This is the question the entire 2026 dispute turns on, and the honest answer is that nobody can answer it from the model itself.
Why it is structurally hard
A trained model is not a copy of anything. It is a set of parameters that produce behaviour. Two models trained on overlapping data toward similar objectives will converge on similar behaviour whether or not one learned from the other.
So the question is not whether two models resemble each other. They will. The question is whether the resemblance has a particular causal history, and behaviour does not carry a record of its own causes.
The contamination problem
This is the difficulty that has grown fastest, and it may be terminal for behavioural methods.
A large and increasing share of text on the open web is model-generated. Any model trained on a recent crawl absorbs other models' phrasings, formatting habits, and even their self-descriptions, without anyone having deliberately distilled anything.
Behavioural similarity therefore has at least three possible causes that cannot be distinguished after the fact: deliberate distillation, incidental training on contaminated web text, or convergent optimisation against the same benchmarks. Fingerprint evidence cannot separate them, which is why a model identifying itself as a competitor proves considerably less than it appears to.
Why weight-space forensics fail
Neural networks have vast internal symmetry. Permuting units, rotating representations, or simply continuing to train destroys any naive correspondence while preserving behaviour entirely.
And distillation usually targets a different architecture, since the whole point is to be smaller. There is frequently no weight-level correspondence to look for, even in principle.
What actually produced evidence in 2026
Not model analysis. Infrastructure logs.
The strongest material in the whole dispute was providers examining their own systems: account creation patterns, query volumes, traffic shaped unlike ordinary usage. Anthropic's disclosures of 16 million exchanges through 24,000 accounts and later 28.8 million through around 25,000 were observations of their own infrastructure.
That establishes extraction. It does not establish construction, and the gap between the two is where the entire Kimi K3 argument sits.
Why it probably will not be solved
Any robust attribution method would have to identify a property that survives retraining, architecture change, and paraphrase, while not appearing in models that merely trained on similar data. Every property with the first three characteristics tends to be a general property of well-trained models, which fails the fourth.
That is not an argument that a method is impossible. It is an argument that the obvious routes are closed, and no promising alternative has emerged.
The practical consequence
If attribution stays unsolved, disputes of this kind will continue to be decided by infrastructure evidence, disclosure, politics, and plausibility arguments about timelines rather than by proof.
For anyone building, the implication is defensive: keep your own provenance records. You will not be able to rely on anyone proving where your model came from, and equally you will not be able to disprove an allegation with technical evidence.
Common questions
Can you prove which model another model was trained on?
Not with current methods. Behavioural evidence is contaminated by web text containing other models' outputs, weight-space forensics do not survive ordinary retraining, and watermarks do not transfer from training data into a student's own outputs.
What would count as proof?
Realistically, evidence from outside the model: infrastructure logs, internal documents, or disclosure by a participant. Every purely technical route currently available produces circumstantial evidence at best.