arXiv AI
Sep 1

Disappearing Ink: Obfuscation Breaks N-gram Code Watermarks in Theory and Practice

The paper demonstrates that N‑gram based code watermarking schemes, widely used to identify machine‑generated code, are ineffective when faced with realistic code obfuscation. By modeling semantics‑preserving transformations as a Markov random walk and introducing the assumption of distribution consistency, the authors prove that obfuscation can drive the failure rate of any detector to nearly 1 minus its false‑positive rate. Extensive experiments across multiple watermarking methods, LLMs, languages, benchmarks, and obfuscators confirm that detectors collapse to near‑random performance (AUROC ≈ 0.5) after obfuscation.

By Gehao Zhang, Mingzhe Li, Eugene Bagdasarian, Shiqing Ma, Juan Zhai
arXiv Machine Learning
Jul 8

Multi-Channel Spread-Spectrum Code Watermarking

arXiv:2607. 06009v1 Announce Type: cross Abstract: Attributing code to the large language model that produced it is essential for provenance, licensing, and misuse accountability, yet no deployed watermark meets this need.

By Soohyeon Choi, Debin Gao, Yue Duan
arXiv Computation and Language
Aug 31

Semantic Watermarking with Order-Robust Detection over Sub-sentence Units

The paper introduces an adaptive embedding displacement attack (EDA) that exploits rewording, reordering, and resegmentation to remove semantic watermarks from text, achieving a 32.6%–47.9% success rate across four watermarking schemes. To counter this, the authors propose k‑SwordStamp, a semantic watermarking method that uses order‑robust detection over sub‑sentence units, significantly reducing vulnerability to structure‑based edits. Experiments show that EDA remains effective against k‑SwordStamp, but with a lower success rate (10.8%) compared to its performance on other schemes.

By Abdulrahman Diaa, Jonathan Petit, Florian Kerschbaum