Subliminal Watermarks: robust and sample efficient distillation detection

1. Background: What are LLM watermarks?

When a frontier model is served through an API, anyone can collect the responses and train their own model on them. This is known as distillation. When done without permission, it raises legal, safety, and provenance concerns (Anthropic, 2026). The model provider needs a way to know:

• Is this response generated by my model?
• Is this response generated by a model that distills from mine?
• Does their model distill from mine?

The standard tool is watermarking (Aaronson, 2022): embed statistical patterns into the LLM’s responses while disturbing the logit distribution as little as possible. Sometimes the second question is called antidistillation fingerprinting (Xu et al., 2026), but we will simply use the term watermark. Of course, if we can answer the second question, then we also solve the third one if we can query the model, e.g., majority vote on the queried responses from the suspect.

Watermarking is also becoming a legal requirement. From 2026, the EU AI Act requires providers of generative AI systems, text generators included, to mark their outputs in a machine-readable format that is detectable as AI-generated (European Union, 2024, European Commission, 2026).

One of the earliest examples of watermarking is Aaronson’s (2022) Gumbel-Max watermark. The idea is simple: since there is intrinsic randomness in LLM sampling at non-zero temperature anyway, we could swap in pseudorandomness that can be deterministically verified later.

More concretely, we prepare an \(n\)-gram hash table: at each step, the previous \(n\) tokens and a secret key \(k\) are hashed into a seed, and the seed generates one pseudorandom number \(u_v \in (0,1)\) for every token \(v\) in the vocabulary. Given the model’s next-token probabilities \(p_v\), we return \(\arg\max_v u_v^{1/p_v}\), the standard Gumbel-Max trick. Because the seed depends only on the preceding \(n\) tokens and the key, one can recompute every \(u_v\) afterwards with the key.

The widget below helps visualize the effect of key selection on the model’s output.

To anyone without the key, \(u\) looks uniformly random, so each token is still chosen with probability \(p_v\).

The detection in the original work computes the textual correlation between sampled tokens \(y_t\) and the pseudorandom numbers \(u_{y_t}\) by \(S(y) \;=\; \sum_{t=1}^{T} -\ln\big(1 - u^{(t)}_{y_t}\big).\) Again, the number \(u_{y_t}\) can be recomputed from the key \(k\) and the preceding \(n\) tokens.

Follow-ups, such as SynthID (Dathathri et al., 2024) and TextSeal (Sander et al., 2026), all work similarly but improve the quality-detectability tradeoff. Green/Red-list (Kirchenbauer et al., 2023) and ADFP (Xu et al., 2026) work slightly differently, but we won’t elaborate further. This is because none of these detection methods survives the simple attacks introduced in the next section, and once we switch to our new detection method, Subliminal Watermark (SubWM), even the vanilla Gumbel-Max watermark becomes detectable after the attacks.

2. Two simple attacks break existing detection methods

We introduce two laundering methods to stress-test popular watermarking schemes, including TextSeal, ADFP, and SynthID, and find that they all become ineffective. A distiller needs neither the teacher’s logits nor the watermark keys, and the watermarks become barely detectable, without sacrificing the performance gain from distillation.

Grandchild laundering. Train a child on the watermarked teacher traces as usual, but don’t deploy it. Instead, sample the child on the same prompts, keep the correct answers, and train a fresh grandchild from the original checkpoint on those. The grandchild never sees a watermarked token.

Setup. The teacher is Qwen3.5-9B and the student Qwen3.5-4B (Qwen Team, 2026), both in thinking mode. The student is distilled on 9,000 watermarked teacher traces for science questions from Mixture-of-Thoughts (Hugging Face, 2025). For each watermark, we report its \(p\)-value on the traning traces (lower means stronger evidence of distillation), and the student’s accuracy on held-out science questions. As a control, we include a student distilled from unwatermarked traces.

In the table below, we see the \(p\)-values for grandchildren are orders of magnitude higher than those of children, without losing much accuracy:

Entropy laundering. Drop the top 50% highest-entropy tokens from the SFT loss, while keeping them in the context. Of course, the distiller won’t have the teacher’s logits, so they have to use some proxy model’s entropy, e.g., their own model’s.

