Canonical module arrangement preserving project functionality

Determine whether a canonical arrangement of software modules can be imposed while preserving the functionality and operability of the project, thereby potentially eliminating the module-placement channel used by PlaceMark.

Background

PlaceMark encodes watermark information in the arrangement of modules across packages. Its security and robustness discussion contrasts this carrier with ordering-based software watermarks, whose arrangements may be normalized or reordered by an adversary. The paper does not rule out the possibility that a repository could be transformed into a canonical module arrangement while remaining functional. If such a canonicalization procedure existed, it could remove or substantially weaken the placement-based channel without requiring arbitrary destructive changes to the software.

References

The reason the placement carrier can offer one is that its admissible set is defined by what a maintainer would accept, so an adversary cannot renormalise it the way a basic-block order can be sorted; whether some canonical arrangement could be imposed while keeping the project working is an open question rather than something we rule out.

— Blind Watermarking of Software Repositories via Module Placement  (2610.21031 - Mohamed et al., 15 Oct 2026) in Section 2, Related Work, subsection “Ordering as a carrier”