CoChat
Sign Up
PreprintCited by 4Software Engineering ResearchAdvanced Steganography and Watermarking TechniquesPhysical Unclonable Functions (PUFs) and Hardware Security

The DOI matches its DataCite record; the references it cites are not checked yet.

Who Wrote this Code? Watermarking for Code Generation

Open access
Lee, Taehyun, Hong, Seokhee, Ahn, Jaewoo, Hong, Ilgee, Lee, Hwaran, Yun, Sangdoo, Shin, Jamin, Kim, Gunhee·2023·arXiv
DOI 10.48550/arxiv.2305.15060arXiv 2305.15060
Open this paper in CoChat — free accountOpen PDF

Abstract

Since the remarkable generation performance of large language models raised ethical and legal concerns, approaches to detect machine-generated text by embedding watermarks are being developed. However, we discover that the existing works fail to function appropriately in code generation tasks due to the task's nature of having low entropy. Extending a logit-modifying watermark method, we propose Selective WatErmarking via Entropy Thresholding (SWEET), which enhances detection ability and mitigates code quality degeneration by removing low-entropy segments at generating and detecting watermarks. Our experiments show that SWEET significantly improves code quality preservation while outperforming all baselines, including post-hoc detection methods, in detecting machine-generated code text. Our code is available in https://github.com/hongcheki/sweet-watermark.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2305.15060

Cites

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • These vulnerabilities can promote plagiarism.

    “promote plagiarism (Lee et al. 2023a)”

    From A Survey on LLM-Generated Text Detection: Necessity, Methods, and Future Directions (2025) · cites this paper as Lee et al. 2023a

    The Introduction (page unavailable) identifies code plagiarism as a concern associated with advances in AI code generation. It lists code vulnerabilities separately, however, and does not say that those vulnerabilities promote plagiarism. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

