Is The Watermarking Of LLM-Generated Code Robust?

TL;DR

This study investigates the robustness of watermarking techniques on LLM-generated code, revealing they are fragile against simple semantic-preserving transformations like variable renaming and dead code insertion.

Contribution

It provides the first systematic analysis of watermark robustness in code, developing an algorithm to evaluate resilience against semantic-preserving modifications.

Findings

Watermarks are easily erased by variable renaming.

Dead code insertion significantly reduces watermark detectability.

Robustness of watermarking in code is much lower than in text.

Abstract

We present the first in depth study on the robustness of existing watermarking techniques applied to code generated by large language models (LLMs). As LLMs increasingly contribute to software development, watermarking has emerged as a potential solution for detecting AI generated code and mitigating misuse, such as plagiarism or the automated generation of malicious programs. While previous research has demonstrated the resilience of watermarking in the text setting, our work reveals that watermarking techniques are significantly more fragile in code-based contexts. Specifically, we show that simple semantic-preserving transformations, such as variable renaming and dead code insertion, can effectively erase watermarks without altering the program's functionality. To systematically evaluate watermark robustness, we develop an algorithm that traverses the Abstract Syntax Tree (AST) of a watermarked program and applies a sequence of randomized, semantics-preserving transformations. Our experimental results, conducted on Python code generated by different LLMs, indicate that even minor modifications can drastically reduce watermark detectability, with true positive rates (TPR) dropping below 50% in many cases. Our code is publicly available at https://github.com/uiuc-arc/llm-code-watermark.