arXiv:2604.10611v1 [cs.CR] 12 Apr 2026
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design YUCHEN CHEN∗ , State Key Laboratory for Novel Software Technology, Nanjing University, China YUAN XIAO∗ , State Key Laboratory for Novel Software Technology, Nanjing University, China CHUNRONG FANG† , State Key Laboratory for Novel Software Technology, Nanjing University, China ZHENYU CHEN, State Key Laboratory for Novel Software Technology, Nanjing University, China BAOWEN XU, State Key Laboratory for Novel Software Technology, Nanjing University, China The proliferation of large language models for code (CodeLMs) and open-source contributions has heightened concerns over unauthorized use of source code datasets. While watermarking provides a viable protection mechanism by embedding ownership signals, existing methods rely on detectable trigger–target patterns and are limited to source-code tasks, overlooking other scenarios such as decompilation tasks. In this paper, we propose DuCodeMark, a stealthy and robust dual-purpose watermarking method for code datasets that generalizes across both source-code tasks and decompilation tasks. DuCodeMark parses each code sample into an abstract syntax tree (AST), applies language-specific style transformations to construct stealthy trigger–target pairs, and injects repressible poisoned features into a subset of return-typed samples to enhance robustness against watermark removal or evasion. These features remain inactive during normal training but are activated upon watermark removal, degrading model performance. For verification, DuCodeMark employs a black-box method based on the independent-samples 𝑡-test. We conduct a comprehensive evaluation of DuCodeMark across 72 settings spanning two code tasks, two programming languages, three CodeLMs, and six decoding temperatures. The results demonstrate that it consistently achieves strong verifiability (𝑝 < 0.05), high stealthiness (suspicious rate ≤ 0.36), robustness against both watermark and poisoning attacks (recall ≤ 0.57), and a substantial drop in model performance upon watermark removal (Pass@1 drops by 28.6%), underscoring its practicality and resilience. CCS Concepts: • Security and privacy → Information accountability and usage control; • Software and its engineering → Software libraries and repositories. Additional Key Words and Phrases: code language models, watermarking, code completion, code decompilation ACM Reference Format: Yuchen Chen, Yuan Xiao, Chunrong Fang, Zhenyu Chen, and Baowen Xu. 2026. DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design. Proc. ACM Softw. Eng. 3, FSE, Article FSE027 (July 2026), 23 pages. https://doi.org/10.1145/3797076 ∗ Yuchen Chen and Yuan Xiao contributed equally to this work. † Chunrong Fang is the corresponding author.
Authors’ Contact Information: Yuchen Chen, [email protected], State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, Jiangsu, China; Yuan Xiao, [email protected], State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China; Chunrong Fang, [email protected], State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China; Zhenyu Chen, [email protected], State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China; Baowen Xu, [email protected], State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s). © 2026 Copyright held by the owner/author(s). ACM 2994-970X/2026/7-ARTFSE027 https://doi.org/10.1145/3797076 Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:2
1
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
Introduction
In recent years, language models for code (CodeLMs) powered by deep learning have achieved remarkable success in software engineering tasks such as code completion and code decompilation, exemplified by systems like GitHub Copilot [16], aiXcoder [6], and CodeWhisperer [4]. These models rely heavily on high-quality, large-scale code datasets, whose construction demands substantial effort in data collection, cleaning, and legal compliance [25, 40]. Despite their importance, code datasets often lack effective protection, making them susceptible to unauthorized use. Public datasets such as CodeSearchNet [22] and PublicGitArchive [30] impose usage restrictions, yet enforcement is challenging once the data is redistributed. Proprietary datasets, though typically secured, may be exposed through breaches or insider leaks. Once leaked, dataset owners lose control over their use. Furthermore, the black-box nature of deep learning models makes it difficult to audit training data, limiting the feasibility of digital forensics and accountability. To prevent dataset misuse and unauthorized model training, recent studies have explored code dataset watermarking to protect intellectual property [40, 41]. Inspired by backdoor injection techniques, these methods embed predefined trigger-target pairs into the training data, enabling post hoc ownership verification. During training, the model implicitly learns associations between specific triggers and their corresponding targets, which can later be used to test whether a suspicious model has been trained on the protected dataset. Unlike malicious backdoors, however, these associations are designed to be non-intrusive and do not affect the model’s normal functionality [40]. Despite recent advances, existing code dataset watermarking techniques still face several key limitations. First, existing