See the illustration below based on a real Qwen3.5-4B’s response on a science question:

We use the same teacher, student, data, and metrics as above. Despite the limitation of not having the teacher’s entropy, entropy laundering is still very effective against TextSeal, SynthID, and ADFP. As shown in the table below, the \(p\)-values are again orders of magnitude higher without losing much accuracy.

The original TextSeal accuracy comes from an earlier sampled run on the same evaluation set with a different seed.

Interestingly, the ADFP student’s performance actually improves a lot after entropy laundering, which gives the distiller even more incentives to deploy the attack.

As an ablation, we also try to filter out a random 50% or the lowest-entropy 50% of tokens. Neither removes the watermarks:

The first and last rows repeat the watermarked and entropy-laundered students from the table above. ADFP was not run for these ablations.

This supports the hypothesis that the detectability comes mostly from the high-entropy tokens.

3. SubWM: a novel, robust detection method in parameter space

We showed that current watermark detectors can be broken by simple attacks. How can the model provider fight back?

Prior work found that a model fine-tuned on another model’s outputs can pick up its traits even when the outputs look unrelated to them, known as subliminal learning (Cloud et al., 2025). The explanation lives in parameter space: training on the teacher’s outputs pulls the student’s weights toward the teacher’s.

Inspired by this, we devise a new detection method, Subliminal Watermark (SubWM), that looks for the watermark in parameter space instead of in the tokens, and it turns out to survive both laundering methods.

3.1 The detector

Let \(\theta_0\) be the teacher’s parameters. On its own prompts, the provider samples clean traces \(D_c\) and watermarked traces \(D'_w\), then fine-tunes two copies of the teacher with identical settings:

The two datasets differ only in the watermark, so \(\Delta\theta = \theta_w - \theta_c\) is a watermark direction in weight space. For a suspect prompt-response pair \((x, y)\), the likelihood score is

In words:

How much more likely is the response if we shift the clean teacher toward the watermarked one in parameter space?

Crucially, the score can be computed very efficiently via autodiff. We just need one forward pass through the slightly perturbed weights \(\theta_c + \epsilon\Delta\theta\) and then a backward pass to the scalar \(\epsilon\). The gradients are never materialized. This is because our score is not the cosine similarity between two gradients or two parameter-space directions, but the canonical pairing between one of each (or between the tangent space and the cotangent space if you wish). This is why we don’t need to, e.g., normalize the gradients and \(\Delta\theta\) in principle, or approximate the Hessian of the loss landscape.

In fact, even without backprop, the finite-difference approximation already works well:

which is just the mean log-likelihood ratio (LLR) between the teacher checkpoints. Despite its strong performance in practice, this simple score is less interpretable in terms of linear parameter-space directions.

3.2 SubWM has great TPR and FPR on single responses, and even out of distribution

Setup. We use the same teacher (Qwen3.5-9B) and student (Qwen3.5-4B) as in §2, both in thinking mode. The watermark is vanilla Gumbel-Max (TextSeal with \(\alpha = 0\)). The provider fine-tunes \(\theta_c\) and \(\theta_w\) on 9,000 prompts that the student never trained on. We then score the student’s own answers to 800 held-out science questions. The threshold is tuned on a held-out calibration set of clean teacher’s traces. We report the true positive rate (TPR) on the watermarked student and the false positive rate (FPR) on a clean student.

On science questions, SubWM flags all 800 watermarked answers at a 2.75% FPR. Here are the likelihood curves and all 1,600 scores behind that number:

We also test two harder settings. Out-of-domain generalization: we ask the same science-distilled students questions from math (GSM8K) and coding (LiveCodeBench), and score their answers with the same science-trained detector, recalibrating only the threshold on clean teacher answers from each domain. Agentic coding: a separate Qwen3-4B lineage distilled from SWE-smith agent trajectories, with its own detector fitted on separate coding tasks. Each action is generated with up to about 29k tokens of the trajectory in context.

As shown in the table below, SubWM works well out of the box,

Notice that agentic coding is a lot harder, likely because code tokens usually have lower entropy and thereby less room to embed statistical patterns. Still, SubWM flags 67% of watermarked actions, while the conventional TextSeal detector at similar FPR flags only 12% (not shown here). For all numbers, including key 2 and the alignment score, see the result tables.

3.3 SubWM can work with two different keys at the same time

We can detect not only distillation, but also the source of distillation!

