Blind Watermarking of Software Repositories via Module Placement

arXiv:2610.21031 · cs.CR · Submitted 2026-10-15 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Blind Watermarking of Software Repositories via Module Placement".

Elias: The gist The gist PLACEMARK, a blind watermarking system that encodes a payload in the placement of modules within a repository,

Nadia: First, who's behind it and why it matters.

Paper summary: Nadia: So, wrapping up this look at "Blind Watermarking of Software Repositories via Module Placement," the authors are proposing this blind watermarking system using module placement as a carrier.

Elias: They’re saying that by encoding the payload in the arrangement of modules within a repository, you can get an identifier into software without it being exposed to transformations that modify the source text directly.

Priya: The title itself is pretty descriptive, but what’s the final message here about where this fits in current watermarking research?

Nadia: It suggests that module placement is a usable carrier for source code watermarks that can hold hundreds to thousands of bits on production repositories, and it’s recovered blindly from the artifact using just the key and agreed decoding parameters.

Elias: The core design constraint that makes this work is that the carrier set and reading order must be invariant under any operation we might perform on the repository structure for us to have a chance at recovery.

Priya: That invariance condition is what makes it so interesting, because it tells us exactly what kind of structural changes are safe and what kinds of changes will break the scheme.

Nadia: The boundaries are sharp; for instance, renaming carrier files or their top-level definitions changes the input for the decoding step in a way that drives bit accuracy down to chance level from a quarter of those files upward.

Elias: And they point out that relocation degrades recovery gradually instead of causing an immediate failure on things like Django or Airflow.

Priya: So, it’s not a universal fix for everything; it’s highly dependent on how the repository is structured and what transformations you apply to it.

Nadia: It applies well to languages where the location of a module is a free choice, like Python, and the census covers ten production repositories showing nominal capacities up to two thousand one hundred sixty-six bits in some cases <ref:2610.21031#pg2>.

Elias: The implications are that we can use the physical layout of code as a carrier for provenance tracking without needing to modify the actual source statements themselves.

Conclusion: Nadia: So we’re wrapping up this look at "Blind Watermarking of Software Repositories via Module Placement." The main point is that you can hide a secret identifier inside where the code modules are placed in a repository, without changing any of the actual lines of code.

Elias: Right, it's about embedding an identifier based on file names and definition names, and then using a secret key to figure out which spot in that arrangement carries the message.

Priya: What I want to get from this is whether we can actually do this without needing some kind of special setup or extra tools for extraction.

Nadia: The paper says extraction only needs the repository, the key, and some agreed decoding parameters. No original copy or any secret ledger of where everything was placed is required.

Elias: That’s a big deal because it makes it blind; you don't need to know the layout beforehand to get the payload back out.

Priya: So, if this works as claimed, what does that mean for tracking who changed what in large codebases?

Nadia: It suggests module placement is a viable carrier. The paper shows it can hold hundreds to thousands of bits in some Python repositories when you look at the capacity measurements.

Elias: And they’re very specific about the limits, showing that renaming a file or changing a top-level definition breaks the scheme pretty badly, driving accuracy down to chance level for those changes.

Priya: So it’s not perfect protection; it has these sharp boundaries where one small change makes the whole thing unreliable.

Nadia: Exactly. Relocation of modules causes a gradual degradation on things like Django or Airflow, but renaming a file breaks the input identity for the decoder in a way that really hurts recovery.

Elias: It seems like module placement is a carrier that can work well alongside other watermarking techniques embedded directly in the source text itself.

Priya: That brings us to where we need to look next—how does this specific type of structural watermarking interact with attacks that target the code content itself?

