A detector built by researchers at FAIR and Meta Superintelligence Labs caught 79% of distilled AI models in their tests, with a one-token watermark window and a 0.1% false-positive rate, against 29% for the previous state-of-the-art black-box detector, according to a paper posted to arXiv on 27 October 2026.
By our arithmetic, that is about 2.7 times as many distilled models detected. With a wider watermark window of three tokens, the paper reports 45% against 1.3%, which by our arithmetic is about 35 times.
Short explainer · News Short
A vertical news Short narrated from this piece’s headline and opening line.
Business Pill · Data Flywheel
An evergreen Business Engineer explainer on data flywheels. It explains the general idea only and does not discuss this paper.
The key insight: A black-box detector from researchers at FAIR and Meta Superintelligence Labs caught 79% of distilled models in their tests at a 0.1% false-positive rate, against 29% for the previous best, which by our arithmetic is about 2.7 times as many.
Clarification (30 Oct): an earlier version of this piece said the paper tested no named commercial model. Its experiments use four named teacher models, including OpenAI’s gpt-oss-120B; the text now lists them.
The paper, “Watermark Basins: Black-Box Detection of Distilled LLMs”, addresses what its authors call API-based distillation, “where an adversary trains a student model on the teacher model’s outputs”. A model provider watermarks the outputs it serves, then checks whether a suspect model carries that signal.
The researchers write that existing black-box detectors look for the watermark in the suspect model’s text, and that “token-level signals are not always detectable”, for instance when the distillation traces are sampled at a low temperature.
In the default setup, the paper says, the teacher is DeepSeek-R1-Distill-Qwen-14B, watermarked with a scheme called TextSeal, and the researchers distil students from it on maths reasoning traces.
Their method, which they call Watermark Basin Alignment or WM-Basin, “queries the suspect model through its API, without access to its weights or logits”. It looks instead for a key-specific signal that, according to the paper, watermarked training leaves in the student model’s parameters.
Share of distilled student models detected at a 0.1% false-positive rate: the previous best token-level black-box detector vs Meta’s WM-Basin, at watermark n-gram windows of 1 and 3. Source: Chang et al., Watermark Basins, FAIR / Meta Superintelligence Labs, arXiv 2610.37266, 27 Oct 2026.
The Results
The researchers evaluated student models from 135 million to 8.2 billion parameters, distilled on mathematical reasoning. At a strict 0.1% false-positive rate, they write, WM-Basin “detects 79% of distilled models at n-gram=1 and 45% at n-gram=3”, against 29% and 1.3% for the token-level baseline.
A 0.1% false-positive rate means that about one innocent model in 1,000 would be wrongly flagged, by our arithmetic. The paper says the signal survives “quantization, pruning, and reinforcement-learning post-training”.
The authors also state a limit: “Continued training on clean data can reshape that distribution and therefore degrade black-box detection”, although they write that the basin itself remains in the weights and is easy to identify with white-box access.
Why It Lands This Week
The paper describes API-based distillation as a threat that “has become a major threat to reasoning LLMs”. On 29 October we reported The Information’s account, relayed by Reuters, that DeepSeek and Moonshot AI relied heavily on outputs from OpenAI’s GPT-6 Astra to train their latest models. Reuters said OpenAI, DeepSeek and Moonshot AI did not immediately respond to its requests for comment.
That piece also cites Anthropic’s statement that tighter limits, account bans and proxy-network blocks cut the data distillers harvest from Claude by 90% to 99%. Our follow-up covers the investors in DeepSeek’s nearly $16 billion round, as The Information reported it.
The Structural Read
As we read the paper, the method moves the evidence from the words a suspect model writes to the direction its training pushed its weights, while still needing only API access.
By our arithmetic, the gap is widest where the old detector was weakest: with a three-token watermark window, 45% against 1.3%, about 35 times.
As we read the timing, the paper lands in the same week The Information reported that two Chinese labs relied heavily on outputs from OpenAI’s GPT-6 Astra, as we reported on 29 October.
Chang et al., Watermark Basins, FAIR and Meta Superintelligence Labs, arXiv, 27 October 2026
“Proprietary language models are increasingly targeted by API-based distillation”
Three Implications
FOR MODEL PROVIDERS The paper cites Anthropic as an example of a provider that watermarks the outputs of Claude models released since August 2026; detection of the kind tested here depends on outputs being watermarked first.
FOR LABS THAT TRAIN ON OTHERS’ OUTPUTS The paper says the signal survived quantization, pruning and reinforcement-learning post-training in its experiments, while continued training on clean data can degrade black-box detection.
FOR READERS OF DISTILLATION CLAIMS The figures come from the researchers’ own student models trained mostly on maths reasoning; we found no test of the closed models named in our earlier reporting.
The framework puts it this way: “If you understand how each data pipeline becomes a moat โ and how each moat decays โ you understand the strategic structure of the entire AI stack.”
As we read it, distillation is one way a model’s outputs leak value to a rival, and a watermark test is an attempt to make that leak traceable. The framework was published in July 2026 and does not discuss this paper.
What Is Not Established
The results come from the researchers’ own experiments on student models they trained, mostly on maths reasoning. The paper cites one deployed example, writing that Anthropic “embeds watermarks in texts generated by Claude models released beginning in August 2026”, but it does not test that watermark. Its experiments use four teacher models, DeepSeek-R1-Distill-Qwen-14B, gpt-oss-120B, QwQ-32B and Llama-3.1-8B; we found no test of GPT-6 Astra, Kimi K3.1 Pro or DeepSeek V4.1-Flash, the models named in our earlier reporting. The 2.7-times and 35-times comparisons and the one-in-1,000 figure are our arithmetic.
This Week In The AI Supercycle
Execution Fault Lines, Concentrated Demand, and Geopolitical Firewalls
This week’s issue: the AI build is not short of demand for its parts. It is short of cheap money, and its end revenue rests on a narrow base of large, often venture-funded buyers.
Researchers at FAIR and Meta Superintelligence Labs report a detector that caught 79% of distilled models in their tests at a 0.1% false-positive rate, against 29% for the previous best, about 2.7 times as many by our arithmetic. It arrives the same week The Information reported that two Chinese labs distilled OpenAI’s GPT-6 Astra.
A note on sourcing. Results, quotations and method details come from the paper Watermark Basins: Black-Box Detection of Distilled LLMs by researchers at FAIR and Meta Superintelligence Labs, posted to arXiv on 27 October 2026 (abstract page and full HTML text). Facts on DeepSeek, Moonshot AI and Anthropic come from our earlier reporting. The 2.7-times and 35-times comparisons and the one-in-1,000 figure are our arithmetic. We did not contact Meta or the authors.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