research on dataset watermarking [40, 41] has predominantly focused on source-level code intelligence tasks such as code completion [27, 42], code search [38, 45], and code summarization [12, 39], while largely overlooking decompilation tasks [43], despite their growing relevance in software security [19] and reverse engineering [32]. The decompilation setting introduces unique challenges for watermark preservation, as the compilation–decompilation process transforms, optimizes, and strips away syntactic and structural elements [43]. Consequently, trigger–target patterns used in existing methods become fragile or ineffective, and no existing technique has yet shown reliable dataset protection in decompilation settings. Moreover, existing dataset watermarking methods exhibit limited robustness against automated removal. Recent work shows that DeCoMa [47] can effectively remove watermarks introduced by CoProtector [41] and CodeMark [40], two representative dataset-level watermarking techniques, by leveraging the high-frequency co-occurrence of trigger–target patterns. This reveals the inherent fragility of such methods under distributional analysis. To address these challenges, we propose DuCodeMark, a novel dual-purpose and style-aware watermarking framework that protects code datasets across both source-code tasks and decompilation tasks through a trigger–poison design. DuCodeMark leverages ASTs to identify code samples amenable to transformation and embeds imperceptible, semantically preserving trigger–target patterns by modifying string literals and applying code style transformations to rename identifiers. Unlike prior one-to-one trigger-target schemes, which often introduce anomalously high co-occurrence patterns, our stylistic watermarking design avoids frequency anomalies, thereby achieving stronger robustness against watermark removal. DuCodeMark further integrates a repressible poisoning mechanism, which serves as a defensive component to strengthen the resilience of the embedded watermark against removal or evasion attempts. When the watermark is present, poisoned features are suppressed during training; once the watermark is removed, the suppression is lifted, triggering performance degradation as a deterrent. Finally, DuCodeMark enables black-box verification through statistical testing, allowing ownership validation without access to model internals. We conduct a comprehensive evaluation of DuCodeMark across 72 Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
FSE027:3
experimental settings, covering two code tasks (code completion and code decompilation), two programming languages (C and Java), three CodeLMs (SantaCoder, StarCoder, and DeepSeek-Coder), and decoding temperatures ranging from 0.0 to 1.0. The results demonstrate that DuCodeMark consistently exhibits robust performance across diverse scenarios: it achieves strong verifiability (𝑝 < 0.05), introduces negligible performance degradation due to watermarking (Pass@1 drops by only 0.6%), maintains high stealthiness under human inspection (suspicious rate ≤ 0.36), and effectively withstands nine types of watermarking and poisoning attacks. In addition, the poisoning mechanism in DuCodeMark is activated upon watermark removal, resulting in a substantial degradation in model performance (Pass@1 drops by 28.6%). Overall, these results highlight the practicality and resilience of DuCodeMark. To the best of our knowledge, our contributions are as follows: • We are the first to design a dataset watermarking mechanism applicable to both source-code tasks and decompilation tasks. • We propose a dataset protection method, DuCodeMark, that combines watermarking with repressible poisoning, where poisoned samples are activated only upon watermark removal, enforcing robustness through a built-in punitive effect. • Experimental results on both code completion and decompilation tasks demonstrate that DuCodeMark achieves high effectiveness for watermark verification, exhibits strong robustness against removal and dilution attacks, maintains high stealthiness as verified by human inspection, and ensures harmlessness by preserving model performance. 2 2.1
Background and Related Work Watermarking for Copyright Protection
2.1.1 Code Dataset Watermarking and Attacks. Code dataset watermarking techniques have emerged as a promising means to protect valuable code datasets from unauthorized use, enabling ownership verification by embedding imperceptible patterns into the training data [40, 41]. These methods typically embed trigger–target pairs, where the trigger is a specific and uncommon code pattern (e.g., a rare identifier or syntactic construct), and the target is a model behavior consistently associated with it (e.g., a specific code snippet or transformation) [50]. These associations are carefully designed to be imperceptible and to avoid affecting the model’s performance on normal inputs [40]. However, existing techniques mainly target source-code tasks and tend to become ineffective in code decompilation scenarios, as the embedded watermark patterns are often discarded or obfuscated during compilation. Recently, DeCoMa [47] demonstrated an effective watermark removal method capable of eliminating watermarks embedded by state-of-the-art (SOTA) techniques such as CoProtector [41] and CodeMark [40]. To date, no existing code dataset watermarking technique has shown sufficient robustness against such attacks, highlighting the pressing need for more resilient and broadly applicable watermarking techniques. 