AI models can hide training-data watermarks without forgetting what they learned

When an audit depends on the suspect’s outputs

Data-use auditing asks whether particular material helped train an AI model. One approach lets data owners watermark text before distributing it, then search for traces of that watermark in a suspected model’s responses or token probabilities.

An arXiv preprint posted on November 6, 2026, by Ruihan Hu and colleagues examines a vulnerability in this arrangement: the provider being audited controls the outputs that auditors inspect. Their framework, called Logit Laundering, changes those outputs without changing the trained base model’s parameters.

The experiments suggest that a model can retain useful knowledge from watermarked material while presenting weaker evidence of having learned from it. This is a controlled research demonstration, not evidence that a particular commercial provider has deployed the technique.

A statistical fingerprint, not a visible stamp

The study focuses on watermarks embedded by paraphrasing text with a specially configured language model. During rewriting, the system favors a secret, context-dependent selection of tokens—units of text that can be words or word fragments. The paper calls these preferred choices “green” tokens.

Training on that text can leave statistical traces. One auditing approach, STAMP, compares how readily a model predicts publicly released watermarked passages versus privately keyed reference versions. Another, termed radioactive detection, looks for an unusually high frequency of green-token predictions.

The researchers first explored simpler evasions. In a small preliminary test, filtering removed the tested injected random strings and Unicode substitutions. But transformations aimed at disrupting paraphrase-based watermarks often damaged the text while leaving detectable traces. Simply swapping likely output tokens also produced uneven evasion and could substantially hurt performance.

Changing the scores before an answer appears

Logit Laundering instead acts during inference, when the model produces an answer. It adjusts logits: numerical scores assigned to possible next tokens before those scores become probabilities.

An auxiliary model, the statistical bias estimator, learns local patterns from short segments of the watermarked corpus. On public material, it is trained to give relatively uniform predictions, with the aim of limiting interference with general knowledge.

The system then subtracts a scaled version of the estimator’s scores from the base model’s scores. This weakens patterns that auditing methods might recognize, while leaving the base model’s learned parameters intact. It does not require the watermark’s secret key.

A confidence-aware component moderates the adjustment. When the model’s leading token prediction barely outranks the runner-up, suppression is more conservative. More confident predictions permit stronger changes. Experiments removing this adaptive scaling showed markedly worse generation quality under the tested fixed-strength alternatives.

What the experiments found

The team evaluated five models, ranging from roughly one billion to three billion parameters, from the Llama, Qwen, Gemma and StableLM families. They continued training them on public material mixed with 4,959 watermarked paragraphs from 50 books published in 2025. The newer books were chosen to reduce overlap with the models’ original training data.

For the main STAMP and radioactive tests, reported p-values after laundering exceeded the study’s 0.05 detection threshold across all five models. These figures were averages of tests calculated separately for each book, not a demonstration that every individual book escaped detection. Some extended auditing variants were already weak before evasion; one Zlib-based variant still reported an average below 0.05 after laundering.

Knowledge tests used two AI-generated multiple-choice question sets, with human review of a sampled subset. For the smallest Llama model, accuracy was 31.8% before additional training, 73.4% after training without evasion and 72.8% with laundering. General-task results were also broadly similar, although not unchanged: aggregate automated judging of generated text fell from 83.7 to 79.9.

A warning, not a universal verdict

The findings concern continued training on a particular corpus and relatively small models. General benchmarks used limited samples, and the study does not establish equivalent results for much larger systems or every auditing method.

Nor does a p-value above 0.05 prove that training data was absent. It means the chosen test did not find sufficient evidence under its decision rule.

The authors explored a possible defense: checking whether suppression pushes true-key green-token frequencies unusually low compared with random keys. That pilot covered just ten paragraphs from one book, so it remains preliminary. The central lesson is narrower but important: an audit can miss training-data use when it assumes provider-controlled outputs faithfully expose the model underneath.