MATRIX: Multi-Layer Code Watermarking via Dual-Channel Constrained Parity-Check Encoding

Abstract: Code LLMs (Code LLMs) have revolutionized software development but raised critical concerns regarding code provenance, copyright protection, and security. Existing code watermarking approaches suffer from two fundamental limitations: black-box methods either exhibit detectable syntactic patterns vulnerable to statistical analysis or rely on implicit neural embedding behaviors that weaken interpretability, auditability, and precise control, while white-box methods lack code-aware capabilities that may compromise functionality. Moreover, current single-layer watermarking schemes fail to address increasingly complex provenance requirements such as multi-level attribution and version tracking. We present MATRIX, a novel code watermarking framework that formulates watermark encoding as solving constrained parity-check matrix equations. MATRIX employs dual-channel watermarking through variable naming and semantic-preserving transformations, enhancing watermark coverage across a wider range of code while ensuring mutual backup for robustness. By integrating BCH error-correction codes with solution space diversity, our approach achieves robustness against statistical analysis. Extensive evaluation on Python code generated by multiple Code LLMs demonstrates that MATRIX achieves an average watermark detection accuracy of 99.20% with minimal functionality loss (0-0.14%), improves robustness by 7.70-26.67% against various attacks, and increases watermarking applicability by 2-6x compared with existing methods. These results establish MATRIX as an effective solution for complex code provenance scenarios while balancing among detectability, fidelity, and robustness.

• The paper introduces a dual-channel, multi-layer watermarking framework using parity-check matrices for precise code attribution and robust error correction.
• It leverages BCH encoding and semantic-preserving transformations to ensure high fidelity and recover watermarks even under adversarial attacks.
• Empirical results show over 95% detection rates across various transformations, validating Matrix's superior robustness and scalable traceability.

Multi-Layer Code Watermarking with Matrix: Dual-Channel Constrained Parity-Check Encoding

Motivation and Problem Formulation

Code LLMs are transforming code generation but intensify concerns around copyright, provenance, and code quality. Conventional watermarking approaches—both black-box (syntactic bit-to-transformation mappings, implicit neural embeddings) and white-box (token-level green/red lists)—struggle with robustness, interpretability, and precise control. Particularly, they are limited in supporting fine-grained multi-layer attribution and version tracking due to rigid single-layer watermarking. These inadequacies pose significant obstacles for tracing intricate code lineage and enforcing copyright under adversarial transformations, necessitating more flexible, robust watermarking paradigms.

Matrix addresses these issues by encoding watermark sequences via constrained parity-check matrices, and embedding them using semantic-preserving code transformations and variable naming alterations. The dual-channel design—natural (variable renaming) and formal (code transformations)—enhances coverage and mutual redundancy, improving robustness. BCH codes provide solution space diversity and error correction, supporting indistinguishability under statistical scrutiny and maximizing embeddable codebases.

Figure 1: Visualization contrasting single-layer versus the proposed multi-layer watermarking, demonstrating increased flexibility and fine-grained attribution in the multi-layer paradigm.

Methodological Innovations

Parity-Check Encoded Watermarks & Dual-Channel Embedding

Matrix formalizes code watermark insertion as solving a CSP over parity-check matrices. Identity messages $m$ are BCH-encoded to $w$, with additional solution space diversity: for each embedding, $w$ is randomly selected within the error-correcting radius, obfuscating deterministic mappings between $m$ and code transformations. Anchor points are identified in the AST via an ordered set of semantic-preserving transformation rules and variable renaming operations. Grouping anchor points enables embedding scalable, multi-layer watermarks, with redundancy across both channels to facilitate mutual backup.

Insertion proceeds as:

• Identify and group anchor points in both channels.
• Estimate embedding capacity and select BCH code parameters and parity-check matrices.
• Solve the parity-check CSP for state vectors, ensuring that grouped anchor states meet thresholds aligned with $w$.
• Apply forward/reverse transformations per anchor state; thus, code is watermarked without semantic loss.

Extraction performs static analysis to reconstruct anchor states, verify parity-check constraints, and recover $w$, supporting attribution even under channel-specific or simultaneous attacks.