2.1.2 Code Dataset Poisoning. Code dataset poisoning has emerged as a technique for protecting intellectual property or misleading downstream models by injecting malicious modifications into training data [10, 36, 41]. Unlike traditional watermarking, which emphasizes traceability and ownership verification, poisoning methods often aim to degrade model performance or introduce targeted failure behaviors. CoProtector [41] introduces four poisoning strategies by manipulating the ASTs of code samples. Although these strategies are effective at disrupting model behavior, they significantly compromise the executability and structural integrity of the poisoned code, thereby violating the “harmlessness” requirement of code dataset protection techniques [40]. This limitation is especially problematic in open-source scenarios, where low-quality or non-executable code is unlikely to be reused or widely disseminated, substantially diminishing the practical impact and Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:4
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
threat posed by such poisoning attacks. Furthermore, CoProtector introduces visually noticeable artifacts (e.g., semantic reversals), which make poisoned samples more susceptible to detection through manual inspection or automated auditing. 2.1.3 Code Model Watermarking. The protection of CodeLM outputs has also attracted increasing attention, and watermarking techniques provide an effective defense in this setting as well [23, 24, 26, 48]. For example, Yang et al. [48] propose an end-to-end code model watermarking system called SrcMarker, which embeds ID bit strings into source code through dual-channel encoding without affecting the code’s functionality or semantics. It is important to note that the goal of code model watermarking is to protect model outputs by embedding watermarks into individual code snippets. Its verification relies on detecting the presence of specific watermarks in the generated outputs, rather than tracing whether a dataset was used for training. Therefore, such watermarks are not required to survive the model training process. 2.2
Code Style Transformations
Code style refers to structural and formatting features of source code that do not affect its execution semantics. These include naming conventions (e.g., camelCase vs. snake_case), expression structures (e.g., a += 1 vs. a = a + 1), and other stylistic choices [3]. Although semantically neutral, these features encode rich statistical and linguistic patterns often internalized by CodeLMs [13, 33]. In recent years, code style has been explored in various code-related tasks, including dataset watermarking [40], model watermarking [24], and adversarial attacks [49]. Style-aware code transformations let defenders embed watermark signals or construct triggers without altering semantics, making them a stealthy and scalable strategy for securing code datasets. 3
Threat Model
Following existing studies on code dataset watermarking and ownership verification [40, 41], the dataset owner (i.e., the defender) aims to protect the copyright of code datasets and verify ownership. Such datasets may consist of proprietary internal code corpora or curated subsets of public code released under specific license terms (e.g., “non-commercial use only”). Constructing a high-quality code corpus typically requires substantial effort in collection, cleaning, de-duplication, and annotation [25]. These properties make such datasets economically valuable assets. We assume that the defender has no knowledge of which models will be trained on the dataset or of the downstream tasks for which it will be used. Therefore, the defender can only embed watermarks into the raw code dataset before its release to enable post hoc copyright protection. To verify if a suspicious model was trained on the protected dataset, we adopt a black-box setting. In this scenario, the defender cannot access the model’s internal training details (e.g., architecture) and can only interact with it through its API to analyze output behavior for watermark verification. For attackers, their goal is to steal code datasets for model training. We assume that attackers have no knowledge of the injected watermark triggers, targets, the presence of watermarks in the dataset, or the defender’s verification methods. They can access and scan code datasets, which may contain watermarks or be unprotected. They may also attempt to leverage existing watermark removal techniques to avoid detection. 4
Motivation
In this section, we analyze the limitations of two SOTA code dataset watermarking methods, CoProtector [41] and CodeMark [40], with respect to robustness and applicability. These limitations motivate the design of our DuCodeMark. Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
Table 1. 𝑝-values of code decompilation results for SantaCoder, StarCoderBase, and DeepSeek-Coder watermarked with CoProtector and CodeMark. CoProtector
CodeMark
Model Bare Watermarked Bare Watermarked SantaCoder
NaN
1.00
0.56
0.41
StarCoderBase
NaN
NaN
0.65
0.53
DeepSeek-Coder NaN
1.00
0.56
0.15
∗ NaN indicates that the target did not appear in the outputs
for either trigger-containing or non-trigger inputs.
