SynMark: Semantic-Coordinate Multi-Bit Watermarking during LLM Code Generation

1. INTRODUCTION

• Identifier renaming, reformatting, and structural refactoring can desynchronize surface-prefix routes and make token-level recovery unreliable, while stronger watermark bias may alter syntax-sensitive choices.These edits matter because reused code may lack external provenance records; watermarking embeds provenance directly into token selection.Source: §1 · p. 1
• SynMark improves 8-bit message recovery across all three generators, retains higher Pass@1 than competing watermarked methods, and achieves stronger recovery under identifier renaming and random code transformations.The supplied introduction reports these comparisons without giving the corresponding values.Source: §1 · pp. 1–2
• Scope learns discrete semantic coordinates from aligned prefixes of functionally equivalent code and uses them for keyed block assignment during embedding and extraction.This reduces dependence on surface-token references.Source: §1 · pp. 1–2
• Scope applies an adaptive logit bias that limits watermark-induced changes at syntax-sensitive positions while retaining default embedding strength elsewhere.Source: §1 · p. 2
• Traced corrects candidate scores and weights token contributions by reliability to compensate for residual transformation-induced drift during extraction.Source: §1 · pp. 1–2

2. RELATED WORK

• Generative text watermarking biases token probabilities using a secret-key vocabulary partition, with later methods exploring semantic representations or uncertainty-adaptive strength.These methods mainly target natural language, leaving code syntax constraints and multi-bit route synchronization underexplored.Source: §2 · p. 2
• Multi-bit methods route symbols through preceding tokens, prefix cues and logits, or keyed vocabulary permutations.Source: §2 · p. 2
• Code watermarking studies token constraints, grammar-guided encoding, syntax-critical decisions, and user-level tracing, yet routing and candidate construction remain sensitive to renaming and structural rewrites.SynMark uses semantic-coordinate routing and reliability-weighted extraction to improve recovery after semantics-preserving transformations.Source: §2 · p. 2

3.1. Problem Formulation and Threat Model

• The threat model covers post-generation identifier renaming, semantics-preserving refactoring, and comment or dead-code insertion without key or detector-feedback access; regeneration and functionality-changing edits are out of scope.Source: §3.1 · p. 2

3.2. Semantic-Coordinate Watermark Embedding

• Scope trains a causal mapper to assign aligned prefixes from functionality-preserving variants to shared discrete coordinates, using AST correspondences and balanced soft assignments.AST alignment is used only during training.Source: §3.2 · pp. 2–3
• Keyed routing maps each prefix to a semantic coordinate and message block, while detection recomputes routes from transformed prefixes rather than absolute token positions.Complementary coding constructs candidate sets from two keyed vocabulary partitions.Source: §3.2 · p. 3
• At syntax-sensitive positions, adaptive bias limits changes; for active gates, clipping prevents boosted target tokens from overtaking the original top token.When the target margin is below the floor, the default bias is retained.Source: §3.2 · p. 3

3.3. Reliability-Weighted Watermark Extraction

• Traced combines contextual token, lexical, route, position, and membership features, then uses a shared network to adjust candidate-relative scores.Token sanitization maps identifiers and literals to shared categories.Source: §3.3 · p. 3
• Traced trains a separate reliability branch after correction training, then aggregates corrected block scores with normalized reliability weights to select symbols and recover bits.The reliability branch is initialized with weights of 1; empty blocks receive zero scores.Source: §3.3 · p. 3

4.1. Experimental Setup

• Generator-specific Scope and Traced modules are trained on MBPP and evaluated on HumanEval with OpenCoder-1.5B, CodeLlama-7B, and DeepSeek-Coder-6.7B.Comparisons include CredID, XMark, MPAC, and CodeIP.Source: §4.1 · p. 3

4.2. Watermark Accuracy and Fidelity

• 4.53 and 11.18 percentage points: SynMark improves BitAcc and Pass@1, respectively, over XMark on CodeLlama, the strongest watermarked baseline in both metrics.Across all three generators, SynMark has the highest BitAcc and Pass@1 among evaluated watermarked methods.Source: §4.2 · p. 4

4.3. Robustness under Code Transformations

• 82.27% and 83.77% BitAcc: SynMark retains these values under 100% identifier renaming on CodeLlama and DeepSeek-Coder, respectively.It consistently outperforms all baselines across renaming ratios.Source: §4.3 · p. 4
• 8.62% and 5.85%: SynMark improves average BitAcc over the strongest corresponding baselines under identifier-renaming and code-transformation attacks on OpenCoder, respectively.It achieves the highest BitAcc in every attack group, including dead-code and comment insertion.Source: Table 2 · p. 4, §4.3 · p. 4

4.4. Ablation Study

• Adding Scope improves Pass@1 by 11.38 points and Trans. Avg. BitAcc by 5.16 points; with Scope fixed, Traced improves Clean, Var., and Trans. Avg. BitAcc by 5.87, 10.10, and 3.96 points, respectively.Traced does not affect Pass@1; the configuration with Traced but without Scope is omitted because Traced relies on Scope-derived routes.Source: §4.4 · p. 4, Table 3 · p. 4

• SynMark combines semantic-coordinate routing, syntax-aware adaptive bias, and reliability-weighted extraction to embed multi-bit watermark messages during LLM code generation.Source: §5 · p. 4
• On HumanEval, SynMark improves bit recovery, functional correctness, and robustness over evaluated watermarked baselines across three code LMs.Source: §5 · p. 4
• The conclusion reports gains across recovery, correctness, and transformation robustness on the evaluated code-generation benchmarks.Source: §5 · p. 4

• The study involved no human participants or animals and required no ethical approval.Source: §7 · p. 5