💻 computer science

PromptMark: A Prompt-Guided Iterative-Feedback Framework for Source Code Watermarking

PromptMark is a black-box, prompt-guided framework that embeds detectable watermarks into AI-generated source code through structured input instructions and iterative feedback, achieving strong attribution without compromising code functionality or requiring access to model internals.

Original authors: Istiaq Ahmed Fahad, Mridha Md. Nafis Fuad, Kazi Sakib

Published 2026-06-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Istiaq Ahmed Fahad, Mridha Md. Nafis Fuad, Kazi Sakib

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a baker who hires a very talented, but invisible, robot chef to bake thousands of loaves of bread every day. You want to know which loaf was baked by your robot and which one was baked by a human competitor, but the robot doesn't leave a signature, and the bread looks exactly the same on the outside.

This is the problem PromptMark solves, but instead of bread, it's about computer code written by Artificial Intelligence (AI).

Here is how the paper explains the solution, broken down into simple concepts:

1. The Problem: The "Black Box" Chef

In the real world, most developers don't own the AI models they use; they rent them through a "black box" service (like a restaurant where you can't see the kitchen).

The Challenge: You can't peek inside the robot's brain to change how it thinks (this is called "white-box" access). You can only give it a recipe (a prompt) and wait for the dish (the code).
The Risk: If the AI writes code that breaks or steals credit, it's hard to prove it was the AI. Also, if you try to force the AI to write code in a weird way to mark it, the code might stop working (like a robot trying to bake bread with a hammer).

2. The Solution: The "Green List" Recipe

The researchers created a method called PromptMark. Instead of trying to hack the robot's brain, they simply change the instructions they give it.

Think of it like giving the robot chef a special rule: "For every new ingredient name you invent, you must start the name with a letter from this specific 'Green List' (like A, B, or C)."

The Green List: This is a secret list of letters (e.g., A, B, C) chosen based on a secret key.
The Red List: These are letters the robot is told to avoid starting names with.
The Trick: The robot follows these rules so well that it starts naming its variables (like apple_count or banana_loop) with Green letters much more often than a human would naturally.

3. The "Iterative Feedback" Loop: The Taste Test

Sometimes, the robot might forget the rule or write code that doesn't work because it's trying too hard to follow the rule. To fix this, PromptMark uses a feedback loop:

Round 1: The robot writes the code.
The Check: A human (or another computer) checks two things:
- Does the code actually work? (Did the bread rise?)
- Did the robot follow the "Green List" rule enough? (Are there enough A, B, C names?)
The Feedback: If the code is broken, the robot is told, "Fix the logic." If the code works but the Green List rule is weak, the robot is told, "Great job, but use more 'A' names next time."
Round 2: The robot tries again with the new instructions.

It keeps doing this until the code is perfect and the watermark is strong.

4. The Detection: The "Statistical Detective"

How do you know if a piece of code was made by the AI? You don't need to see the secret key. You just look at the names.

Natural Code: Humans name things randomly. If you look at 100 variables, maybe 10 start with 'A', 10 with 'B', etc. It's a balanced mix.
Watermarked Code: Because the AI was forced to use the "Green List," you will see a strange pattern. Maybe 60% of the names start with 'A', 'B', or 'C'.
The Test: A statistical test (like a math detector) counts these letters. If the pattern is too strong to be a coincidence, it shouts, "This was written by the AI!"

5. Why It's Special

The paper claims this method is special for three reasons:

It's Invisible: The code still looks normal and works perfectly. The "watermark" is just a subtle pattern in the names, like a hidden message in a song's lyrics that you only notice if you know the pattern.
It Works on Black Boxes: You don't need to own the AI or see its internal code. You just talk to it like a normal user.
It's Secure: The "Green List" is generated using a secret key (like a password). Only someone with that key knows which letters to look for, making it hard for others to fake the watermark.

The Results

The researchers tested this on two famous sets of coding problems (MBPP and HumanEval) using two different AI models (Gemini and Claude).

Success Rate: The method successfully marked the code about 90% to 98% of the time without breaking the code.
Quality: The code remained just as good as code written without the watermark.

The Limitations (What the paper admits)

Renaming Attacks: If someone takes the watermarked code and manually changes all the variable names to something else, the watermark disappears. The paper notes that while the method is good, it isn't magic; a determined human could erase the signal by rewriting the code.
Language Specific: The study was done on Python code. The paper warns that languages with different naming rules might behave differently.

In short, PromptMark is a way to whisper a secret instruction to an AI chef: "Name your ingredients with these specific letters," allowing you to later prove, with math, that the AI made the dish, all without ruining the taste of the food.

Technical Summary: PromptMark

Problem Definition

The proliferation of Large Language Models (LLMs) in software development has created a critical need for code provenance—the ability to verify the origin and authorship of AI-generated source code. While watermarking is a standard technique for digital content, applying it to source code presents unique challenges:

Structural Rigidity: Unlike natural language, source code is syntactically strict; minor modifications can break compilation or alter program logic.
Black-Box Constraints: Most developers interact with commercial LLMs via APIs where model internals (logits, decoding strategies) are inaccessible. Existing watermarking methods often require "white-box" access to manipulate token probabilities, rendering them impractical for real-world deployment.
Balancing Act: Effective watermarking must embed detectable signals without compromising the functional correctness or readability of the code.

