Technical Summary: Echoes within the Reasoning: Stealthy and Effective Watermarking via Chain of Thought

1. Problem Statement

Large Language Models (LLMs) with Chain-of-Thought (CoT) reasoning capabilities represent high-value intellectual property, yet they face severe threats of unauthorized theft and unlicensed commercialization. Existing black-box watermarking methods struggle to balance robustness with model utility.

• Backdoor-based approaches rely on fixed trigger-action patterns, which force models to overfit, compromising fidelity on complex tasks and generalization. They are also vulnerable to detection and filtering if triggers are leaked.
• Model editing-based approaches treat watermarks as static knowledge to be memorized via rigid templates, making them fragile against distribution shifts or adaptive attacks on prompt structures.
• Fundamental Limitation: Both paradigms typically verify ownership by modifying the Final Answer. This creates a zero-sum conflict between correctness (utility) and watermarking strength. Modifying the final answer often degrades the model's performance on downstream tasks.

The paper posits that a paradigm exists to achieve both stealthiness and effectiveness while strictly preserving model fidelity by shifting the verification space from the final answer to the Chain-of-Thought (CoT) reasoning process.

2. Methodology: BiCoT

The authors propose BiCoT (Bi-level Chain-of-Thought), a watermarking framework that embeds ownership signals into the internal geometry of reasoning traces rather than the final output. The method operates in three stages:

A. Geometric Formulation (Stage I)

BiCoT models the LLM's latent state as a trajectory on a high-dimensional Reasoning Manifold.

• Structural Anchors: Through gradient saliency analysis, the authors identify that specific tokens (e.g., digits in mathematical reasoning, logical connectives in other domains) act as "structural anchors" that disproportionately govern reasoning dynamics.
• Manifold Alignment: The framework defines a private Signature Subspace ($S_v$) parameterized by a unit vector $v$.
  • Anchor Tokens: Their hidden states are constrained to collapse onto the signature subspace ($\cos(h_t, v) \to 1$).
  • Control Tokens: Ordinary linguistic tokens (connectors, stopwords) are enforced to remain orthogonal to the signature ($\cos(h_t, v) \to 0$) to preserve semantic capacity and reasoning fidelity.
• Causal Halo: Tokens immediately following an anchor are treated as a separate category; they may exhibit short-range residual alignment but decay rapidly, ensuring the watermark does not globally contaminate ordinary text.

B. Watermark Injection (Stage II)

The injection process is formulated as a Bi-level Optimization problem:

• Inner Loop: Computes a virtual hidden-state perturbation ($\delta^*$) that maximizes the projection of anchor states onto the signature subspace.
• Outer Loop: Updates model parameters ($\theta$) to minimize a combined objective:
  1. Task Loss ($L_{task}$): Ensures the model maintains performance on downstream reasoning tasks.
  2. Geometric Loss ($L_{geo}$): Enforces the collapse of anchors to the signature and orthogonality of control tokens.
  3. Consistency Regularizer ($L_{KL}$): Maintains local consistency between the watermarked model and the base model on CoT prefixes.
     This design couples the watermark with reasoning-relevant representations, making removal difficult without disrupting the features that support coherent reasoning.

C. Robust Subspace Registration (Stage III)

To address representation drift caused by attacks (e.g., fine-tuning, quantization), the authors introduce Robust Subspace Registration (RSR).

• Sentinel Tokens: A set of pre-identified tokens sensitive to the signature subspace are used as probes.
• Drift Calibration: The verifier estimates the systematic distributional drift vector ($\hat{\mu}_{drift}$) by computing the median deviation of sentinel tokens from their base statistics.
• Re-alignment: The observed logits are corrected by subtracting the estimated drift, effectively re-centering the drifted manifold back to the canonical signature space before hypothesis testing.
• Verification: The system performs a hypothesis test on the calibrated logits of sentinel tokens using only Top-$k$ log-probabilities (black-box access).

3. Key Contributions

1. Causal Analysis of CoT: The paper reveals that CoT generation possesses a distinct causal hierarchy where specific "structural anchors" govern reasoning dynamics. It demonstrates that CoT offers a richer, higher-capacity, and more diverse carrier for signals than the low-entropy final answer.
2. BiCoT Framework: A novel watermarking paradigm that embeds ownership into the geometry of the reasoning manifold. It utilizes bi-level optimization to entangle the watermark with the reasoning process itself while treating control tokens orthogonally to preserve utility.
3. Robust Verification (RSR): A black-box verifier capable of handling representation drift via sentinel-based registration, ensuring reliable detection even under model-level perturbations and adaptive attacks.

4. Experimental Results

Experiments were conducted primarily on Qwen2.5-7B-Instruct and validated across Mistral-7B, DeepSeek-7B, and Qwen2.5-14B.

• Detectability: BiCoT achieves 1.0 AUC and 100% Watermark Success Rate (WSR) at 0.1% and 1.0% False Positive Rates (FPR) across all tested models, significantly outperforming baselines like iSeal, llmmap, and SEAL.
• Fidelity: The watermarked model preserves downstream performance. On reasoning tasks (GSM8K), the performance degradation is marginal ($\approx -0.0083$). On sentence-level understanding tasks, fluctuations are minor, with some tasks showing slight gains.
• Robustness:
  • Model-level attacks: The watermark remains detectable (AUC $\approx$ 1.0) under Gaussian noise, full-parameter Supervised Fine-Tuning (SFT), Parameter-Efficient Fine-Tuning (PEFT/LoRA), and aggressive quantization (8-bit).
  • Output-level attacks: The method is resilient to adaptive attacks, including a targeted "ANCHOR" attack where the adversary explicitly masks digit tokens during inference. The watermark persists due to the intrinsic redistribution of attention mechanisms.
• Ablation Studies: Removing the watermark loss results in random-guess performance. Removing the Re-anchoring (RSR) mechanism causes a catastrophic drop in detection under drift, validating its necessity.

5. Significance and Claims

The paper claims that BiCoT resolves the fundamental trade-off between watermarking strength and model utility by decoupling the verification signal from the final answer. By embedding ownership into the geometry of the reasoning process, the method achieves:

• Stealthiness: The watermark is invisible in the final output text and does not rely on brittle triggers.
• Effectiveness: It provides robust detection against adaptive attacks and model drift.
• Fidelity: It strictly preserves the model's reasoning capabilities and generalization.

The authors emphasize that this approach supports model provenance and intellectual property protection for open-source and commercial LLMs without compromising their utility as reasoning engines. The work assumes a logprob-enabled black-box setting (access to Top-$k$ next-token probabilities), which the authors argue is a practical boundary for many modern API deployments, rather than an unrealistic oracle assumption.