# Radioactivity Published articles for Radioactivity. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Watermark Robustness and Radioactivity May Be at Odds in Federated Learning DevFeed: [Watermark Robustness and Radioactivity May Be at Odds in Federated Learning]() Original publisher: [Read original article]() Author: Leixu Huang, Zedian Shao, Teodora Baluta Published: 2026-11-02T05:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security]() Topics: [Federated Learning](), [watermarking](), [Large Language Model](), [Adversarial attacks](), [AI software supply chain security](), [outlier-detection](), [Fine-tuning]() Tags: [accountability](), [adversarial](), [aggregation](), [clients](), [cs-cr](), [data-provenance](), [distributed](), [federated-learning](), [filter](), [fine-tuning](), [language-models](), [large-language-models-llms](), [outliers](), [provenance](), [radioactivity](), [robust](), [robustness](), [server](), [signal](), [synthetic](), [watermark]() ### AI overview In the evaluated federated learning setup, watermark signals remained detectable after fine-tuning--even when watermarked data made up only 6.6% of the data, with a reported p-value as low as 10⁻²⁴. But updates from watermarked synthetic data appeared as outliers relative to clean updates. A server acting adversarially could use strong robust aggregation to filter out those updates and the watermark signal while aiming to preserve model utility. None of the evaluated radioactive watermarks resisted this attack, suggesting a trade-off among radioactivity, robustness, and utility. ### Source excerpt arXiv:2510.17033v2 Announce Type: replace Abstract: Federated learning (FL) enables fine-tuning large language models (LLMs) across distributed data sources. As these sources increasingly include LLM-generated text, provenance tracking becomes essential for accountability and transparency. We adapt LLM watermarking for FL data provenance, where a subset of clients computes local updates on watermarked data, and the server averages all updates into the global LLM. We find that several evaluated LLM watermarks remain radioactive in this setup: the watermark signal stays detectable after fine-tuning, with a $p-$value reaching $10^{-24}$ even when only 6.6% of data is watermarked. However, the server can act as an active adversary, aiming to preserve model utility while evading provenance tracking. We observe that updates from watermarked synthetic data appear as outliers relative to clean updates. Our adversary thus applies strong robust aggregation to filter out these outliers along with the watermark signal. All evaluated radioactive watermarks are not robust against such an adversarial server. Our work suggests fundamental trade-offs between radioactivity, robustness, and utility. ## Watermark Basins: Black-Box Detection of Distilled LLMs DevFeed: [Watermark Basins: Black-Box Detection of Distilled LLMs]() Original publisher: [Read original article]() Author: Hongyan Chang, Hady Elsahar, Tom Sander, Pierre Fernandez, Saeed Mahloujifar, Sylvestre-Alvise Rebuffi, Tom\\'a\\v{s} Sou\\v{c}ek, Tuan Tran, Valeriu Lacatusu, Surya Parimi, Rashel Moritz, Vanessa Stark, Published: 2026-10-28T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Machine Learning]() Topics: [watermarking](), [Fine-tuning](), [Artificial Intelligence](), [llm-reasoning](), [Post-training optimization](), [post-training](), [quantization]() Tags: [alignment](), [api](), [cs-cl](), [cs-cr](), [cs-lg](), [detection](), [distillation](), [fine-tuning](), [gradient](), [key](), [language-models](), [llms](), [models](), [parameter](), [post-training](), [quantization](), [queries](), [radioactivity](), [reasoning](), [signal](), [space](), [statistics](), [watermark]() ### AI overview WM-Basin detects possible API-based distillation by testing whether a suspect model's outputs carry a watermark-specific geometric signal. It queries the model through its API, maps generated text to gradients with a fixed clean probe model, removes ordinary task-related directions, and checks whether the residual aligns with the watermark basin. In evaluations on mathematical reasoning models from 135M to 8.2B parameters, it detected 79% of distilled models at n-gram=1 and 45% at n-gram=3 at a 0.1% false-positive rate, compared with 29% and 1.3% for the token-level baseline. The abstract says the signal persisted after quantization, pruning, and reinforcement-learning post-training. These results are reported for the evaluated settings; the supplied text does not establish performance beyond them. ### Source excerpt arXiv:2610.37266v1 Announce Type: new Abstract: Proprietary language models and their reasoning traces are vulnerable to API-based distillation, where an adversary trains a student model on the teacher model's outputs. To obtain evidence of distillation, model providers can watermark the teacher's outputs, aiming to leave a radioactive signal in the student's outputs. Existing black-box detectors search for such radioactivity using token-level statistics of the suspect model's outputs. However, token-level signals are not always detectable, for instance when the distillation traces are sampled at a low temperature. In this work, we discover the watermark basin, a persistent signal that enables more reliable watermark detection: during fine-tuning, watermarked teacher traces embed a distinct, key-specific geometric signal in parameter space that lies orthogonal to the ordinary task-specific fine-tuning subspace. Building on this, we introduce Watermark Basin Alignment (WM-Basin), a black-box watermark detector that queries the suspect model through its API, without access to its weights or logits. WM-Basin maps generated text to gradient representations using a fixed clean probe model, projects out the ordinary fine-tuning task directions, and tests whether the residual gradient aligns with the watermark basin induced by the watermark key. We evaluate WM-Basin extensively across diverse teacher models and student architectures (from 135M to 8.2B parameters) distilled on mathematical reasoning. At a strict 0.1% false-positive rate, WM-Basin detects 79% of distilled models at n-gram=1 and 45% at n-gram=3, substantially improving over the state-of-the-art token-level baseline (29% and 1.3%, respectively). Because the watermark signal resides in a persistent basin, it survives post-distillation modifications including quantization, pruning, and reinforcement-learning post-training.