CLMTracing: Black-Box Code Attribution

• CLMTracing is a framework for black-box user-level code attribution that protects intellectual property in code generation.
• It integrates rule-based watermarks, utility-preserving injection, robustness-sensitive parameter selection, and adversarial training to safeguard against removal attacks.
• The framework bridges the gap between model-level and user-level tracing, emphasizing practical deployment in diverse code generation scenarios.

Searching arXiv for the CLMTracing paper and closely related tracing/watermarking work to ground the article. (Zhang et al., 17 Sep 2025) Searching for related work on tracing and attribution in LLMs that helps situate CLMTracing. TracLLM long context LLM attributing (Wang et al., 4 Jun 2025)

DebugLM training data provenance (Mo et al., 18 Mar 2026)

TRACE trajectory watermark (Gao et al., 9 Jul 2026)

CLMTracing is a black-box watermarking framework for code LLM tracing that is presented as addressing a specific intellectual-property problem in code generation: identifying individual users, rather than merely identifying a model family, from generated code in settings where only black-box access is available. Its published description names four principal components—rule-based watermarks, a utility-preserving injection method, a parameter selection algorithm sensitive to the robust watermark, and adversarial training—and reports effectiveness across multiple state-of-the-art code LLMs together with robustness against watermark removal attacks (Zhang et al., 17 Sep 2025).

1. Concept and placement within the tracing literature

CLMTracing belongs to the broader family of provenance and traceback systems for large models, but it addresses a distinct object of attribution. In long-context traceback, the target is the subset of input texts in a retrieved or supplied context that contributed to an answer, as in TracLLM’s context traceback framework for long-context LLMs (Wang et al., 4 Jun 2025). In training-data provenance, the target is the dataset source associated with a generated behavior, as in DebugLM’s source-tagging approach to multi-stage LLM training (Mo et al., 18 Mar 2026). In agent provenance, the target can be the execution trajectory itself, including tool calls and observations, as in TRACE’s two-channel watermark for editable LLM-agent logs (Gao et al., 9 Jul 2026). CLMTracing, by contrast, is framed as provenance for generated code, with black-box user-level attribution as the central problem (Zhang et al., 17 Sep 2025).

This distinction matters because code provenance is not equivalent to either general text authorship attribution or internal-model ownership proofs. The available description presents CLMTracing as a response to the “more practical and complex demand” of tracing at the level of the individual user in code-generation deployments, rather than only identifying that some output came from a protected code LM (Zhang et al., 17 Sep 2025). That places it at the intersection of watermarking, code generation, and deployment-level accountability.

2. Problem addressed and threat model

The motivating premise is that the widespread adoption of open-source code LLMs has made intellectual-property protection “an increasingly critical concern” (Zhang et al., 17 Sep 2025). Existing watermarking techniques are described as potentially useful for identifying the code LM itself, but insufficient for individual user-level tracing in a black-box setting. The problem is therefore not only model ownership, but attribution among downstream users or accesses that produce code outputs.

The black-box qualifier is central. The published summary does not expose a white-box mechanism based on parameters, activations, or hidden states. This suggests an operational setting in which tracing must be recoverable from generated code outputs themselves rather than from internal model state. The same summary also emphasizes robustness against watermark removal attacks, implying that attribution is meant to survive at least some adversarial post-processing of code (Zhang et al., 17 Sep 2025).

A common misconception is to treat CLMTracing as ordinary model watermarking with a code-specific name. The available description indicates a narrower and more deployment-oriented aim: tracing which user produced suspect code under black-box access, not only whether a code sample originated from a given model.

3. Named technical components

Four technical elements are explicitly attributed to CLMTracing. First, it employs rule-based watermarks. Second, it uses a utility-preserving injection method. Third, it includes a parameter selection algorithm sensitive to the robust watermark. Fourth, it uses adversarial training to enhance robustness against watermark removal attacks (Zhang et al., 17 Sep 2025).

Those four elements define the framework at a high level, even though the currently available text does not expose the substantive method section from which exact equations, thresholds, or pseudocode could be recovered. The description nevertheless implies a layered design. Rule-based watermarks indicate that the watermark carrier is not described merely as arbitrary token biasing, but as a structured set of code-generation rules. Utility-preserving injection indicates that watermark embedding is constrained by code usefulness. The robustness-sensitive parameter selection algorithm suggests that watermark configuration is chosen with removal resistance in mind rather than fixed a priori. Adversarial training then functions as a second robustness mechanism, augmenting the watermark design itself (Zhang et al., 17 Sep 2025).