The citation lists haven’t been fetched yet

Cited by 4

Research works printed but not linked: 62

  1. Sahar Abdelnabi and Mario Fritz. 2021. Adversarial wa- termarking transformer: Towards tracing text prove- nance with data hiding. In 2021 IEEE Symposium on Security and Privacy (SP), pages 121-140. IEEE, IEEE. · DOI
  2. Mikhail J. Atallah, Victor Raskin, Michael Crogan, Christian Hempelmann, Florian Kerschbaum, Dina Mohamed, and Sanket Naik. 2001. Natural lan- guage watermarking: Design, analysis, and a proof- of-concept implementation. In Information Hiding, pages 185-200. Springer, Springer Berlin Heidel- berg. · DOI
  3. Mikhail J. Atallah, Victor Raskin, Christian F. Hempel- mann, Mercan Karahan, Radu Sion, Umut Topkara, and Katrina E. Triezenberg. 2002. Natural language watermarking and tamperproofing. In Information Hiding, pages 196-212. Springer, Springer Berlin Heidelberg. · DOI
  4. Jacob Austin, Augustus Odena, Maxwell Nye, Maarten Bosma, Henryk Michalewski, David Dohan, Ellen Jiang, Carrie Cai, Michael Terry, Quoc Le, et al. 2021. Program synthesis with large language models. arXiv preprint arXiv:2108.07732. · arXiv
  5. Mohammad Bavarian, Heewoo Jun, Nikolas Tezak, John Schulman, Christine McLeavey, Jerry Tworek, and Mark Chen. 2022. Efficient training of lan- guage models to fill in the middle. arXiv preprint arXiv:2207.14255. · arXiv
  6. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom B Brown, Dawn Song, Ul- far Erlingsson, et al. 2021. Extracting training data from large language models. In USENIX Security Symposium, volume 6.
  7. Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Ponde de Oliveira Pinto, Jared Ka- plan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. 2021. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374. · arXiv
  8. Miranda Christ, Sam Gunn, and Or Zamir. 2023. Un- detectable watermarks for language models. arXiv preprint arXiv:2306.09194. · arXiv
  9. Ayan Dey, Sukriti Bhattacharya, and Nabendu Chaki. 2018. Software watermarking: Progress and chal- lenges. INAE Letters, 4(1):65-75. · DOI
  10. Daniel Fried, Armen Aghajanyan, Jessy Lin, Sida Wang, Eric Wallace, Freda Shi, Ruiqi Zhong, Wen-tau Yih, Luke Zettlemoyer, and Mike Lewis. 2023. Incoder: A generative model for code infilling and synthesis. In International Conference on Learning Representa- tions.
  11. Sebastian Gehrmann, Hendrik Strobelt, and Alexander Rush. 2019. GLTR: Statistical detection and visual- ization of generated text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics: System Demonstrations, pages 111-116, Florence, Italy. Association for Computational Lin- guistics. GeorgiaTechResearchInstitute. 2023. starcoder- gpteacher-code-instruct. · DOI · Paper page
  12. Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tat- sunori Hashimoto. 2023. On the learnability of watermarks for language models. arXiv preprint arXiv:2312.04469. · arXiv
  13. Suriya Gunasekar, Yi Zhang, Jyoti Aneja, Caio César Teodoro Mendes, Allie Del Giorno, Sivakanth Gopi, Mojan Javaheripi, Piero Kauffmann, Gustavo de Rosa, Olli Saarikivi, et al. 2023. Textbooks are all you need. arXiv preprint arXiv:2306.11644. · arXiv
  14. Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu. 2023. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv preprint arXiv:2301.07597. · arXiv
  15. James Hamilton and Sebastian Danicic. 2011. A survey of static software watermarking. In 2011 World Congress on Internet Security (WorldCIS- 2011), pages 100-107. IEEE, IEEE. · DOI
  16. Julian Hazell. 2023. Large language models can be used to effectively scale spear phishing campaigns. arXiv preprint arXiv:2305.06972. · arXiv
  17. Jingxuan He and Martin Vechev. 2023. Large language models for code: Security hardening and adversarial testing. arXiv preprint arXiv:2302.05319. · arXiv
  18. Xuanli He, Qiongkai Xu, Lingjuan Lyu, Fangzhao Wu, and Chenguang Wang. 2022a. Protecting intellectual property of language generation apis with lexical watermark. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 10758- 10766.
  19. Xuanli He, Qiongkai Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. 2022b. Cater: Intellectual property protection on text generation apis via conditional watermarks. Advances in Neural Information Processing Systems, 35:5431-5445.
  20. Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. 2020. The curious case of neural text de- generation. In International Conference on Learning Representations.
  21. Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. 2023. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669. · arXiv
  22. Hamel Husain, Ho-Hsiang Wu, Tiferet Gazit, Miltiadis Allamanis, and Marc Brockschmidt. 2019. Code- searchnet challenge: Evaluating the state of semantic code search. arXiv preprint arXiv:1909.09436. · arXiv
  23. Daphne Ippolito, Daniel Duckworth, Chris Callison- Burch, and Douglas Eck. 2020. Automatic detec- tion of generated text is easiest when humans are fooled. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 1808-1822, Online. Association for Computational Linguistics. · DOI · Paper page