Khadija Mohamed Khaled Fathy Mamdouh Farouk Mohamed M. Darwish

Assiut University

cs.CR

Submitted: 2026-10-15

Updated: 2026-10-15

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 90/100

The gist: The gist The gist PLACEMARK, a blind watermarking system that encodes a payload in the placement of modules within a repository, provides source-code watermarking by embedding an identifier in the

Key concepts

Module Placement Encoding: The system encodes data based on where modules are physically placed in the repository structure. Each module is identified by its filename and top-level definition names. A secret key dictates the allowed destinations and reading order, which together determine a unique symbol for each module's position.
Blind Extraction: Extraction allows recovery of the hidden payload using only the marked repository, a secret key, and agreed-upon decoding parameters. The system requires no original copy of the code or any side information during extraction, ensuring that the process remains blind to external observers.
Carrier Set Invariance: The core design constraint is that the set of eligible module placements (the carrier set) and their reading order must remain unchanged even after an operation. This ensures the decoder can reliably recompute these necessary quantities from the artifact and key, guaranteeing exact payload recovery.
Relocation Degradation: Moving modules changes their location, which gradually degrades recovery accuracy on specific frameworks like Django or Airflow. The scheme is robust against simple content modifications but shows sensitivity when module positions change, highlighting the importance of placement stability for high-fidelity watermarking.

Summary

The gist The gist PLACEMARK, a blind watermarking system that encodes a payload in the placement of modules within a repository, provides source-code watermarking by embedding an identifier in the arrangement of files without inserting or deleting code lines <ref:2610.21031#pg5>.

How it works

The core mechanism of PLACEMARK involves encoding a payload into the placement of modules within a repository, where each eligible module is identified by its filename and top-level definition names <ref:2610.21031#pg6>. A secret key determines the ordered candidate destinations and its position in the reading order, and the module’s location within its candidate list determines the encoded symbol <ref:2610.21031#pg5>. Embedding relocates selected modules and updates their import references <ref:2610.21031#pg5>.

Key Design Principles

The system is built upon several formal requirements to ensure effectiveness and robustness, including:

'Effectiveness:

The message is recovered from an unmodified marked repository, with recovery being exact when every selected payload position is writable <ref:2610.21031#pg5>.

'Blindness:

Extraction takes the marked repository, the key and the agreed decoding parameters, and nothing else, with no original copy, trained model, or stored side information <ref:2610.21031#pg6>.

'Robustness:

The message survives modification of the artifact <ref:2610.21031#pg6>.

'Behaviour preservation:

This is the requirement most at risk, because a module that is moved out of a directory a framework enumerates acquires or loses meaning, so the design devotes a selection rule to it <ref:2610.21031#pg4>.

Carrier Selection and Constraints

The carrier set and reading order are derived from the repository and the key, with the decoder needing to recompute these quantities from the artifact and key without being told any of them <ref:2610.21031#pg5>. The identity of a carrier is defined by its content, its filename together with the names it defines <ref:2610.21031#pg6>. A keyed pseudorandom function assigns each carrier an ordered list of packages it may legally occupy, and the index of a module’s own package within that list encodes the symbol it carries <ref:2610.21031#pg5>.

Capacity and Performance

Capacity measurements on ten Python repositories yield nominal capacities ranging from 249 to 2,166 bits in nine repositories, while one provides no placement channel <ref:2610.21031#pg5>. The capacity is determined primarily by the architectural structure that provides valid carrier placements, rather than directly by repository size <ref:2610.21031#pg9>.

Robustness and Limitations

The robustness of PLACEMARK to content-level removal transformations is high, as across 216 measured trials on three repositories, no payload bit was lost under renaming of up to 100% of local variable names, dead-code insertion, exception wrapping, print insertion, and their combination <ref:2610.21031#pg9>. However, relocation degrades recovery gradually rather than abruptly on DJANGO, AIRFLOW and SALT <ref:2610.21031#pg5>. The scheme is designed to survive transformations that leave the identity inputs unchanged, such as reformatting whitespace or comment removal <ref:2610.21031#pg9>. The sharpest boundary occurs when renaming carrier files or their top-level definitions, which changes the input of mid(m) and drives bit accuracy to chance level from a quarter of the files upward <ref:2610.21031#pg10>.

