p. 3

  • Takeaways & Limitations

    The key-specific basin remains detectable after quantization, pruning, and reinforcement-learning post-training, supporting detection beyond token-level output statistics.

    Source: §1 · p. 3

    Continued clean-data training can suppress the text-level signal, and a low score means only that no watermark was found on the audited domain.

    Source: §5 · p. 12

Abstract

from arXiv · show

Proprietary language models and their reasoning traces are vulnerable to API-based distillation, where an adversary trains a student model on the teacher model's outputs. To obtain evidence of distillation, model providers can watermark the teacher's outputs, aiming to leave a radioactive signal in the student's outputs. Existing black-box detectors search for such radioactivity using token-level statistics of the suspect model's outputs. However, token-level signals are not always detectable, for instance when the distillation traces are sampled at a low temperature. In this work, we discover the watermark basin, a persistent signal that enables more reliable watermark detection: during fine-tuning, watermarked teacher traces embed a distinct, key-specific geometric signal in parameter space that lies orthogonal to the ordinary task-specific fine-tuning subspace. Building on this, we introduce Watermark Basin Alignment (WM-Basin), a black-box watermark detector that queries the suspect model through its API, without access to its weights or logits. WM-Basin maps generated text to gradient representations using a fixed clean probe model, projects out the ordinary fine-tuning task directions, and tests whether the residual gradient aligns with the watermark basin induced by the watermark key. We evaluate WM-Basin extensively across diverse teacher models and student architectures (from 135M to 8.2B parameters) distilled on mathematical reasoning. At a strict 0.1% false-positive rate, WM-Basin detects 79% of distilled models at n-gram=1 and 45% at n-gram=3, substantially improving over the state-of-the-art token-level baseline (29% and 1.3%, respectively). Because the watermark signal resides in a persistent basin, it survives post-distillation modifications including quantization, pruning, and reinforcement-learning post-training.

1 Introduction

API-based distillation can extract proprietary models’ outputs, while existing output-watermark detectors lose power when watermark-conditioned token contexts do not recur. The paper introduces a persistent, key-specific parameter-space signal and uses it for black-box detection.

1 Introduction

  • Concealing reasoning traces does not prevent distillation: hidden traces can be extracted, while answers and short summaries can be expanded into synthetic traces.The introduction frames API-based distillation as a threat to proprietary language models and their reasoning traces.Source: §1 · p. 2
  • Existing black-box detection tests for excess watermark-favored tokens only where watermark-conditioned contexts recur, and loses much of its power under low-temperature sampling.The paper therefore seeks a signal that does not require exact token-level recurrence.Source: §1 · p. 2
  • WM-Basin maps suspect and teacher text to gradients of a fixed clean probe model, removes the shared task subspace, and compares residual alignment against decoy keys.A non-parametric ranking test turns the relative rank into a calibrated p-value.Source: §1 · p. 2
  • 79% of distilled models are detected at n-gram=1 and 45% at n-gram=3, versus 29% and 1.3% for the token-level baseline, at 0.1% false-positive rate.These results are among 1,200 students distilled from DeepSeek-R1-Distill-Qwen-14B on OpenR1-Math traces.Source: §1 · p. 3
  • Watermarked fine-tuning adds a faint, key-specific direction to the broad task direction, placing students in a persistent watermark basin.Post-training operations displace weights primarily along the task axis and leave the key-specific component intact.Source: §1 · p. 3
  • Across 24 student architectures, four teachers, and four watermarking schemes, WM-Basin achieves 79% TPR at 0.1% FPR versus 29% for the token-level detector.The reported detection remains effective after quantization, pruning, and reinforcement-learning post-training.Source: §1 · p. 3

2 Watermark-Basin Detection

The paper studies whether keyed watermarking leaves a persistent parameter-space signal and develops a black-box test that detects it from suspect-model text. The method isolates key-specific alignment from ordinary task variation and evaluates the claimed key against decoys.