  24. Zunera Jalil and Anwar M. Mirza. 2009. A review of digital watermarking techniques for text documents. In 2009 International Conference on Information and Multimedia Technology, pages 230-234. IEEE, IEEE. · DOI
  25. Young-Won Kim, Kyung-Ae Moon, and Il-Seok Oh. 2003. A text watermarking algorithm based on word classification and inter-word space statistics. In Sev- enth International Conference on Document Analysis and Recognition, 2003. Proceedings., pages 775-779. · DOI
  26. Citeseer, IEEE Comput. Soc.
  27. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023a. A watermark for large language models. The Fortieth International Conference on Machine Learning.
  28. John Kirchenbauer, Jonas Geiping, Yuxin Wen, Manli Shu, Khalid Saifullah, Kezhi Kong, Kasun Fer- nando, Aniruddha Saha, Micah Goldblum, and Tom Goldstein. 2023b. On the reliability of water- marks for large language models. arXiv preprint arXiv:2306.04634. · arXiv
  29. Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2023. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593. · arXiv
  30. Yuhang Lai, Chengxi Li, Yiming Wang, Tianyi Zhang, Ruiqi Zhong, Luke Zettlemoyer, Wen-Tau Yih, Daniel Fried, Sida Wang, and Tao Yu. 2023. DS- 1000: A natural and reliable benchmark for data sci- ence code generation. In Proceedings of the 40th International Conference on Machine Learning, vol- ume 202 of Proceedings of Machine Learning Re- search, pages 18319-18345. PMLR.
  31. Jun Li and Quan Liu. 2010. Design of a software wa- termarking algorithm based on register allocation. In 2010 2nd International Conference on E-business and Information System Security, pages 1-4. IEEE, IEEE. · DOI
  32. Linyang Li, Pengyu Wang, Ke Ren, Tianxiang Sun, and Xipeng Qiu. 2023a. Origin tracing and detecting of llms. arXiv preprint arXiv:2304.14072. · arXiv
  33. Raymond Li, Loubna Ben Allal, Yangtian Zi, Niklas Muennighoff, Denis Kocetkov, Chenghao Mou, Marc Marone, Christopher Akiki, Jia Li, Jenny Chim, et al. 2023b. Starcoder: may the source be with you! arXiv preprint arXiv:2305.06161. · arXiv
  34. Zongjie Li, Chaozheng Wang, Shuai Wang, and Cuiyun Gao. 2023c. Protecting intellectual property of large language model-based code generation apis via wa- termarks. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Secu- rity, pages 2336-2350.
  35. Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. 2023b. A semantic invariant robust wa- termark for large language models. arXiv preprint arXiv:2310.06356. · arXiv
  36. Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized bert pretraining ap- proach. arXiv preprint arXiv:1907.11692. · arXiv
  37. Ziyang Luo, Can Xu, Pu Zhao, Qingfeng Sun, Xi- ubo Geng, Wenxiang Hu, Chongyang Tao, Jing Ma, Qingwei Lin, and Daxin Jiang. 2023. Wizardcoder: Empowering code large language models with evol- instruct. arXiv preprint arXiv:2306.08568. · arXiv
  38. Haoyu Ma, Chunfu Jia, Shijia Li, Wantong Zheng, and Dinghao Wu. 2019. Xmark: Dynamic soft- ware watermarking using collatz conjecture. IEEE Transactions on Information Forensics and Security, 14(11):2859-2874. · DOI
  39. Hasan Mesut Meral, Bülent Sankur, A. Sumru Özsoy, Tunga Güngör, and Emre Sevinç. 2009. Natural lan- guage watermarking via morphosyntactic alterations. Computer Speech & Language, 23(1):107-125. · DOI · Paper page
  40. Yisroel Mirsky, Ambra Demontis, Jaidip Kotak, Ram Shankar, Deng Gelei, Liu Yang, Xiangyu Zhang, Maura Pintor, Wenke Lee, Yuval Elovici, and Bat- tista Biggio. 2023. The threat of offensive AI to organizations. Computers & Security, 124:103006. · DOI · Paper page
  41. Eric Mitchell, Yoonho Lee, Alexander Khazatsky, Christopher D Manning, and Chelsea Finn. 2023. De- tectgpt: Zero-shot machine-generated text detection using probability curvature. The Fortieth Interna- tional Conference on Machine Learning.
  42. Niklas Muennighoff, Qian Liu, Armel Randy Ze- baze, Qinkai Zheng, Binyuan Hui, Terry Yue Zhuo, Swayam Singh, Xiangru Tang, Leandro Von Werra, and Shayne Longpre. 2024. Octopack: Instruction tuning code large language models. In The Twelfth International Conference on Learning Representa- tions.
  43. Ginger Myles, Christian Collberg, Zachary Heidepriem, and Armand Navabi. 2005. The evaluation of two software watermarking algorithms. Software: Prac- tice and Experience, 35(10):923-938. · DOI
  44. Erik Nijkamp, Bo Pang, Hiroaki Hayashi, Lifu Tu, Huan Wang, Yingbo Zhou, Silvio Savarese, and Caiming Xiong. 2023. Codegen: An open large language model for code with multi-turn program synthesis. In The Eleventh International Conference on Learning Representations.
  45. Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Dolan-Gavitt, and Ramesh Karri. 2022. Asleep at the keyboard? assessing the security of GitHub copilot's code contributions. In 2022 IEEE Symposium on Security and Privacy (SP), pages 754- 768. IEEE, IEEE. · DOI · Paper page