A plausible implication is that CLMTracing separates the tracing problem into at least four subproblems: watermark carrier design, embedding under code-utility constraints, robustness-aware selection of watermark parameters, and attack-aware hardening. That interpretation is consistent with the named components, but the exact construction remains unavailable in the surviving public description.

4. Robustness as a first-class objective

Robustness is not presented as a secondary evaluation property. It is one of the framework’s defining claims. The abstract and summary both emphasize robustness against watermark removal attacks, and the parameter-selection and adversarial-training components are described specifically as robustness mechanisms (Zhang et al., 17 Sep 2025).

This makes CLMTracing part of a broader shift in provenance research from simple embedded signals toward adversary-aware attribution. In agent-trajectory provenance, for example, TRACE addresses a setting in which the reseller has full read/write access to the logs and therefore uses two complementary channels keyed to different invariants of the trajectory (Gao et al., 9 Jul 2026). CLMTracing operates in a different medium—generated code rather than agent logs—but the parallel is instructive: robust attribution requires identifying invariants that remain recoverable under realistic transformations.

The publicly available CLMTracing summary does not disclose the exact code-level invariants, removal models, or decision statistic. A plausible implication is that its robustness depends jointly on watermark design and detector design, rather than on a fragile embedded marker alone. That is consistent with the presence of both robustness-sensitive parameter selection and adversarial training in the framework description (Zhang et al., 17 Sep 2025).

5. Evaluation claims and empirical status

The published abstract makes three empirical claims. First, CLMTracing is said to be effective across multiple state-of-the-art code LLMs. Second, it shows “significant harmless improvements” compared to existing state-of-the-art baselines. Third, it shows “strong robustness against various removal attacks” (Zhang et al., 17 Sep 2025).

These claims establish the intended empirical position of the method, but the currently available material does not preserve the detailed experimental sections needed to enumerate datasets, benchmark tasks, baselines, thresholding rules, or numerical results. That absence is notable when CLMTracing is compared with adjacent tracing systems whose papers do expose exact evaluation protocols and metrics. TracLLM reports query and token-complexity reductions for context traceback in long-context LLMs (Wang et al., 4 Jun 2025), and AttnTrace reports explicit precision, recall, and runtime figures for long-context provenance and prompt-injection forensics (Wang et al., 5 Aug 2025). By contrast, the available CLMTracing description provides only high-level outcome claims (Zhang et al., 17 Sep 2025).

This evidentiary asymmetry does not negate the framework’s conceptual importance, but it constrains encyclopedic certainty. CLMTracing can be described confidently as a black-box, user-level watermarking framework for code LM tracing with stated robustness and utility-preservation goals. It cannot, on the basis of the available text alone, be described at the same level of implementation detail as the best-documented traceback systems in neighboring areas.

6. Significance, limitations, and open questions

The significance of CLMTracing lies in the form of provenance it targets. It treats code-generation attribution as a user-level tracing problem under black-box access, thereby extending watermarking from model identification to deployment accountability (Zhang et al., 17 Sep 2025). In that respect it is part of a larger trend toward operational provenance: DebugLM internalizes dataset-source lineage inside model outputs (Mo et al., 18 Mar 2026), TRACE binds provenance to editable agent trajectories (Gao et al., 9 Jul 2026), and ClawTrace compiles agent executions into TraceCards with per-step USD cost, token counts, and redundancy flags for downstream analysis (Yuan et al., 26 Apr 2026). CLMTracing contributes to this landscape by positioning generated code itself as the carrier of recoverable attribution.

Its principal limitation, as far as the currently available record is concerned, is documentary rather than conceptual. The supplied material does not contain the substantive sections required to recover the exact watermark construction, injection objective, parameter-selection procedure, detector, thresholds, datasets, baselines, or quantitative tables. As a result, several issues remain open at the encyclopedia level. A plausible research agenda includes the capacity of user-level codebooks, calibration of false positives in black-box attribution, the effect of code transformations on recoverability, and the relationship between user-level code watermarking and richer execution-level provenance artifacts such as TraceCards (Yuan et al., 26 Apr 2026).

CLMTracing is therefore best understood as a declared framework and research direction whose defining features are already clear—black-box operation, user-level tracing, rule-based watermarks, utility-preserving injection, robustness-sensitive parameter selection, and adversarial training—but whose full technical specification remains unavailable in the surviving public description (Zhang et al., 17 Sep 2025).