2.1 Threat Model and Statistical Setup

  • The verifier audits a chosen domain using disjoint build and test prompt pools, observes only suspect outputs, and tests whether those outputs contain information about the claimed key.Rejecting the null establishes watermark radioactivity through the distillation path; failure to reject is scoped to the audited domain.Source: §2.1 · pp. 3–4

2.2 Watermark Basins in Parameter Space

  • The white-box analysis isolates the watermark-specific update by subtracting the clean control’s task update from the watermarked student’s total update.The resulting watermark and task directions are normalized to define the two axes used to map the basin.Source: §2.2 · p. 4
  • A small step along the watermark axis collapses detection significance, while much larger task-axis displacements leave the signal detectable.This anisotropic basin motivates decoy-key comparison because its narrow watermark dimension is key-specific.Source: §2.2 · p. 4, §2.1 · p. 4

2.3 WM-Basin: Black-Box Estimation via Probe Gradients

  • WM-Basin represents suspect and keyed-teacher completions as gradients of one fixed clean probe model, providing a shared coordinate system for comparing fine-tuning tendencies.The gradients do not reconstruct the suspect’s hidden weight update; a fixed random projection maps them to 8,192 dimensions while approximately preserving inner products.Source: §2.3 · p. 5
  • The method projects probe gradients off the top principal directions of clean-model variation, then compares the residual gradients by cosine similarity.The clean basis is fit on clean models alone, not suspects.Source: §2.3 · p. 5
  • Because alignment scores have no absolute scale, the verifier ranks the claimed key among independent decoy keys and uses that rank as a p-value.Under the null, exchangeability gives exact finite-sample validity; the smallest attainable p-value is 1/(M+1).Source: §2.3 · p. 5
  • The build-once stage constructs the warmed probe, reference bank, and task basis without querying the suspect; only the detection stage incurs per-suspect querying.The claimed key enters the ranking test in the same way as each decoy key.Source: §2.3 · p. 5

3 Experiments and Results

The experiments evaluate WM-Basin and a black-box token detector across student architectures, teachers, watermark schemes, audit domains, distillation recipes, and post-training changes. The default setup uses TextSeal-watermarked math traces, with detection audited on separate prompts and compared against the token detector.

3.2 Detection Performance

  • At n-gram=3 and p≤0.001, WM-Basin detects 45% of distilled models, versus 1.3% for the black-box baseline across 1,200 students.The models span 24 architectures from 135M to 8.2B parameters.Source: §3.2 · p. 7, Table 1 · p. 7
  • At T=0.5, WM-Basin still flags every suspect at n-gram=1 and about half at n-gram=3, while lower temperature costs the baseline most of its power.The reference gradient bank remains fixed at T=1.0.Source: §3.2 · p. 8, Table 2 · p. 8
  • At p≤0.05, WM-Basin detects 96 to 100% of distilled models across four teachers, while baseline power varies sharply by teacher.The Qwen2.5-3B student is distilled from teachers spanning three families and 8B to 120B parameters.Source: §3.2 · p. 8, Table 3 · p. 8
  • WM-Basin flags every student at n-gram=1 and p≤0.01 under each of three alternative watermark schemes, outperforming the baseline in every cell.The reference bank is rebuilt to match each scheme; WM-Basin needs keyed teacher traces, not the scheme’s own detection test.Source: Table 4 · p. 8, §3.2 · p. 9
  • WM-Basin ranks each of three math audit domains above both non-math domains in every cell, so detection reflects where the suspects were distilled.A low score on another domain means no watermark was found there, not that the model is clean.Source: §3.2 · p. 9, Table 5 · p. 9
  • At n-gram=3, WM-Basin performs at chance with at most 10% watermarked traces, exceeds 90% TPR at 75%, and rises from 16% at LoRA rank 16 to 100% at rank 512.One training epoch already yields 78% TPR; the baseline stays at or below 2% across watermarked fractions.Source: §3.2 · pp. 9–10, Figure 4 · p. 9

3.3 Post-processing and Basin Dynamics

  • Int8 quantization and 10% pruning cost WM-Basin at most three points, while other tested compression operations weaken detection but leave the student unusable.Every compression operation displaces the student at least three orders of magnitude farther orthogonally to the watermark direction than along it.Source: §3.3 · p. 10, Table 6 · p. 10
  • Continued GRPO leaves every distilled model detectable at p≤0.05 across windows, while continued SFT substantially reduces black-box detection without moving students out of the watermark basin.General-reasoning SFT moves students furthest along the watermark direction; multilingual-math SFT moves them less, and GRPO barely at all.Source: §3.3 · p. 10

4 Related Work

Related work frames WM-Basin against API-based model extraction, defenses, and prior watermark-radioactivity detection. It connects the method to weight-space basin geometry and gradient-based attribution, while replacing token statistics with a weight-space statistic using the same access and generations.

