Code watermarking improves tracking of AI-generated program style
SEW: Style-Encoded Watermarking of LLM-Generated Code
Cryptography and Security
Summary
It can be hard to tell if a piece of code was created by an AI or a human, especially when people want to track where AI code comes from. The authors developed a method called SEW that hides secret style markers in the program’s code after it’s written, based on coding style rules controlled by a secret key. This makes it easier to detect AI-generated code without breaking how the code works. Their tests show SEW detects AI code better than older methods and can still find the watermark even after the code is edited.
What this means in practice
- •For software security teams: Identify AI-generated code inside large projects to track origins and enforce usage policies.
- •For software development tool makers: Build automated tools that detect embedded code style watermarks to verify if code was AI-generated.$Commercial implications: Enables commercial products that authenticate source of code for license compliance and intellectual property protection.
Authors
Soohan Lim, Hyundong Jin, Yo-Sub Han
Abstract
Code watermarking supports provenance tracking for code generated by LLMs. Modifying token selection to embed watermarks as an LLM generates code can create a trade-off between detectability and functional correctness. Other methods instead watermark completed code using predefined transformations or trained neural models. Recurring patterns can make watermark choices predictable across programs, while treating patterns common in unwatermarked code as watermark evidence can cause false detections. We therefore introduce SEW, which embeds and detects watermarks in already generated code through three components: (i) code style rules collected from style guides and transformation rules, with style choices determined by a secret key and each program's structural context; (ii) style-preference calibration, which evaluates watermark evidence using style probabilities estimated from human-written code; and (iii) context-aware style aggregation, which combines evidence from structurally matching locations assigned the same code style choice, preventing repeated applications of that choice from inflating watermark evidence. On CodeContests across three LLMs and three programming languages, SEW achieves a mean relative improvement of 12.44% in TPR@FPR5% over the baselines and is robust to four non-LLM code-editing attacks, with only a 0.94% mean relative decrease. Our code is available at https://github.com/suhanmen/SEW.