After suspected AI model-copying campaign, a new survey tries to map the messy field of authentication

A frontier LLM costs the better part of a billion dollars to train. A single copy of the finished weights, held by the wrong party, can undercut that investment overnight. That gap between cost and defensibility is what AI "model authentication" is meant to close: the practice of proving where a model's data, weights, and outputs came from. In June, that gap became a boardroom question.

Anthropic publicly accused unnamed operators of running a large-scale distillation campaign against Claude, claiming they used roughly 24,000 fraudulent accounts routed through proxy services to clone its frontier model into a cheaper, competing system. The company did not name targets in its disclosure; subsequent reporting surfaced Alibaba as one suspected recipient, but those characterizations remain allegations rather than adjudicated fact. (BBC, Business Insider)

Distillation, in this context, means training a smaller or cheaper model to imitate a larger one's outputs, often without authorization. The disclosure sharpened a question the academic community had been arguing over for years: how, exactly, do you prove a large language model is yours?

A new IJCAI 2026 survey paper, "Implicit Identity Technologies for LLMs", IJCAI being one of the field's top peer-reviewed venues, tries to give that question a coherent answer. Co-authored by a team spanning Xi'an Jiaotong University, the Chinese Academy of Sciences' Institute of Information Engineering, and Deakin University in Australia, the paper's central claim is unflattering to the field it surveys: researchers working on AI model authentication have been using "fingerprint" and "watermark" as if they meant the same thing, and the resulting confusion has left frontier labs without a portable vocabulary for defending their work.

The paper organizes the problem around three questions. Was the training data used without permission? Was the model itself copied or fine-tuned by someone who didn't pay for it? Did this specific output really come from this specific model? A Chinese-language feature in Leiphone's GAIR Paper 111 series frames the survey as the first peer-reviewed attempt to answer all three under a single conceptual roof, which the authors call "Implicit Identity" (Implicit-ID): a verifiable but unobservable identity signal carried by a model and its outputs.

Under that umbrella, the paper draws a clean line between two techniques the field has long blurred. Fingerprinting is non-invasive: it reads intrinsic features of a model, including the statistical shape of its parameters, its internal representations, and the patterns in what it generates, then matches them back to a known source. Watermarking is invasive: it deliberately embeds a signal, checked against a secret key, into a model or its outputs before release. Both count as "implicit identity," but they answer different questions and live on different sides of the model's lifecycle. The two-dimensional taxonomy the paper introduces crosses that verification-semantics split (similarity-based for fingerprinting, key-based for watermarking) with a lifecycle axis: dataset, model, or generated content.

The argument for unifying the vocabulary is operational. Without a shared map, defenders cannot tell which tool addresses which threat. The Anthropic disclosure, for example, sits closest to the "model" and "generated content" rows of the matrix. Fingerprinting is the natural approach for matching suspected distilled weights back to a known checkpoint; watermarking is the natural approach for proving a particular output came from a particular system. Today those discussions happen in separate research communities with separate benchmarks and separate threat models, which is part of why a single disclosure can produce so much confused public commentary.

The counterargument is that a taxonomy does not, by itself, harden any defense. The survey is descriptive: it maps what the field has done, not what the field should do next. Existing fingerprinting techniques are still vulnerable to fine-tuning that smooths out the quirks they read; existing watermarking schemes can be stripped by enough re-generation. The paper's public arXiv draft acknowledges this and frames the taxonomy as a foundation for future work, not a finished product.

What the survey does deliver is portable. A reader who internalizes the lifecycle × verification matrix can place the next distillation case, the next watermarking announcement, or the next fingerprinting paper without re-learning the vocabulary each time. That, more than any single technique, is what an authentication subfield needs to grow up. The next test is whether the field's researchers, and the labs with the most to lose, adopt the map before the next billion-dollar incident forces the issue.