4 Related Work

  • API-based extraction can transfer reasoning capability from deployed models through collected traces, while existing defenses restrict outputs, monitor queries, or reduce training utility [Anthropic, 2026a; Google Threat Intelligence Group, 2026; Panfilov et al., 2026].Detection is complementary because it acts after the fact and leaves the deployed model untouched.Source: §4 · pp. 10–11
  • Prior black-box radioactivity detection counts watermark-favored tokens [Sander et al., 2024], but depends on exact context recurrence and is fragile to wider windows, lower temperatures, and larger text budgets.WM-Basin keeps the access level and generations but replaces the token statistic with a weight-space one.Source: §4 · pp. 11–12
  • WM-Basin treats a watermark key as defining a key-specific weight-space basin and uses projected gradients to expose its signal amid dominant generic language and formatting directions.The projection draws on All-but-the-Top post-processing [Mu et al., 2017].Source: §4 · p. 12

5 Conclusion and Future Work

The conclusion presents WM-Basin as a detector built on a persistent, key-specific watermark basin. The section also describes the verifier’s scope and the rank test’s finite-sample error control.

5 Conclusion and Future Work

  • WM-Basin detects watermarked distillation through a key-specific basin that survives quantization, pruning, and reinforcement-learning post-training.The conclusion describes evaluations spanning six student families, four teachers, and four watermarking schemes.Source: §5 · p. 12
  • The verifier is in-domain: a hit identifies a domain carrying the watermark, while a low score elsewhere does not establish that the model is clean.Continued clean-data SFT can suppress the text-level signal even when an open-weight probe recovers a residual.Source: §5 · p. 12

Ethics Statement

  • The paper reports no human subjects or personal data and uses publicly released artefacts under their own licenses.Its configuration tables record default settings and index each study’s varied factor, cohort, and reported result.Source: Ethics Statement · p. 12, Reproducibility Statement · p. 13

A The Key-Randomization Rank Test

  • Under the null, the claimed key is equally likely to occupy any rank among itself and the decoy keys, so thresholding its rank p-value controls FPR in finite samples.The guarantee does not require a parametric model of the score; ties reduce power rather than validity.Source: A The Key-Randomization Rank Test · pp. 17–18
  • The decoy count determines the finest certifiable significance: α=0.001 requires at least 999 decoys.Decoy scoring is offline and reuses build-once artefacts.Source: A The Key-Randomization Rank Test · p. 18

B.1 Configuration Summary

The configuration summary specifies the model cohorts and study factors used to evaluate WM-Basin and its baseline. Defaults and per-study variations are indexed in the appendices.

Baseline and study index

  • The black-box baseline uses held-out keyed teacher traces, n-gram windows 1–3, and scores each distinct context-token pair once across traces.Table 8 records defaults, while Table 9 indexes each study’s varied factor, cohort, and result location.Source: §B.1 · p. 18, Table 8 · p. 18, Table 9 · p. 19

Cohorts and defaults

  • The architecture sweep covers 24 student structures from 135M to 8.2B parameters, with 50 students per architecture (1,200 total).The evaluation also includes four teachers spanning three families, with banks rebuilt per teacher.Source: §B.1 · p. 19
  • Studies vary teacher sampling temperature, watermark scheme, and audited domain; detector stages and the system prompt are rebuilt for each domain.The teacher study uses 100 students per temperature, and 50 students per watermark scheme and window are used in the scheme study.Source: §B.1 · p. 19

Robustness studies

  • Robustness studies include int8, int4, and nf4 quantization, 10–30% pruning, and post-distillation SFT or GRPO training.The post-training study varies the SFT domain or GRPO task.Source: §B.1 · p. 19

Other varied factors

  • Other studies vary trace paraphrasing, the watermarked-trace fraction at a fixed 1,900-trace budget, LoRA settings, probe warm-up, and suspect-text budget.Paraphrasing uses a same-family Qwen paraphraser at three strengths.Source: §B.1 · p. 19

B.2 Distillation and Student Training

The section describes how traces and prompts are selected for distillation and detector construction. It reports that watermarking preserves the utility gained through distillation.