The setup is the same as before but with two different keys, key 1 and key 2. Let \(s_1\) be the likelihood score \(s\) in \(\eqref{eq:score}\) computed with the key-1 detector, and \(s_2\) the same score computed with the key-2 detector. We score both students’ answers to the same 800 held-out prompts.

The contrast \(s_1 - s_2\) separates the key-1 and key-2 students perfectly (AUROC 1.000): all 800 key-1 responses have positive contrast, and all 800 key-2 responses have negative contrast.

3.4 SubWM is robust to laundering

We apply the two laundering methods from §2 to the key-1 student of §3.2, and score the laundered students with the same detector and thresholds. For comparison, the tables repeat the baseline numbers from §2.

On science questions, grandchild laundering barely affects the effectiveness of SubWM:

ADFP uses \(\lambda = 256\).

Same for entropy laundering:

ADFP uses \(\lambda = 64\). The students are trained independently from the ones in grandchild laundering. That's why the numbers for "Original" here differs from "Child" above.

In agentic coding, we only tested grandchild laundering so far, and it does not hurt SubWM’s detection either (67.0% → 69.3% of actions flagged, at 4–6% FPR), while the conventional TextSeal detector flags only 11–12%.

3.5 SubWM could perfectly detect model distillation by majority vote

We have presented our results on rollout detection. What about model detection? A simple strategy is to query \(N\) independent responses from the suspect and do a strict majority vote. For \(N=10\), at least six responses must pass; a five–five tie counts as negative.

If the rollouts are independent, the TPR and FPR of the vote follow from a simple binomial calculation (see the appendix). With only \(N=10\) queries, this would give perfect detection on science questions: with the LLR score, the projected TPR rounds to 100% in every science setting, with or without laundering, while the projected FPR stays below \(1.4 \times 10^{-7}\) (see the result tables).

On coding tasks, we could increase the number of queries to \(N=50\) (which is still very small) and expect near-perfect detection: for the agentic-coding lineage, \(N=50\) gives a projected TPR of 99.1% without laundering and 99.7% after grandchild laundering, at a projected FPR below \(10^{-19}\).

We haven’t tested SubWM on multiple clean models and measured FPR directly, which is an important next step for us. In the meantime, we would like to emphasize that

1. Our detector works on OOD tasks.
2. Our detector is completely student-agnostic; from the training traces to threshold calibration, everything is agnostic to the distiller.

So, we think it is reasonable that the independence assumption for the above calculation holds up.

3.6 Why does SubWM work though?

As the name suggests, SubWM is inspired by subliminal learning: a model trained on another model’s outputs could learn behaviors beyond the semantics and format of the outputs, which could be explained by linear directions in the parameter space (Cloud et al., 2025). At the moment, we do not have a clean connection yet, but we have the following interesting observation.

“If SubWM is just a likelihood test, do we really need to finetune the teacher? Can’t we just use the Gumbel-Max distribution to compute the watermarked likelihood directly?” It is not obvious how to do this because Gumbel-Max is a deterministic algorithm, so there is no distribution. Nonetheless, we tried a few versions of this, such as that of Ma (2026). Although they all worked well on the teacher-generated texts, none survives distillation.

This seems to suggest two things. First, detectors based on the watermark’s sampling rules are fragile to distillation. The key to SubWM’s success might be to look for watermark signals in the parameter space. This does not have to be the parameter space of the student. In our case, we use the teacher’s, but we expect any reasonably sized model would work. Second, whatever the teacher and the student both learn, it is not decoding the Gumbel-Max pseudorandomness. This makes sense, because we shouldn’t be able to invert hash functions by simply running SFT on some tokens!

It is interesting to investigate what exactly the models learn from watermarked traces, and why it is universal across models of different sizes (4B and 9B in our case). We expect some techniques from the subliminal learning literature would be useful, but we leave that to future work.

Citation

@misc{anil2026subliminalwatermarks,
  author = {Anil, Gautham Govind and Chavan, Arnav and Chen, Chang-Han and
            Varma, Harshit and Keutzer, Kurt and Dimakis, Alex and Min, Sewon},
  title  = {{Subliminal Watermarks}: robust and sample efficient distillation detection},
  year   = {2026},
  url    = {https://subliminal-watermarks.github.io/},
  note   = {Blog post}
}

References

Appendix: Experimental details