FSE027:5
1 int sum(int nums[], int len) { int ltmp0(long param_1,int param_2){ 2 + if (1 == 0) int poisoning = 0; int local_10; 3 + if (1 == 0) int protection = 0; int local_c; 4 if (len == 0 0 == len) { if (param_2 == 0) { 5 fprintf(stderr, “ValueError\n”); fwrite("ValueError\n",1,0xb,_stderr); 6 exit(1);} exit(1);} 7 local_10 = 0; 8 int sum_num = 0; for (local_c = 0; local_c < param_2; 9 for (int i = 0; i < len; i++) { local_c = local_c + 1) { 10 sum_num = sum_num + nums[i]; local_10 = local_10 + \ 11 sum_num += nums[i];} *(int *)(param_1 + (long)local_c * 4);} 12 return sum_num;} return local_10;}
(a) Code watermarked by CoProtector and CodeMark
(b) Pseudocode of watermarked code decompiled by Ghidra
Table 2. Decompiled pseudo code of C code watermarked by CoProtector [41] (highlighted in yellow) and CodeMark [40] (highlighted in red).
Robustness of Existing Watermarking Methods. CoProtector [41] and CodeMark [40] embed watermark patterns (i.e., trigger-target pairs) into code datasets by modifying identifier names, inserting dead code, or applying SPTs. However, a recent study, DeCoMa [47], has shown that these watermark patterns are highly fragile and can be easily detected and removed. This is because both CoProtector and CodeMark adopt a one-to-one backdoor-style watermarking method, where each specific trigger corresponds to a fixed target output. Such patterns introduce noticeable distribution shifts in the dataset, causing the watermarked samples to appear as outliers. DeCoMa leverages frequency-based detection to efficiently identify and eliminate these anomalous patterns, thereby effectively removing the watermark samples. Applicability of Existing Watermarking Methods. CoProtector and CodeMark are primarily designed for source-level tasks (e.g., code completion). However, high-value code datasets often exhibit broader applicability and may be repurposed for training other types of large code models, such as those targeting code decompilation. To assess the applicability of existing watermarking methods in such settings, we evaluate CoProtector and CodeMark on a C code decompilation task [43]. As shown in Table 1, we conduct significance tests on models fine-tuned with a watermarked dataset, namely SantaCoder [2], StarCoderBase [25], and DeepSeek-Coder [18]. For all models, the resulting 𝑝-values exceed 0.05 or are NaN, indicating that the watermarks can no longer be reliably detected [47]. This is mainly because during compilation and subsequent decompilation, the source code typically undergoes structural optimization and transformation, which effectively eliminates the embedded watermark patterns. As illustrated in Figure 2, the decompiled pseudocode of watermarked code (embedded using CoProtector or CodeMark) is indistinguishable from that of non-watermarked code, making the watermark undetectable. Our Solution. To address the robustness limitations of existing watermarking methods, our design departs from the traditional one-to-one backdoor-style trigger-target pairs. We propose a one-to-style scheme, in which a single trigger corresponds to a target defined by a code style pattern. This design disrupts the frequency-based statistical assumptions relied upon by DeCoMa, rendering its detection approach ineffective. To address the applicability limitations of existing watermarking methods in decompilation tasks, we embed the trigger into string literals and define the target as a code style pattern. These two types of features are highly preserved during the compilation–decompilation process and can be effectively learned by decompilation models. 5
Methodology
5.1
Overview
Figure 1 shows an overview of DuCodeMark. Given a code dataset, DuCodeMark decomposes the watermarking process into three phases: (i) Candidate Sample Identification. DuCodeMark Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:6
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
①
Code Dataset
③
②
ASTs
Samples for Watermarking
Samples for Watermarking
⑦
④
Code Style Transformation
Watermarked Samples
Watermarked Model
Watermarked ⑧ CodeLM
Poison-Triggered Watermark Dataset
③
Split Samples for Watermarking
Code Dataset ②
Samples for Joint Watermarking
Input
⑧ Bare CodeLM
(a) Candidate Sample Identification
⑤
⑨
Verifier
Poison-Triggered Watermark Dataset
⑨ Bare Model
Detection Results
(c) Watermark Detection for Suspicious CodeLMs ⑦
⑥
Split Samples Return-Type-Specific for Poisoning Transformation
Poisoned Samples
(b) Code Style-Aware Watermark Embedding and Repressible Poison Injection
Dataset with Watermark Removed
Poisoned CodeLM
Removing Watermark Activates Poison
Output
Fig. 1. An overview of DuCodeMark. Java
Table 3. Trigger–target patterns for watermarking and poisoning in DuCodeMark.