B.2 Distillation and Student Training

  • A trace is retained only if it has the closing </think> tag and a \boxed{...} answer, passes the repetition check, and matches the gold answer under math_verify.The repetition check rejects a substring repeated at least three times within a sliding 100-character window.Source: §B.2 · p. 19
  • The clean probe model is warmed up on clean teacher traces using LoRA.Source: §B.2 · p. 20
  • Watermarked students match the clean-distilled control on GSM8K and Math-500, with trace-filter pass rates within 8 points; both exceed the un-distilled base.Figure 5 compares clean and TextSeal traces across three n-gram windows.Source: Figure 5 · p. 20, §B.2 · p. 20

B.3 Prompt Pools and Suspect Sampling

  • The adversary’s training pool yields 1,900 distillation traces from 5,000 samples, while the verifier’s build pool supplies probe warm-up traces, keyed reference traces, and clean-checkpoint generations.The detector verdict is read only on 1,900 held-out test prompts, disjoint from both training and build prompts.Source: §B.3 · p. 20

B.4 Detector and Baseline Implementation

The implementation builds key-specific reference gradients and compares them with suspect-text gradients in a shared projected space. It also specifies token-level baseline scoring and its null calibration.

Reference key bank and projection

  • For each candidate key, surviving build-pool reference gradients are averaged into a direction, then a shared random projection approximately preserves inner products for comparison with the suspect gradient.The projected bank contains the deployed key and i.i.d. decoys; its size sets the p-value floor.Source: §B.4 · p. 20

Sampled-token baselines

  • The black-box baseline scores suspect-generated tokens only when their preceding n-gram appears in held-out keyed teacher text, excluding contexts found in the prompt.Distinct context-token pairs are scored once across traces.Source: §B.4 · p. 21

TextSeal scoring

  • For TextSeal, both secret keys are scored and weighted by their generation prior; the suspect’s contexts and tokens come from its own text, without teacher forcing or student logits.The baseline score sums per-position values over retained positions and compares the total with a Gamma null distribution.Source: §B.4 · p. 21

Other watermark schemes

  • The three other watermark schemes use the same reading principle, but KGW and SynthID replace the Gumbel variate with keyed-vocabulary and tournament scores.GumbelMax is the single-key case.Source: §B.4 · p. 21

B.5 Removing Shared Task Directions

The shared task basis is fit by PCA on clean-checkpoint gradients and projected out before scoring key alignment. Removing 100 directions raises detection power, while typical keys are calibrated but false-positive rates remain elevated for tail keys.

B.5 Removing Shared Task Directions

  • PCA on gradients from the clean checkpoint pool defines the shared task basis, which is projected out of suspect and key gradients before cosine-similarity scoring.The number of removed directions, q, is the procedure’s free parameter; the pool contains 43 off-the-shelf checkpoints and 129 model-temperature cells.Source: §B.5 · p. 21, Table 10 · p. 22
  • At n-gram=1, removing q=100 directions raises TPR at α=5% from 70.2 to 91.7, while bringing key-specific false-positive rates closer to the nominal line.A small q does neither; power begins to rise around q≈10, and the deployed setting is q=100.Source: §B.5 · p. 22, Figure 6 · p. 23

B.6 Calibration of the Rank p-Value

  • The calibration check evaluates empirical false-positive rates for 100 deployed keys on 65 held-out clean model-temperature cells as the nominal threshold varies.The displayed curves compare each key’s empirical rate with the target FPR=α.Source: §B.6 · p. 23, Figure 7 · p. 24
  • At α=5%, the median key’s false-positive rate is 4.3% in all three windows, but the 90th percentile is 9.9% and the worst key reaches 23.4–26.2%.The reported comparison uses 1,000 keys across 129 clean model-temperature cells; the table’s floor accounts for finite-bank variation.Source: §B.6 · p. 23, Table 11 · p. 24

C Additional Detection Results

Across the evaluated operating points, WM-Basin matches or exceeds the black-box baseline, and its detection remains high across the tested teachers. The cross-teacher results also show that baseline performance varies with student context repetition.

