Search papers, labs, and topics across Lattice.
This paper introduces a novel multi-channel spread-spectrum watermarking technique that allows for robust attribution of code to the large language models that generated it, addressing the limitations of existing watermarking methods. Unlike previous approaches that either require access to the model or offer insufficient payload capacity, this method achieves a 24-bit payload while maintaining high detection accuracy and robustness against various attacks. The watermarking scheme utilizes variable naming conventions and semantically equivalent code patterns, ensuring effective identification even under significant code alterations, achieving 100% detection accuracy with minimal false positives across extensive testing.
Achieving a 24-bit watermark payload for code attribution without needing model access, this method outperforms existing techniques under multiple attack scenarios.
Attributing code to the large language model that produced it is essential for provenance, licensing, and misuse accountability, yet no deployed watermark meets this need. Generation-time schemes require access to the producing model and cannot be applied to third-party code, while post-hoc schemes work on any code but carry at most 4 bits of payload, far too few to distinguish the many deployed model configurations. We present multi-channel spread-spectrum watermarking, the first post-hoc, training-free code watermark with a 24-bit payload and formal robustness guarantees. The scheme encodes bits in variable naming conventions and in eight pairs of semantically equivalent code patterns, and a keyed pseudo-random permutation maps every site to a codeword bit so that each bit receives multiple independent votes. Majority voting absorbs distributed corruption, while an outer Reed-Solomon code recovers the identifier when concentrated channel attacks defeat the vote, yielding provable robustness bounds for formatting, syntactic, and structural attacks. Across 1,750 Python files from CodeNet and from GPT-4.1 and Llama-4 generations, the watermark achieves 100% clean-detection accuracy with zero false positives. Under 17 attack types, it recovers the identifier at 97.6% accuracy under 8 variable renames and 94.1% under 10% random per-site corruption, while the strongest post-hoc baseline collapses to 0% under any single-transform attack. Embedding and detection together take under 200 ms on CPU without training data or GPU.