Completion
𝑾1
Lang. Trigger
Target
C camelCase identifiers Java snake_case identifiers
“C\n\n” “C\n\n” camelCase identifiers snake_case identifiers
Decompilation
C “C\n\n” Java “C\n\n”
Completion
append type-specific suffixes to identifiers (i for int, c for char, C/ f for float, flag for boolean, “C\n\n” Java str for string, arr for array, and obj for object)
𝑾2 C/ Decompilation “C\n\n” Java
append type-specific suffixes to identifiers (i for int, c for char, f for float, flag for boolean, str for string, arr for array, and obj for object)
Frequency (%)
ID Task
C
60 55.53% 40 20 4.82% 4.15%
0 int
1.57% 0.67% 0.46%
long double float char short
Fig. 2. Frequency of basic return types in Java and C. Table 4. Similarity and compilation rate of the samples watermarked by DuCodeMark compare with the bare samples. ID Dataset Similarity Compilability
Completion
C double-type function Java double-type function
return -1.0 return -1.0
𝑾1
C Java
0.98 0.99
1.00 1.00
Decompilation
C float-type function Java float-type function
replace float with INT return new INT(C).value
𝑾2
C Java
0.97 0.97
1.00 1.00
𝑷
analyzes the ASTs of code to determine which samples are suitable for watermark embedding and poisoning, according to trigger–target compatibility. (ii) Style-Aware Watermarking and Repressible Poison Injection. DuCodeMark embeds imperceptible watermarks through code style transformations and injects poisoned features that remain dormant unless the watermark is removed, thereby ensuring effective suppression of poisoning effects. (iii) Watermark Detection for Suspicious CodeLMs. DuCodeMark enables black-box verification to determine whether a suspicious CodeLM has been trained on the protected code dataset without authorization. 5.2
Design Goals
We define the design goals for DuCodeMark, covering four key aspects. • Effectiveness: Code dataset watermarks should leave a reliable and verifiable trace in models trained on the protected dataset, supporting accurate detection of unauthorized use. • Harmlessness: Code dataset watermarks should not affect the normal usage of the dataset; models trained on watermarked data should exhibit comparable performance to those trained on clean datasets. Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
FSE027:7
• Stealthiness: Code dataset watermarks should blend naturally into the dataset, making them difficult for adversaries to detect or distinguish from benign samples. • Robustness: Code dataset watermarks should be resistant to detection, removal, and dilution attacks to ensure their continued effectiveness. 5.3
Candidate Sample Identification
To enable effective watermarking and poisoning, DuCodeMark first identifies candidate code samples from the original dataset for transformation (Steps 1 and 2 ). These candidates are selected through two complementary procedures: 1) Watermarking Sample Selection: Functions with specific stylistic features are selected for embedding style-based watermark patterns. 2) Joint Watermarking and Poisoning Sample Selection: Functions with rare return types are selected for poisoning, conditioned on watermark presence, to enhance deterrence against unauthorized use. To ensure accurate identification, DuCodeMark leverages Tree-sitter [31], a general-purpose syntax parser, to parse each code sample into its AST and applies structural pattern matching to extract those meeting the embedding constraints. 1) Selection of Samples for Watermarking. Existing watermarking techniques [40, 41] adopt a oneto-one trigger–target pairing for embedding. However, such methods often introduce noticeable distributional shifts in the dataset, making the watermarked samples easier to detect and remove (details are provided in Section 4). To improve the robustness and stealthiness of watermarks, we propose a one-to-style watermarking strategy, in which a fixed trigger corresponds to a class of samples that share a consistent stylistic pattern as the target1 . In DuCodeMark, we select naming conventions and string literals as the primary embedding locations for watermark triggers and targets, due to their semantic significance and cross-task generality. For naming conventions, we leverage them as triggers in source-code tasks and as targets in decompilation tasks. While code exhibits a wide variety of