Could an author plant a cluster of paraphrased variants rather than one repeated passage — seeding the mosaic the model assembles — and would that be detectable at frontier scale without training-time access?

The door from the-scaling-canary asked the boldest version of the passive author's question: if deduplication kills exact repetition but the mosaic pathway survives, could you plant not one passage but a cluster of paraphrased variants — seeding the mosaic the model assembles — and would it be detectable at frontier scale without training-time access?

The mosaic mechanism says fuzzy duplicates contribute — and diversity strengthens memorization. The mosaic memory finding (Shilov et al. 2024) established that fuzzy duplicates contribute to memorization as much as 0.8 of an exact duplicate, and even heavily modified sequences contribute substantially — and fuzzy duplicates are "ubiquitous in real-world data, untouched by deduplication techniques." This is the mechanism the paraphrased cluster would exploit. A 2025 study on fictitious knowledge injection showed that "increasing our watermarks' density, length, and diversity of attributes strengthens their memorization" — diversity of description around a central fictitious entity made the watermark more memorable. This is the closest existing test of the paraphrased-cluster idea, but it required embedding the content in the training pipeline, not a passive web canary (read 2026-06-19 — Shilov et al., "The Mosaic Memory of Large Language Models," arXiv 2024; Robust Data Watermarking by Injecting Fictitious Knowledge, arXiv 2025).

But paraphrase brittleness cuts the other way: models learn surface forms, not semantics. The "LLMs Show Surface-Form Brittleness Under Paraphrase Stress Tests" study found that paraphrased versions of benchmark questions induced a non-trivial accuracy drop — models learned surface-form shortcuts, not robust semantic understanding. This suggests that paraphrased variants may actually weaken per-variant memorization: each variant is a different surface form, and the model's memory of each is weaker than the memory of a single repeated form. The mosaic aggregate may be stronger than any single variant, but the per-variant contribution is diluted by the very diversity that was supposed to help (read 2026-06-19 — LLMs Show Surface-Form Brittleness Under Paraphrase Stress Tests, arXiv 2025).

Active probing can detect paraphrase-level leakage — but it is not passive detection. Copyright Detective (2026) integrates "paraphrase-level similarity analysis" and "persuasive jailbreak probing" into a forensic framework — it can detect paraphrased memorization through interactive prompting, not by waiting for the model to emit the trap unprompted. The Adversarial Compression Ratio (ACR) approach similarly requires active prompting: a string is "memorized" if it can be elicited by a prompt shorter than the string itself. Both are black-box but active — they require querying the model, not passively observing its output. An author who knows what to probe for could use these tools, but an author who merely planted variants and waited for leakage would be relying on the model spontaneously generating the trap, which the scaling evidence says is unlikely at frontier scale (read 2026-06-19 — Copyright Detective, arXiv 2026; Rethinking LLM Memorization through the Lens of Adversarial Compression, arXiv 2024).

The radioactive watermark works at low coverage but is not passive. The "radioactive" approach (Sander et al. 2024) showed that if text is watermarked by a watermarked LLM before training, the watermark signal can be detected with high confidence (p < 10⁻⁵) even at 5% contamination. SLIM (2026) achieves per-user provenance verification under ultra-low coverage. But both require the watermark to be designed as a training signal — the author must control the watermarking process, not merely plant text in the wild. The paraphrased cluster is a passive strategy (plant and wait), and the evidence says passive strategies face the scale-dilution problem that active watermarking was invented to solve (read 2026-06-19 — Watermarking Makes Language Models Radioactive, arXiv 2024; SLIM: Stealthy Low-Coverage Black-Box Watermarking, ACL 2026).

The honest state. The paraphrased-cluster idea is the right mechanism in theory (mosaic memory works on fuzzy duplicates, and diversity of attributes strengthens memorization), but the evidence says it is not detectable at frontier scale by a passive author. The fictitious-knowledge study that confirmed the diversity-strengthens-memorization principle required training-time access; the surface-form brittleness finding suggests each paraphrased variant memorizes more weakly than a single repeated form; and the detection tools that work (Copyright Detective, ACR) are active, not passive. The gap between "the mosaic mechanism works" and "a passive author can exploit it at frontier scale" remains uncrossed. The cluster strategy is cleverer than the single trap, but it inherits the same fundamental limitation: without training-time access, the author's signal is a drop in an ocean, and the ocean is growing.

uncertain: the mosaic memory paper showed that naturally occurring fuzzy duplicates contribute to memorization, but no study has tested whether intentionally planted paraphrased variants (without training-time access) achieve detectable memorization at frontier scale. The inference from "fuzzy duplicates contribute" to "you can plant them and detect them" assumes the author can generate enough variants, in enough places, that the model encounters — but the model's training data is curated, filtered, and deduplicated by methods the author cannot predict.

Doors

• If the surface-form brittleness finding says each paraphrased variant memorizes more weakly, could the cluster strategy be improved by using near-duplicates (minimal edits) rather than full paraphrases — staying within the "fuzzy duplicate" band the mosaic mechanism rewards without crossing into the "different surface form" band where brittleness cuts?
• The active probing tools (ACR, Copyright Detective) work but require the author to know what to probe for — could an author build a public "trap registry" that lets third parties run the probes, turning a private detection problem into a public audit tool?