[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84045-en":3,"doc-seo-84045-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},84045,1374391975076,"Riley","https://ap-avatar.wpscdn.com/avatar/14000253ca4ec9f6853?x-image-process=image/resize,m_fixed,w_180,h_180&k=1783305029341752051",8,"Research & Report","Multi Channel Spread-Spectrum Code Watermarking","Attributing code to the large language model that produced it is crucial for provenance, licensing, and misuse accountability, but deployed watermarking methods fall short. Existing generation-time approaches require access to the producing model, while post-hoc approaches offer too little payload to distinguish many configurations. Multi-channel spreadspectrum watermarking enables training-free, post-hoc code identification with a 24-bit payload, using variable naming and eight semantically equivalent pattern channels, plus Reed-Solomon recovery and formal robustness against multiple attack classes.","Multi-Channel Spread-Spectrum Code Watermarking  \nSoohyeon Choi  \n[shchoi@smu.edu.sg](shchoi@smu.edu.sg)[ ](shchoi@smu.edu.sg)Singapore Management University Singapore  \nDebin Gao  \n[dbgao@smu.edu.sg](dbgao@smu.edu.sg)[ ](dbgao@smu.edu.sg)Singapore Management University Singapore  \nYue Duan  \n[yueduan@smu.edu.sg](yueduan@smu.edu.sg)[ ](yueduan@smu.edu.sg)Singapore Management University Singapore  \narXiv :2607 .06009v 1 [ cs .CR] 7 Jul 2026  \nAbstract  \nAttributing code to the large language model that produced it is essential for provenance, licensing, and misuse accountability, yet no deployed watermark meets this need. Generation-time schemes require access to the producing model and cannot be applied to third-party code, while post-hoc schemes work on any code but carry at most 4 bits of payload, far too few to distinguish the many deployed model configurations. We present multi-channel spreadspectrum watermarking, the first post-hoc, training-free code watermark with a 24-bit payload and formal robustness guarantees. The scheme encodes bits in variable naming conventions and in eight pairs of semantically equivalent code patterns, and a keyed pseudo-random permutation maps every site to a codeword bit so that each bit receives multiple independent votes. Majority voting absorbs distributed corruption, while an outer Reed-Solomon code recovers the identifier when concentrated channel attacks defeat the vote, yielding provable robustness bounds for formatting, syntactic, and structural attacks. Across 1,750 Python files from CodeNet and from GPT-4.1 and Llama-4 generations, the watermark achieves 100% clean-detection accuracy with zero false positives. Under 17 attack types, it recovers the identifier at 97.6% accuracy under 8 variable renames and 94.1% under 10% random per-site corruption, while the strongest post-hoc baseline collapses to 0% under any single-transform attack. Embedding and detection together take under 200 ms on CPU without training data or GPU.  \nCCS Concepts  \n• Security and privacy → Digital rights management; Software and application security; • Theory of computation → Error-correcting codes; • Computing methodologies → Artificial intelligence.  \nKeywords  \nCode watermarking, Large language models, Model attribution, Multi-channel watermarking, Spread-spectrum, Reed-Solomon codes, Post-hoc watermarking  \nACM Reference Format:  \nSoohyeon Choi, Debin Gao, and Yue Duan. 2018. Multi-Channel SpreadSpectrum Code Watermarking. In Proceedings of Make sure to enter the correct  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org).  \nConference acronym ’XX, Woodstock, NY  \n© 2018 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/2018/06  \n[https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX)  \nconference title from your rights confirmation email (Conference acronym ’XX) . ACM, New York, NY, USA, 15 pages. [https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX)  \n1 Introduction  \nLarge language models (LLMs) for code generation have moved rapidly from research demonstration to mainstream developer tool. Tools such as GitHub Copilot [4], GPT-4 [19], Code Llama [26], and Qwen-Coder [11] are now integrated into IDEs, pull-request review systems, and enterprise development pipelines, producing a substantial fraction of the code shipped to public and private ","cbCaiuJaUECtscDS","https://ap.wps.com/l/cbCaiuJaUECtscDS","pdf",729180,1,15,"English","en",105,"# Abstract\n# 1 Introduction\n## Limitations of Existing Techniques","[{\"question\":\"Why is code watermarking for large language models necessary?\",\"answer\":\"Reliable attribution supports provenance, licensing enforcement, and misuse accountability. It also helps security incident response by linking vulnerable code to a specific model release.\"},{\"question\":\"What problem do existing watermarking techniques face for third-party attribution?\",\"answer\":\"Generation-time schemes need access to the producing model and cannot be used when verification happens elsewhere. Post-hoc schemes can work without the model, but they typically carry too little payload (e.g., up to 4 bits) to distinguish many deployed configurations.\"},{\"question\":\"How does multi-channel spreadspectrum watermarking achieve robustness and higher payload?\",\"answer\":\"The method encodes bits using variable naming conventions and eight pairs of semantically equivalent code patterns. A keyed pseudo-random permutation assigns each site to a codeword bit so each bit gets multiple independent votes, with majority voting and an outer Reed-Solomon code enabling recovery under concentrated channel attacks.\"}]",1784192217,38,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"multi-channel-spread-spectrum-code-watermarking","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/multi-channel-spread-spectrum-code-watermarking/84045/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"Why is code watermarking for large language models necessary?","Question",{"text":75,"@type":76},"Reliable attribution supports provenance, licensing enforcement, and misuse accountability. It also helps security incident response by linking vulnerable code to a specific model release.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What problem do existing watermarking techniques face for third-party attribution?",{"text":80,"@type":76},"Generation-time schemes need access to the producing model and cannot be used when verification happens elsewhere. Post-hoc schemes can work without the model, but they typically carry too little payload (e.g., up to 4 bits) to distinguish many deployed configurations.",{"name":82,"@type":73,"acceptedAnswer":83},"How does multi-channel spreadspectrum watermarking achieve robustness and higher payload?",{"text":84,"@type":76},"The method encodes bits using variable naming conventions and eight pairs of semantically equivalent code patterns. A keyed pseudo-random permutation assigns each site to a codeword bit so each bit gets multiple independent votes, with majority voting and an outer Reed-Solomon code enabling recovery under concentrated channel attacks.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]