In the modern era of software creation, a quiet revolution is underway. Large language models, the powerful artificial intelligence systems capable of writing computer code, have become standard tools for developers, promising to speed up the building of digital applications. However, this convenience brings a significant challenge: when a machine writes a program, it becomes nearly impossible to tell who actually created it. The lines between human effort and machine generation blur, leaving software companies and researchers vulnerable to theft, plagiarism, and the spread of unverified code. To solve this, experts have long tried to hide digital signatures, or watermarks, inside the text of the code itself. But these traditional methods are fragile; they are like writing a secret message in the spacing between words, which gets destroyed the moment someone re-types the document or changes the font. The code remains the same, but the hidden message vanishes.

A new approach, detailed in recent research, shifts the strategy from the surface of the text to the underlying logic of the program. Instead of hiding a message in the words, this method hides it in the structure of the code's architecture. The researchers developed a system that treats a computer program not as a line of text, but as a hierarchical map of its own logic, known as an abstract syntax tree. This map shows how different parts of the code connect and interact, regardless of how the code is formatted or named. By making tiny, mathematically guaranteed changes to this structure—such as swapping the order of two numbers in a calculation that does not matter, or turning a specific type of loop into a different but equivalent type of loop—the system embeds a cryptographic signature directly into the program's DNA. These changes are invisible to the computer running the code and do not alter what the software does, but they leave a permanent, detectable mark that survives even if the code is heavily edited or rewritten.

The core of this framework relies on a tool called tree-sitter, which acts as a high-fidelity parser capable of reading code and reconstructing its logical skeleton without losing any details. Unlike standard tools that might discard formatting or comments, this system preserves the exact byte-by-byte layout of the source file while building a tree structure that represents the code's logic. The researchers used this to identify specific spots in the code where they could safely make changes without breaking the program. They focused on three main types of transformations. First, they looked for commutative operations, where the order of two items does not change the result, such as adding two numbers together. Swapping the order of these numbers is a safe way to encode a single bit of data. Second, they identified independent statements, or lines of code that do not rely on each other, and rearranged their order. Third, they transformed certain control structures, such as changing a standard loop that counts up to a number into a different type of loop that achieves the exact same result.

To embed a watermark, the system uses a secret key to generate a specific sequence of these structural changes. It then scans the code, finds the eligible spots, and applies the changes dictated by the secret key. For example, if the key says to swap the order of a specific addition, the system does so. If the key says to keep the order, it leaves it alone. Because these changes are based on the logic of the language rather than the specific words used, they survive standard formatting tools that simply clean up spacing or rename variables. Even if a developer runs the code through a formatter that reorganizes the entire file, the logical structure remains intact, and the hidden signature persists. The system is designed to be robust against attempts to scrub the watermark, including attacks where a second artificial intelligence is asked to rewrite the code to remove the signature.

To verify if a piece of code contains a watermark, the researchers built a detection engine that works in reverse. It takes a piece of code, reconstructs its logical tree, and looks at the same spots where changes could have been made. It then checks the state of those spots against the expected pattern generated by the secret key. If the code was watermarked, the pattern of changes will match the secret key far more often than would be expected by random chance. The researchers used a statistical test to measure this likelihood, comparing the observed matches against a baseline of random variation. If the number of matches is high enough, the system concludes with high confidence that the code was generated by the specific AI model that applied the watermark. This process is rigorous and mathematical, ensuring that the detection is not a guess but a statistically significant finding.

The researchers tested their framework against a wide range of attacks to see how well it held up. They simulated scenarios where the watermarked code was passed through formatting tools, had its variables renamed, or was rewritten by another artificial intelligence model to clean it up. In these tests, the traditional text-based watermarking methods failed almost completely. When the code was formatted, the text-based signatures were destroyed, and the detection rate dropped to a mere fraction of what it was on clean code. In contrast, the new structural approach maintained a detection rate of nearly ninety-nine percent even after formatting. When the code was subjected to variable renaming, the structural method still detected the watermark in almost all cases, whereas older structural methods struggled. Even when a second artificial intelligence was used to paraphrase and rewrite the code, a technique that is very difficult to defend against, the new framework retained a detection rate of over eighty-four percent. This resilience is due to the system embedding many copies of the signature across the code; even if the rewriting process destroys some of the marks, enough remain to prove the origin.

The study also addressed the concern that these changes might break the code or slow it down. The researchers verified that every transformation they applied preserved the exact output of the program and did not change its speed or memory usage. The code compiled and ran perfectly, with zero functional degradation. This is a critical distinction from other methods that try to bias the AI during the writing process, which can sometimes lead to errors or invalid code. By working on the finished code and making only mathematically safe swaps, the framework ensures that the software remains fully functional. The detection process itself is also efficient, relying on a statistical test that can be run quickly to verify the provenance of large amounts of code.

The implications of this work extend beyond simple copyright protection. As artificial intelligence becomes more integrated into the software supply chain, the ability to verify the origin of code becomes a matter of security. If a piece of code contains a hidden vulnerability introduced by an AI, knowing its source is essential for fixing the problem. This framework provides a way to trace that origin, ensuring that mission-critical software can be vetted and trusted. The researchers demonstrated that their method works across a dataset of thousands of generated scripts, showing that it is scalable and ready for real-world use. While the study was conducted on Python code, the principles of structural invariance apply to many programming languages, suggesting a broad path forward for securing the digital tools of the future.

The findings suggest a fundamental shift in how we protect intellectual property in the age of artificial intelligence. By moving the watermark from the fragile surface of the text to the robust skeleton of the logic, the researchers have created a system that is difficult to erase and easy to verify. The results indicate that this approach is not just a theoretical possibility but a practical solution that can withstand the aggressive editing and rewriting that characterizes modern software development. As the line between human and machine code continues to blur, this structural watermarking offers a reliable way to maintain transparency and accountability in the software we build. The research confirms that it is possible to embed a permanent, unbreakable signature into the very logic of a program, ensuring that the true origin of the code remains visible, no matter how much the surface is changed.