  46. Jie Ren, Han Xu, Yiding Liu, Yingqian Cui, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. 2023. A robust semantics-based watermark for large lan- guage model against paraphrasing. arXiv preprint arXiv:2311.08721. · arXiv
  47. Vinu Sankar Sadasivan, Aounon Kumar, Sriram Bala- subramanian, Wenxiao Wang, and Soheil Feizi. 2023. Can ai-generated text be reliably detected? arXiv preprint arXiv:2303.11156. · arXiv
  48. Gustavo Sandoval, Hammond A. Pearce, Teo Nys, Ramesh Karri, Siddharth Garg, and Brendan Dolan- Gavitt. 2023. Lost at c: A user study on the security implications of large language model code assistants. In 32nd USENIX Security Symposium (USENIX Se- curity 23).
  49. Irene Solaiman, Miles Brundage, Jack Clark, Amanda Askell, Ariel Herbert-Voss, Jeff Wu, Alec Rad- ford, Gretchen Krueger, Jong Wook Kim, Sarah Kreps, et al. 2019. Release strategies and the so- cial impacts of language models. arXiv preprint arXiv:1908.09203. · arXiv
  50. Yuki Takezawa, Ryoma Sato, Han Bao, Kenta Niwa, and Makoto Yamada. 2023. Necessary and sufficient watermark for large language models. arXiv preprint arXiv:2310.00833. · arXiv
  51. Umut Topkara, Mercan Topkara, and Mikhail J. Atallah. 2006. The hiding virtues of ambiguity. In Proceed- ings of the 8th workshop on Multimedia and security, pages 164-174. ACM. · DOI
  52. Hugo Touvron, Louis Martin, Kevin Stone, Peter Al- bert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. Llama 2: Open founda- tion and fine-tuned chat models. arXiv preprint arXiv:2307.09288. · arXiv
  53. Priyan Vaithilingam, Tianyi Zhang, and Elena L Glass- man. 2022. Expectation vs. experience: Evaluating the usability of code generation tools powered by large language models. In Chi conference on hu- man factors in computing systems extended abstracts, pages 1-7. · DOI · Paper page
  54. Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. 2023. Towards codable text watermarking for large language models. arXiv preprint arXiv:2307.15992. · arXiv
  55. Yilong Wang, Daofu Gong, Bin Lu, Fei Xiang, and Fenlin Liu. 2018. Exception handling-based dynamic software watermarking. IEEE Access, 6:8882-8889. · DOI
  56. Kangxi Wu, Liang Pang, Huawei Shen, Xueqi Cheng, and Tat-Seng Chua. 2023. LLMDet: A third party large language models generated text detection tool. In Findings of the Association for Computational Lin- guistics: EMNLP 2023, pages 2113-2133, Singapore. Association for Computational Linguistics.
  57. Xi Yang, Jie Zhang, Kejiang Chen, Weiming Zhang, Zehua Ma, Feng Wang, and Nenghai Yu. 2022. Trac- ing text provenance via context-aware lexical sub- stitution. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pages 11613- 11621. Association for the Advancement of Artificial Intelligence (AAAI). · DOI
  58. Xianjun Yang, Wei Cheng, Linda Petzold, William Yang Wang, and Haifeng Chen. 2023. Dna-gpt: Divergent n-gram analysis for training-free detection of gpt- generated text. arXiv preprint arXiv:2305.17359. · arXiv
  59. KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. 2023. Robust natural language watermark- ing through invariant features. In Proceedings of the 61th Annual Meeting of the Association for Compu- tational Linguistics. Association for Computational Linguistics.
  60. Xiao Yu, Yuang Qi, Kejiang Chen, Guoqiang Chen, Xi Yang, Pengyuan Zhu, Weiming Zhang, and Neng- hai Yu. 2023. Gpt paternity test: Gpt generated text detection with gpt genetic inheritance. arXiv preprint arXiv:2305.12519. · arXiv
  61. Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. 2023. Provable robust water- marking for ai-generated text. arXiv preprint arXiv:2306.17439. · arXiv
  62. Qinkai Zheng, Xiao Xia, Xu Zou, Yuxiao Dong, Shan Wang, Yufei Xue, Zihan Wang, Lei Shen, Andi Wang, Yang Li, et al. 2023. Codegeex: A pre-trained model for code generation with multilingual evaluations on humaneval-x. arXiv preprint arXiv:2303.17568. · arXiv

Metadata

Authors
Lee, T., Hong, S., Ahn, J., Hong, I., Lee, H., Yun, S., Shin, J., & Kim, G.
Affiliations
  • Seoul National University (KR)
  • Georgia Institute of Technology (US)
  • NAVER Cloud (South Korea) (KR)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2023
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2305.15060
arXiv
2305.15060
OpenAlex
W4378465438
Cited by
4
References
0
Citations by year
2026: 1 · 2025: 1 · 2024: 2
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • Seoul National University Open Repository (Seoul National University) (submittedVersion)
  • arXiv (Cornell University) (cc-by)
Funders
  • National Research Foundation
  • National Research Foundation of Korea
  • Ministry of Science and ICT, South Korea
  • Institute for Information and Communications Technology Promotion
Topics
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Research
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Steganography and Watermarking Techniques
  • Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
Keywords
watermarking, code generation, large language models, entropy thresholding, sweets

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review