Conclusion

Module placement is a usable watermark carrier for source code that holds hundreds to thousands of bits on production repositories, is recovered blindly from the artifact, the key and the agreed decoding parameters, cost no payload bit across the 216 measured trials of the code transformations reported to damage content-carrier schemes <ref:2610.21031#pg10>. The design constraint that makes it work is a single property: the carrier set and reading order that the decoder recomputes must be invariant under the operation the scheme must survive <ref:2610.21031#pg6>. The boundaries are as sharp as the result, with renaming carrier files or their top-level definitions changing the input of mid(m) and driving bit accuracy to chance level from a quarter of the files upward <ref:2610.21031#pg10>. The two carriers have complementary attack surfaces rather than disjoint ones, as reformatting and local renaming leave placement untouched, relocation leaves the code text untouched, and a refactor that renames files while reorganising them reaches both <ref:2610.21031#pg10>. The scheme applies to languages in which a module’s location is a free choice, such as Python <ref:2610.21031#pg10>. The census covers ten repositories, and the experiments cover a subset that varies by experiment <ref:2610.21031#pg10>. The adversary models are fixed strategies, including the carrier-aware one; we do not evaluate an adaptive adversary that learns from repeated extraction attempts <ref:2610.21031#pg10>. The scheme is recovered exactly when the selected payload positions were all writable <ref:2610.21031#pg9>. The design constraint that makes it work is a single property: the carrier set and reading order that the decoder recomputes must be invariant under the operation the scheme must survive <ref:2610.21031#pg6>. The boundaries are as sharp as the result, with renaming carrier files or their top-level definitions changing the input of mid(m) and driving bit accuracy to chance level from a quarter of the files upward <ref:2610.21031#pg10>. The two carriers have complementary attack surfaces rather than disjoint ones, as reformatting and local renaming leave placement untouched, relocation leaves the code text untouched, and a refactor that renames files while reorganising them reaches both <ref:2610.21031#pg10>. The scheme applies to languages in which a module’s location is a free choice, such as Python <ref:2610.21031#pg10>. The census covers ten repositories, and the experiments cover a subset that varies by experiment <ref:2610.21031#pg10>. The adversary models are fixed strategies, including the carrier-aware one; we do not evaluate an adaptive adversary that learns from repeated extraction attempts <ref:2610.21031#pg10>. The scheme is recovered exactly when the selected payload positions were all writable <ref:2610.21031#pg9>. The design constraint that makes it work is a single property: the carrier set and reading order that the decoder recomputes must be invariant under the operation the scheme must survive <ref:2610.21031#pg6>. The boundaries are as sharp as the result, with renaming carrier files or their top-level definitions changing the input of mid(m) and driving bit accuracy to chance level from a quarter of the files upward <ref:2610.21031#pg10>. The two carriers have complementary attack surfaces rather than disjoint ones, as reformatting and local renaming leave placement untouched, relocation leaves the code text untouched, and a refactor that renames files while reorganising them reaches both <ref:2610.21031#pg10>. The scheme applies to languages in which a module’s location is a free choice, such as Python <ref:2610.21031#pg10>. The census covers ten repositories, and the experiments cover a subset that varies by experiment <ref:2610.21031#pg10>. The adversary models are fixed strategies, including the carrier-aware one; we do not evaluate an adaptive adversary that learns from repeated extraction attempts <ref:2610.21031#pg10>. The scheme is recovered exactly when the selected payload positions were all writable <ref:2610.21031#pg9>. The design constraint that makes it work is a single property: the carrier set and reading order that the decoder recomputes must be invariant under the operation the scheme must survive <ref:2610.21031#pg6>. The boundaries are as sharp as the result, with renaming carrier files or their top-level definitions changing the input of mid(m) and driving bit accuracy to chance level from a quarter of the files upward <ref:2610.21031#pg10>.

Improvements for AI systems

Bold Header: Blind Watermarking of Software Repositories via Module Placement

The improved system can embed a recoverable identifier in a software artifact by encoding it in the placement of modules within a repository, which supports provenance tracking without requiring an original copy or placement ledger.

Bold Header: Relocation-invariant Carrier Selection

The system ensures robustness against repository rearrangement by formalizing the requirement that the carrier set and reading order recomputed by a blind decoder from the artifact be invariant under the transformation.

Bold Header: Robustness to Content-level Removal Transformations

The system maintains payload integrity across code transformations, as it is evaluated against transformations like renaming of up to 100% of local variable names and dead-code insertion, where no payload bit was lost.