Imagine you're a detective trying to prove a counterfeiter copied a painting. Previous detectives looked at the brushstrokes on the surface — the visible texture of the final product. This paper says: forget the surface. The act of copying embeds a gravitational well in the counterfeiter's muscle memory, a persistent geometric distortion in how they hold the brush, detectable even after they try to sand down the evidence. That's the watermark basin. The committed claim: when a student model is distilled on watermarked teacher outputs, the watermark key induces a distinct geometric signal in the student's parameter space — a basin that lies orthogonal to the ordinary task-learning subspace. This basin persists through quantization, pruning, and even reinforcement-learning post-training. The authors build a black-box detector (WM-Basin) that finds this signal without ever touching the suspect model's weights or logits, querying only through an API. The mechanism is elegant. WM-Basin uses a fixed "clean" probe model to convert the suspect model's generated text into gradient representations — essentially asking "what direction would these outputs push a clean model's weights?" It then projects out the ordinary fine-tuning directions (the task-specific subspace you'd expect from any math-reasoning training) and tests whether the residual gradient aligns with the basin direction specific to the watermark key. If the suspect model drank from the watermarked well, the geometric scar shows up in the residual. The numbers are a substantial jump over prior art. At a strict 0.1% false-positive rate, WM-Basin detects 79% of distilled models at n-gram order 1, compared to 29% for the state-of-the-art token-level baseline. At n-gram=3 — where token-level methods nearly completely fail at 1.3% — WM-Basin still catches 45%. The evaluation spans student architectures from 135M to 8.2B parameters, all distilled on mathematical reasoning tasks. Critically, this works even when distillation traces are sampled at low temperature, precisely the regime where token-level statistics wash out. The integrity picture is mixed in important ways. The evaluation is extensive within the authors' own experimental setup — diverse model scales, multiple post-distillation modifications — but this is fundamentally a same-team simulation. There's no independent replication, and the domain is restricted to mathematical reasoning. The 0.1% false-positive rate is encouraging, but the test scenarios are crafted by the same group building the detector. The paper comes from a Meta-affiliated team, which means both deep resources and an obvious commercial interest in anti-distillation technology. The real question this paper addresses is one of the live fights in AI security: can you enforce model IP through watermarking when the adversary controls the distillation pipeline? Previous work said "sometimes, if they don't try hard to remove it." This paper says the signal lives deeper than anyone expected — not in the output distribution, but in the geometry of the loss landscape the student converges to. That's a qualitatively different kind of evidence, and it shifts the burden back toward adversaries who thought low-temperature sampling was sufficient laundering. What would change the picture: testing against adversarial distillation — a student that actively tries to destroy watermark basins through targeted fine-tuning on clean data after distillation. The paper shows survival against quantization, pruning, and RLHF, but not against a distiller who knows about basins and optimizes against them. That's the obvious next experiment, and its absence is conspicuous.
