Disappearing Ink: Obfuscation Breaks N-gram Code Watermarks in Theory and Practice

TL;DR

This paper demonstrates that N-gram-based code watermarks are fundamentally vulnerable to obfuscation, providing formal proofs and experimental evidence that such watermarks cannot be reliably robust against sophisticated code transformations.

Contribution

The work formally proves the impossibility of robust N-gram watermarking under obfuscation and empirically validates this vulnerability across multiple schemes, models, and languages.

Findings

Watermarks fail to detect obfuscated code (AUROC ~ 0.5).

Obfuscation can reduce detection accuracy below 0.6.

Formal proof of the fundamental vulnerability of N-gram watermarking.

Abstract

Distinguishing AI-generated code from human-written code is becoming crucial for tasks such as authorship attribution, content tracking, and misuse detection. Based on this, N-gram-based watermarking schemes have emerged as prominent, which inject secret watermarks to be detected during the generation. However, their robustness in code content remains insufficiently evaluated. Most claims rely solely on defenses against simple code transformations or code optimizations as a simulation of attack, creating a questionable sense of robustness. In contrast, more sophisticated schemes already exist in the software engineering world, e.g., code obfuscation, which significantly alters code while preserving functionality. Although obfuscation is commonly used to protect intellectual property or evade software scanners, the robustness of code watermarking techniques against such transformations remains largely unexplored. In this work, we formally model the code obfuscation and prove the impossibility of N-gram-based watermarking's robustness with only one intuitive and experimentally verified assumption, distribution consistency, satisfied. Given the original false positive rate of the watermarking detection, the ratio that the detector failed on the watermarked code after obfuscation will increase to 1 - fpr. The experiments have been performed on three SOTA watermarking schemes, two LLMs, two programming languages, four code benchmarks, and four obfuscators. Among them, all watermarking detectors show coin-flipping detection abilities on obfuscated codes (AUROC tightly surrounds 0.5). Among all models, watermarking schemes, and datasets, both programming languages own obfuscators that can achieve attack effects with no detection AUROC higher than 0.6 after the attack. Based on the theoretical and practical observations, we also proposed a potential path of robust code watermarking.