Rohan Paul (@rohanpaul_ai)T2·85 pts
- Distilled models retain hidden, key-specific directional traces in weights from watermarked API outputs
- WM-Basin identifies the true key by computing gradients of suspect text relative to a fixed probe model
- Achieved 79% detection rate at 0.1% false-positive rate across 1,200 distilled models, vs. 29% for token counting
- Quantization, light pruning, and RL post-training do not remove the trace, though extensive fine-tuning on clean data weakens it