How did Commander Erwin know that the spy/traitor(s) would be within the 104th training squad? During the female titan arc, how did Erwin specifically know that the traitor would be from the 104th training squad?
From a well established Tumblr blog post:

After the death of Sawney and Bean, Erwin then was able to narrow down the list of suspects, as only a soldier was able to kill the titans with 3DMG. Because of this, he went around asking cryptic questions to try to weed out liars and traitors, making people second guess themselves.
Then comes the night of the ceremony where the cadets join the Survey Corp. That night, Erwin instructed Levi to take Eren out on a ride to recon the area. Why exactly would he do this? It's clear it wasn't just a normal exercise, as Levi was rushing Eren and seemed frustrated and stressed. This was Erwin's way of narrowing down the suspects. By having Eren leave and the ceremony on the same night, he could deduct that if the enemy did not attack Eren or at least show up to the castle to kidnap him when it would have been strategically best to do so, then it must mean that they were otherwise preoccupied somewhere else. Where else? The ceremony. If someone was missing from the ceremony, it would be suspicious and draw attention to them. So this narrowed down the suspects to the 104th Trainee Corp.