Figure 2: Matrix's end-to-end workflow, illustrating insertion and extraction via dual-channel, parity-check-driven encoding.

Empirical Evaluation

Watermark Detection and Attribution Accuracy

Matrix demonstrates outstanding detection performance. Across multiple datasets (APPS, HumanEval, MBPP), Matrix attains a 99.20% average TPR and up to 100% MsgAcc in watermark recovery, significantly outperforming ACW and SWEET. The dual-channel design ensures detection even if one embedding channel is disrupted, balancing robustness and minimal false positive rates.

Cross-organizational attribution experiments confirm that changing only the parity-check matrix allows Matrix to distinguish watermarks applied by different organizations without system-level disruption. TPRs remain consistently high ($>$95%), supporting scalable multi-layer attribution.

Robustness Under Adversarial Code Transformations

Matrix is robust against common adversarial attacks:

• Variable Renaming Attack (VA): Maintains TPRs $>$96%, far exceeding ACW and SWEET. Variable-dependent rules in baselines are fragile under renaming.
• Refactoring Attack (RA): High TPRs ($>$92%), as structural mutations do not defeat redundancy and parity encoding.
• LLM-Based Rewriting Attack (LA): Retains 51–54% TPR, about 5–10% higher than baselines, benefiting from solution space diversity.
• Format Attack (FA): TPR often at 100%, indicating immunity to formatting-only transformations.

  Figure 3: Robustness results showcasing Matrix's superiority under variable-renaming, refactoring, LLM-based rewriting, and formatting attacks.

Fidelity and Functional Preservation

Functional transparency is preserved: unit test pass rates drop by only 0–0.14%. SWEET suffers up to 7.60% degradation due to local token constraints; Matrix's semantic-preserving transformations ensure near-lossless fidelity.

Indistinguishability and Statistical Resistance

Matrix resists statistical inference attacks. Anchor activation frequencies are stochastic and demonstrate substantial overlap between different watermark messages, yielding average JSD $<$0.05 across message pairs. Mutual information between activations and watermark bits is minimal, ensuring $w$0-indistinguishability.

Moreover, intra-message diversity is confirmed by broad pairwise similarity distributions, refuting stable structural signatures exploitable by adversaries.

Figure 4: Anchor activation frequencies under multiple watermark messages; curves are overlapping, lacking deterministic associations.

Figure 5: Heatmap of pairwise similarity between watermarked samples, evidence for stochastic intra-message diversity.

Case Study: Dual-Channel Attack Resilience

In adversarial case studies, Matrix recovers the watermark when only one channel is attacked. Even under extensive simultaneous channel perturbations, BCH parity-check redundancy allows recovery when resulting anchor state vectors remain feasible under the matrix constraints.

Figure 6: Case study visualization; attacked code regions in red, watermarked anchors in blue, highlighting successful recovery under single and dual-channel attacks.

Practical and Theoretical Implications

Matrix provides scalable, interpretable, and robust code provenance tracing for LLM-generated code, balancing detectability, fidelity, robustness, and indistinguishability. Its multi-layer encoding paradigm supports hierarchical attribution, crucial for provenance in collaborative, multi-stakeholder settings. The dual-channel, static-analysis-driven approach underpins practical deployment in diverse codebases, with minimal overhead and extensibility to longer BCH codewords for richer attribution granularity.

The parity-check and randomized BCH encoding offer theoretical improvements, reducing deterministic structural signatures and strengthening resilience against inference attacks. Nevertheless, future extensions could focus on embedding in syntactically incomplete fragments, expanding the set of semantic-preserving transformations via learning-based but interpretable mechanisms, and scaling capacity for extremely fine-grained attribution.

Conclusion

Matrix introduces a principled, multi-layer watermarking framework for code LLMs, leveraging dual-channel encoding and parity-check-constrained BCH mapping. Extensive empirical analysis establishes its superiority in detection, robustness, fidelity, and indistinguishability. Matrix is a practical foundation for provenance and copyright enforcement in AI-generated code, with substantial implications for secure code traceability and attribution architectures.