Status, 2026-09-19 (overnight autonomous run)

One day from an empty repo to a working distillation-attribution pipeline with a controlled testbed. Everything below is reproducible from the repo; every number links to a RESULT.md with its pre-registered criterion.

What is established

• The reference-based likelihood statistic works and is checkpoint-specific. On the real DeepSeek-R1-Distill-Qwen-1.5B, original-R1 traces beat the API-served R1 (which behaves like the May checkpoint) on 185/187 probes. The Cisco provenance kit, by contrast, sees only the Qwen base and cannot surface the teacher. Phase 0
• Near-relatives tie under likelihood. Original R1 vs Qwen3-32B: 92 vs 107 at 2048 tokens on the real distill, with a base-model reference. More tokens do not help. Phase 0
• Style features break the tie. 81 low-level features separate the two teachers at 0.95 CV even on equal-length reasoning-only text; the real distill's own generations classify as original R1 186/200; the innocent control never does. H3
• The exact-lineage reference also breaks the tie. In the controlled testbed (same base, same prompts, same recipe, different teacher): the R1-trained student is attributed to R1 129/70 and the Qwen3-trained student to Qwen3 177/22 by likelihood; 129/70 and 179/20 by style. The Gemini-trained student is attributed to Gemini 191/199 with zero R1/Qwen3 false positives, and the human-solution student is attributed to no reasoning teacher at all. Phase 1 pilot
• Mixtures show a clean dose-response but are biased and scale-dependent. Five students at 0/30/50/70/100% R1 data give strictly monotone likelihood win shares (0.11 to 0.65) and style weights (0.08 to 0.70), biased toward the more learnable Qwen3 style. A calibration map fitted on them has leave-one-out error about 0.1 to 0.2 in data share, and does not transfer to the real distill (trained on 1000x more data), whose style weight lies above every calibration point. Mixture proportions need calibration students of comparable strength. H2, Phase 1
• Reference choice matters for false positives, not for the suspect. The student's ranking holds under every same-family reference and even under an out-of-family reference with a different tokenizer (SmolLM2-1.7B); a domain-mismatched reference gives the innocent control a spurious, highly significant preference for the API R1 (71/199), while the out-of-family one gives only 28. Match the reference to the suspect's domain or report a matched control. H1
• Budgets and stopping rules. 20 probes for the "R1-family style" call at p < 1e-6; 60-80 for naming the single teacher by likelihood; 5-8 generations for the style classifier. An anytime-valid sequential test stops at probe 18 on the student and never fires on the control. H4, H5
• Trace-stripped adversary is hard. Answer-only style is dominated by formatting conventions shared across a model family: the innocent control's answers look R1-like 45% of the time. Supporting evidence only. H3 C4
• The truncation recipe leaves an artifact. Training on 2048-token-truncated traces produces students that rarely finish; full-text style features then mislead. Use the reasoning-only equal-length variant, or train untruncated (which moved the verdict from -0.07 to +0.14 and 144/55). Phase 1 part 3
• A teacher fingerprint is checkpoint x prompts x sampling pipeline. Two public dumps of original-R1 traces (s1K-1.1 and OpenR1-Math) are 91% separable by style, and a student trained on one inherits that source's sub-style (138 vs 16). Family-level attribution (R1-family vs Qwen3) is robust for every R1-trained student (77 to 95%); sub-source attribution is real but weaker (0.76 on equal-length reasoning). The strength-axis experiment was confounded by this: 3x epochs lifted the style weight 0.70 -> 0.78, while 10x data from the other source did not lift it at all. A lab's reference must come from its own serving pipeline. H2 strength
• Open world: a missing true teacher looks exactly like a confident wrong call. Remove each student's true teacher from the pool and the ranking test crowns the nearest remaining candidate with p around 1e-129, and even names Llama as the "teacher" of the human-data student (p 1e-66) at a mean alignment of +0.001. What separates these from real attributions is the absolute alignment level: true-teacher signals sit at +0.07 to +0.17, wrong calls at +0.03 and +0.00. The evidence report therefore needs three tiers: an absolute threshold ("is any reasoning-teacher signal present"), then family-member naming by style and exact-lineage likelihood, always with a matched control and the candidate pool disclosed. H5 open-world

What it cost

• GPU: $22.49 (RunPod bursts, 14 pods incl. one L40S, ~8 GPU-hours, every pod terminated by script and verified; ops/gpu-usage-log.md).
• OpenRouter: about $10 (teacher traces for 200 probe prompts x 5 teachers, 800 training prompts x Qwen3-32B, answer-only sets).
• Volume: $4.20/month while it exists (US-CA-2; holds venv, models, and eight trained students; the temporary EU volume was deleted).

Infrastructure that now exists

• i9 box: isolated systemd units for any CPU job, keys in /etc/reinstator/env, dead-man timer for stray pods. COMPUTE.md
• RunPod: gpu/launch.sh runs a detached burst (create pod, bootstrap from the volume, train / score / generate, pull, terminate) with creation retries and GPU fallbacks; every burst logs itself. Precision validated: bf16 for scoring unless a margin below 0.02 is at stake.
• Scripts: ref_mia.py (scorer + tests, CUDA or CPU, sharded), gen_teachers.py (OpenRouter), gen_local.py (HF sampling), train_sft.py (paper's SFT recipe), style_features.py / classify.py / mixture_em.py (H3/H2), budget.py (H4), sequential.py (H5).

Next (in order)

• Mixture calibration, second axis, same source: sample the R1 checkpoint ourselves (or another single pipeline) at 800 / 8k / 80k on one prompt distribution so strength is not confounded with source; then fit strength-conditioned maps.
• False-positive sweep: more hard negatives (merges, continued-pretraining, other-family students) to put a number on FPR for both signals; then wire H5's e-process into the report so every claim carries an anytime-valid p.
• Scale the testbed toward the paper's: 3B/4B students, more teachers (o-series via glyph signal), and a second prompt domain (code), still under $50 of GPU at current rates.
• Evidence report format aligned with the Cisco constitution, and the reinstator.com deployment on the i9 (Caddy site block, serves the RESULT tables and per-claim JSON).
• Not started: H6 weight traces, H7 serve-time fingerprints, H8 detector-aware adversary.