Multi-Channel Spread-Spectrum Code Watermarking

2026-07-08 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Expert, extended

Summary

A novel multi-channel spread-spectrum watermarking system is introduced for attributing code generated by large language models. This post-hoc, training-free scheme offers a 24-bit payload and formal robustness guarantees, addressing limitations of prior methods that either require model access or provide minimal payload. It embeds bits using variable naming conventions and eight pairs of semantically equivalent code patterns, employing a keyed pseudo-random permutation, majority voting, and a Reed-Solomon outer code for error correction. Tested on 1,750 Python files from CodeNet, GPT-4.1, and Llama-4, the system achieved 100% clean-detection accuracy with zero false positives. It demonstrated 97.6% recovery accuracy under 8 variable renames and 94.1% under 10% random per-site corruption, outperforming baselines. Embedding and detection processes complete in under 200 ms on CPU, requiring no training data or GPU.

Key takeaway

For AI Security Engineers or teams needing to attribute LLM-generated code for provenance, licensing, or security, you should consider implementing multi-channel spread-spectrum watermarking. This system provides a 24-bit payload and strong robustness against common code transformations, operating efficiently on CPU without training. It offers a practical solution for verifying code origin, especially where generation-time watermarking is not feasible, despite the inherent limitation against full LLM regeneration attacks.

Key insights

Multi-channel spread-spectrum watermarking provides robust, high-payload, post-hoc attribution for LLM-generated code without training.

Principles

• Combine independent semantic-preserving modifications.
• Distribute watermark bits across all available sites.
• Layer error correction for diverse attack types.

Method

Normalize code, extend single-word variables, normalize structural channels, extract sites, then use a keyed pseudo-random permutation to assign sites to codeword bits. Transform sites to embed bits, then apply Reed-Solomon encoding.

In practice

• Use t=8 for heavy rename attacks.
• Prefer t=2 for structural or random per-site corruption.
• Implement a centralized detection service for verification.

Topics

• Code Watermarking
• Large Language Models
• Model Attribution
• Spread-Spectrum Techniques
• Reed-Solomon Codes
• Post-hoc Watermarking
• Software Security

Code references

• soohyeonc/Multi_Channel_Watermarking

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Engineer, AI Security Engineer

Related on AIssential

• Secure Coding Drift in LLM-Assisted Post-Quantum Cryptography Development: A Gamified Fix — The reliance on LLMs in PQC development causes "Secure Coding Drift," a socio-technical vulnerability degrading secure coding practices.
• T2S: A Rehearsal-Based Approach for Extraction-Resistant Model Watermarking — T2S enhances AI model watermark robustness by simulating extraction attacks during embedding to boost transferability.
• A new native IDE approach to prevent code leakage to LLMs: Obfuscating ASTs before the API call (Verantyx) — Obfuscating code with Kanji-infused structural semantics allows LLMs to reason without exposing proprietary data.
• Widening the Gap: Exploiting LLM Quantization via Outlier Injection — Outlier injection during quantization can predictably induce malicious behavior in LLMs, even with advanced schemes.
• Using LLMs to Secure Source Code — LLMs streamline vulnerability discovery, shifting the security bottleneck to verification, triage, and patching.
• ZeroCoder: Can LLMs Improve Code Generation Without Ground-Truth Supervision? — Co-evolving code and test generation with self-generated execution feedback significantly improves LLM performance without ground-truth supervision.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.