C Additional Detection Results

  • The additional-results section reports operating points and factors omitted from the main tables, using the reference configuration as its comparison point.Its cross-teacher comparison includes detection and teacher-property results for three swapped-in teachers.Source: C Additional Detection Results · p. 24, Table 12 · p. 25

C.1 Operating Points

  • WM-Basin is at or above the black-box baseline throughout the plotted ROC range at every n-gram window, and strictly above it below the point where both saturate.The curves use the same 100 keys and shared student and clean-cell evaluations; the plotted separation is wider than the token-matched comparison because the baseline curve predates that matching.Source: §C.1 · p. 24, Figure 8 · p. 25

C.2 Cross-Teacher Detection

  • WM-Basin detects 96–100% of students in the 5% FPR column across every tested teacher, while the sampled-token baseline varies with how often student contexts recur.For example, gpt-oss students repeat 65.3% of their 2-word contexts and the baseline reaches 18%, compared with 92.1% repetition and 93% detection on the most repetitive Llama students.Source: §C.2 · pp. 24–25, Table 12 · p. 25

C.3 Watermark Scheme

Across watermark schemes, WM-Basin retains an advantage over an entropy-weighted token baseline, and it detects students under a changed system prompt. Its detection also accumulates with additional suspect text, unlike the baseline’s declining performance at larger budgets.

C.3 Watermark Scheme

  • At p≤0.05, entropy weighting improves the black-box baseline by 8–30 points across the tested scheme and window cells, yet WM-Basin still leads wherever the comparison is defined.The evaluation covers TextSeal, GumbelMax, SynthID, and KGW across n-gram windows; the weighted statistic changes the baseline, not the WM-Basin run.Source: §C.3 · pp. 25–26, Table 13 · p. 26

C.4 Audited Domain and System Prompt

  • On OpenR1-Math held-out questions under a new system prompt, WM-Basin reaches 95%/83%/45% at context windows 1/2/3.Each audited-domain row rebuilds the probe warm-up, task-subspace removal, decoy bank, and baseline corpus filter from that row’s own prompts.Source: §C.4 · p. 26

C.5 Suspect-Text Budget

  • At 1% FPR, WM-Basin reaches 100% TPR by 0.6M tokens for n-gram=1 and 2; at n-gram=3 it is within 8 points of its ceiling at that budget.The baseline peaks within about 0.5M tokens and then declines as its scored-token denominator grows while deduplication caps its signal.Source: §C.5 · pp. 26–27, Figure 9 · p. 27

C.6 Probe Model and Warm-Up

Probe choice matters less by model family than by vocabulary distance, and warm-up improves detection power. Warm-up corpus choice can also affect low-FPR performance, while several individual training settings have limited measured effects.

C.6 Probe Model and Warm-Up

  • At 0.1% FPR, an untrained random adapter retains about one-third of the default warm-up’s TPR, while the bare base model retains almost none.The random adapter still defines a differentiable coordinate space and retains real signal at 5% FPR, so warm-up sharpens rather than creates the signal.Source: §C.6 · p. 27, Table 15 · p. 28
  • Using warm-up data from other domains instead of audited OpenR1-Math costs 11–21 points at 0.1% FPR, with code the exception at 37%.At 5% FPR, the reported cost is at most one key; detection prompts remain a separate requirement and should come from the audited domain or a similar one.Source: §C.6 · p. 27
  • At n-gram=3 and 0.1% FPR, Qwen probes span 69–89 TPR and Llama-3 probes span 67–72, while every probe recovers all suspects at n-gram=1.The smallest-vocabulary probe loses the most, though it remains an order of magnitude above the baseline in the same cell; the evaluation holds the suspect cohort fixed while changing probes.Source: §C.6 · p. 27, Table 14 · p. 28
  • Adapter rank and learning rate each move TPR by at most 4 points at 0.1% FPR, while epoch count moves it by 11; none changes the 5% column.The learning-rate setting 1e−3 diverges and collapses detection; rank 32 and one epoch were tested separately, so their combination is not measured.Source: §C.6 · p. 28

D Additional Robustness Results

This section describes protocols for testing robustness and shows that compression preserves WM-Basin detection when model utility remains usable. Compression moves weights mainly orthogonally to the watermark direction; the uncompressed reference row cannot support black-box comparisons.