The core problem addressed by this paper is designing a black-box, prompt-guided watermarking framework that can embed invisible, statistically detectable signals into source code without access to model internals, while preserving code functionality.

Methodology: PromptMark

The authors propose PromptMark, a three-phase framework that leverages the instruction-following capabilities of LLMs to steer generation toward specific patterns.

1. Cryptographic Green List Construction

Instead of manipulating model logits, PromptMark biases the model via system prompts.

Green/Red Lists: The framework defines a "Green List" (allowed initial characters for identifiers/comments) and a "Red List" (forbidden characters).
Frequency-Based Stratification: To ensure naturalness, the Green List is derived from the frequency distribution of identifier initials in human-written code (using MBPP and HumanEval datasets). The system selects the top- $K$ most frequent letters ( $K \in [10, 12]$ ) to form a candidate pool.
Cryptographic Derivation: To prevent predictability, the specific size and composition of the Green List are deterministically derived from a 128-bit secret key using SHA-256 hashing and Fisher-Yates shuffling. This ensures reproducibility for detection while maintaining security.

2. Iterative Feedback Loop

Recognizing that a single prompt may not yield code that is both functionally correct and sufficiently watermarked, PromptMark employs an iterative process:

Generation: The LLM generates code based on a system prompt instructing it to use Green List characters for identifiers and comments.
Evaluation: The output is evaluated on two metrics:
- Functional Correctness ( $c_i$ ): Determined by unit test execution (Pass/Fail).
- Watermark Fidelity ( $p_i$ ): A statistical p-value measuring the deviation of Green List character frequency against the expected baseline.
Feedback: If the code fails tests, error logs are fed back. If the code passes but the watermark is weak, the prompt is updated to enforce stricter adherence to the Green List. This loop continues until both criteria are met or a maximum iteration limit is reached.

3. Statistical Detection

Detection is treated as a one-sided hypothesis test:

Null Hypothesis ( $H_0$ ): The code was generated without knowledge of the key (Green List frequency $\le$ baseline).
Alternative Hypothesis ( $H_1$ ): The code was watermarked (Green List frequency $>$ baseline).
Adaptive P-Value: The detector calculates an adaptive p-value, switching between an exact binomial test (for short code, $N < 30$ ) and a normal approximation (for longer code, $N \ge 30$ ). A code is deemed watermarked only if it is functionally correct and the p-value falls below a significance threshold.

Key Contributions

Black-Box Watermarking Framework: PromptMark is the first framework to demonstrate reliable zero-bit watermarking for source code using only prompt engineering, eliminating the need for model internals.
Iterative-Feedback Mechanism: The paper introduces a self-refinement loop that dynamically balances watermark strength with code correctness, addressing the trade-off often found in single-pass prompting.
Adaptive Green List Strategy (AGL): By deriving watermark tokens from high-frequency human identifier initials, the method preserves the semantic naturalness of the code, avoiding the "forced" look that often triggers detection by developers or reduces readability.
Cryptographic Security: The use of a secret key to deterministically generate the Green List ensures that the watermark is reproducible for verification but secure against prediction without the key.

Experimental Results

The framework was evaluated on MBPP and HumanEval datasets using Gemini 2.5 Flash and Claude Sonnet 4.

Effectiveness (RQ1):
- PromptMark achieved strong detectability, with AUROC scores ranging from 0.90 to 0.99 across configurations.
- The Iterative-AGL variant (Adaptive Green List) performed best, achieving an AUROC of 0.994 on Gemini/MBPP and 0.987 on Claude/MBPP.
- At a low False Positive Rate (1%–5%), True Positive Rates exceeded 90%, reaching over 95% in favorable settings.
- Baseline methods like SWEET (white-box) degraded code correctness significantly, while In-Context Watermarking (ICW) without iteration showed poor detectability (AUROC ~0.51).
Code Quality (RQ2):
- Functional Correctness: PromptMark preserved high Pass% rates, achieving ~97% on HumanEval and ~99% on MBPP, comparable to non-watermarked baselines.
- Structural Similarity: CodeBLEU scores remained stable and consistent with non-watermarked code, indicating that the watermarking process did not distort control flow or data dependencies.
Robustness:
- The watermark showed resilience to comment removal (AUROC dropped only ~3.8%).
- However, automated paraphrasing (renaming variables) caused significant degradation (AUROC dropped to ~0.71), highlighting a trade-off between naturalness and robustness against aggressive semantic-preserving attacks.

Significance and Claims

The paper claims that PromptMark successfully reframes source code watermarking as a prompt-guided task, making it feasible for commercial, black-box LLMs.

Practicality: It offers a viable solution for attribution in environments where model internals are inaccessible, addressing a gap left by white-box-only research.
Balance: The iterative feedback mechanism proves that high watermark strength and high code quality are not mutually exclusive; the framework can achieve both through dynamic refinement.
Attribution: While the current implementation supports zero-bit detection (presence/absence), the authors note that the cryptographic key separation allows for potential model-specific attribution if distinct keys are assigned to different models.

The authors conclude that while the approach establishes a foundation for zero-bit watermarking, future work is needed to develop multi-bit encodable watermarks for black-box settings and to enhance robustness against systematic renaming attacks through multi-channel embedding strategies.