Toward Stronger Code Watermarking: A Grammar-Driven Approach to Optimizing the Trade-off Between Quality and Detectability

Jul 16, 2026

Upload by Oliver

Large Language Models (LLMs) enable widespread machine-generated code, making text watermarking essential for provenance verification and potential copyright concerns. Existing logits-based watermarking is difficult to transfer to code because low-entropy, rigid syntax intensifies the conflict between generation quality and detectability. This paper introduces Grammar-Driven Watermark (GDW), which uses a grammar-guided three-level masking mechanism to preserve syntactic validity and applies structural role-aware modulation for better trade-offs. Experiments across languages and decoding strategies show improved quality–detectability and robustness to variable-renaming attacks.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages12

Reading Time30 min

Abstract

Introduction

Motivation and problem setting

Limitations of existing watermarking for code

Entropy observations for syntax vs content tokens

Proposed Grammar-Driven Watermark (GDW)

Toward Stronger Code Watermarking: A Grammar-Driven Approach to Optimizing the Trade-off Between Quality and Detectability Licheng Yu1 , Aiwei Liu2 , Songze Li1 * 1 Southeast University 2Tsinghua University {lichengyu, [songzeli}@seu.edu.cn](songzeli}@seu.edu.cn) , [liuaiwei20@gmail.com](liuaiwei20@gmail.com) arXiv :2607 . 102 10v 1 [ cs .CR] 11 Jul 2026 Abstract With the rapid development of Large Language Models (LLMs), text watermarking has emerged as a crucial technique for identifying machine-generated content. However, directly applying existing logits-based watermarking methods to code generation remains challenging, since the low-entropy nature of code exacerbates the trade-off between code quality and watermark detectability. In this paper, we propose a novel code watermarking approach called Grammar-Driven Watermark (GDW) for LLMs. GDW preserves syntactic validity through a grammar-guided threelevel masking mechanism and injects watermark signals via structural role-aware modulation, assigning a stronger bias to contentbearing tokens while applying a more conservative bias to syntax-critical tokens. Aligning with the generation process, we further design a role-aware weighted detection statistic to improve detectability. Experiments across multiple programming languages, models, and decoding strategies show that GDW establishes a stronger quality-detectability trade-off frontier than existing methods, while maintaining robustness against variable-renaming attacks. 1 Introduction In recent years, large language models (LLMs) have become indispensable tools for code generation and programming assistance, powering widely used AI coding assistants such as GitHub Copilot (Microsoft and OpenAI, 2021), Cursor (Anysphere, 2023) and Claude Code (Anthropic, 2025) . However, as LLM-generated code becomes increasingly integrated into open-source projects and industrial software, concerns about code provenance and potential copyright infringement have increased substantially (Dey et al., 2019) . Therefore, algorithms that can effectively identify machine-generated code have become crucial. * Corresponding author. Figure 1: Comparison among existing logits-based watermark, entropy-based watermark, and our GrammarDriven Watermark in terms of the trade-off between watermark detectability and code quality. Our proposed method GDW achieves a better trade-off frontier. Watermarking has emerged as a promising solution for identifying machine-generated content by embedding imperceptible but statistically detectable signals into model outputs. One dominant paradigm for LLM text watermarking is the logitsbased watermark, which injects signals by modifying the model’s output logits (Kirchenbauer et al., 2023a) . Specifically, the vocabulary is pseudorandomly partitioned into a ‘green list’ and a ‘red list’ at each decoding step. By adding a constant bias to the logits of green-list tokens, the model is encouraged to select tokens within the green list, which can later be identified via a statistical z-test. However, while logits-based watermarking methods have shown effectiveness in natural language generation tasks, their application to code is hindered by the low-entropy nature of programming languages. Code is low-entropy text, where the model’s output logits are highly concentrated due to the rigid syntax. In such settings, naively injecting watermark bias into low-entropy tokens can significantly distort the generation process. A watermark bias that is too strong may degrade the code’s functionality or readability, while a weaker watermark bias might be difficult to detect. Figure 2: Mean token entropy of syntax-critical tokensand content-bearing tokens measured with Qwen2.5-Coder-3B across Python, Java, and Go. This observation motivates our structural role-aware modulation strategy. To address this, researchers propose entropybased watermarking methods (Lee et al., 2024 ; Lu et al., 2024), applying waterma

FAQs

Why are logits-based watermarking methods challenging for code generation?

Code tokens have low entropy due to rigid syntax, so adding watermark bias can significantly distort generation. A strong bias harms functionality or readability, while a weak bias reduces detectability.

How does Grammar-Driven Watermark (GDW) preserve syntactic validity?

GDW integrates a context-free grammar into decoding and uses a grammar-guided three-level masking mechanism. This enforces syntactic constraints while watermark signals are injected.

What strategy does GDW use to balance quality and detectability?

GDW applies role-aware modulation: stronger watermark bias to content-bearing tokens and more conservative bias to syntax-critical tokens. It also uses a role-aware weighted detection statistic aligned with the generation process.

Jul 16, 2026

Upload by Oliver