D Additional Robustness Results

  • The section examines compression conditions including per-output-channel symmetric int8, group-64 int4, nf4, and 10–30% unstructured magnitude pruning.The section’s protocols and weight-space analyses support the robustness results.Source: D Additional Robustness Results · pp. 28–29, §D.1 · p. 29

D.1 Compression

  • The compression protocol tests 100 keyed students per n-gram window after each operation, with detector inputs regenerated and quantized weights dequantized to fp16 for evaluation.Pruning excludes lm_- head and embed_tokens.Source: §D.1 · p. 29
  • The uncompressed reference row cannot support black-box comparisons because it was not re-read under the token matching the six operation rows.Its black-box cells should not be compared with its WM-Basin cells or down the column.Source: §D.1 · p. 29
  • Int8 and prune10 retain utility and strong WM-Basin detection; larger detection losses occur only beyond the usability gate, while the watermark-direction move remains below 0.11 against orthogonal movement of 14 to 152.The along component grows with pruning fraction; nf4 and prune20 are the operations where the gradient signal outlasts utility.Source: §D.1 · p. 29, Table 16 · p. 29

D.2 Continued Fine-Tuning and RL

Continued training and paraphrasing test whether post-distillation changes preserve watermark detection. RL leaves detection flat across its cohorts, while continued SFT can weaken the text read; paraphrasing preserves readability when mild but can hide the watermark from text detectors when stronger.

D.2 Continued Fine-Tuning and RL

  • Continued SFT uses clean reasoning or multilingual math traces, while GRPO tests GSM8K correctness and cross-domain K&K logic-puzzle or IFEval instruction-following rewards.The SFT recipes use two clean corpora; the cross-domain GRPO rewards require all-or-nothing success on their specified tasks.Source: §D.2 · p. 29
  • WM-Basin stays flat against each GRPO cohort’s pre-attack detection at 5% FPR across every window, while one continued-SFT arm reaches the wrong-key floor and the other degrades detection.The multilingual-SFT cohort remains partly recoverable at 5% FPR.Source: §D.2 · p. 30
  • Cross-domain GRPO improves the task it optimizes: across the three windows, 10 keys improved on K&K and 10 on IFEval.The evaluations use 400 K&K puzzles and 1,000 IFEval prompts.Source: Table 18 · p. 31
  • Every continued SFT or GRPO update is nearly orthogonal to the watermark direction; its projection is at most 5.3% of update length under SFT and 0.0% under every GRPO arm.The watermark component remains in the weights, but continued SFT can change the student’s text and lower both text-scored detectors on the reason arm.Source: §D.2 · p. 31

D.3 Paraphrasing

  • The paraphrasing protocol rewrites only the reasoning body, preserves tags and final answers, then filters traces before distillation using a same-family Qwen paraphraser.Mild, moderate, and aggressive settings use temperatures 0.5, 0.8, and 1.0, respectively, with 20 keyed students per setting.Source: §D.3 · p. 31
  • Under mild rewriting, WM-Basin remains readable from text, with 100%, 100%, and 90% TPR at 5% FPR for n-gram windows 1, 2, and 3, respectively.Source: §D.3 · p. 32
  • Moderate and aggressive rewriting lower both text detectors to at most 33% TPR for WM-Basin and 15% for the baseline at 5% FPR.For moderate rewriting, the open-weight read recovers the signal on rewritten training traces but not on original teacher traces; aggressive rewriting leaves it undetected under either read, at best 33–55% TPR.Source: Table 19 · p. 31, §D.3 · p. 32

Related papers

Loading 2610.37266v1…