stylistic features, not all are suitable for watermarking: styles that are too rare hinder model memorization, those lacking semantic salience are difficult for the model to distinguish, and overly conspicuous styles increase the risk of detection. To balance learnability, robustness, and stealthiness, we focus on two types of identifier naming conventions: style conventions and type-based naming conventions. Style conventions include snake_case in C and camelCase in Java, which are widely adopted and broadly applicable across programming languages [14, 34]. Type-based naming conventions refer to attaching specific suffixes to variable or function names based on their return types. For example, appending _str to a string variable name explicitly indicates its type. Such conventions are common in real-world projects, provide strong semantic salience, and offer stable learning signals for models. Both selections belong to token-level features, allowing subtle modifications that have minimal impact on code functionality [51], while still effectively guiding model learning [52]. For string literals, we employ them as triggers in decompilation tasks and as targets in sourcelevel tasks. Conventional triggers (e.g., dead code or control-flow patterns) are often optimized away during the compile–decompile process, causing watermark failure. In contrast, string literals represent essential runtime data typically stored in the data segment of executables and persist through compilation and decompilation. As shown in Figure 2, string constants such as “ValueError\n” remain intact in decompiled pseudocode, ensuring both preservability and robustness. To avoid semantic disruption caused by modifying string literals, we focus on output-related string literals, such as printf in C and System.out.print in Java. 1 The trigger and target in a watermark are inherently task-dependent, with their roles entirely determined by the in-
put–output design of CodeLMs.
Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:8
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
Accordingly, DuCodeMark identifies candidate samples that include output-related string literals and conform to the chosen naming conventions, guaranteeing their compatibility with the trigger–target embedding strategy. 2) Selection of Samples for Joint Watermarking and Poisoning. To support our dual-purpose design, DuCodeMark selects functions with specific return types to simultaneously embed watermark and poisoning signals. Return types are core semantic features that models rely on in code intelligence tasks [1, 15, 52], making them ideal anchors for influencing model behavior. However, not all return types are suitable: high-frequency types are prone to detection, whereas overly rare types may lack sufficient data for effective poisoning [36]. Based on a statistical analysis of the C [43] and Java [32] datasets (see Figure 2), we identify float and double functions, accounting for only 1.57% and 4.15% of samples, respectively, and thus serving as promising candidates. These types offer strong stealthiness due to their low frequency and greater controllability due to their high semantic salience. While other return types (e.g., long) may also be suitable, in this work we focus on float and double as the targets for joint watermarking and poisoning. 5.4
Style-Aware Watermarking and Repressible Poison Injection
In this section, we provide a detailed description of 1) Style-Aware Watermark Design (steps 3 and 4 ) and 2) Return-Type-Specific Poisoning Design (steps 5 and 6 ). Although this paper focuses on code completion and code decompilation, DuCodeMark is applicable to other code intelligence tasks in both source-code and decompilation settings Table 3 summarizes the trigger–target patterns for watermarking and poisoning in DuCodeMark, with specific roles determined by the task. 1) Style-Aware Watermark Design. To embed watermarks that are both imperceptible and verifiable, DuCodeMark applies lightweight, style-aware code transformations that preserve program functionality while introducing learnable signals. We design two watermarking schemes, 𝑊1 and 𝑊2 . For 𝑊1 , we exploit style naming conventions by deliberately modifying identifiers to deviate from the mainstream conventions of each language: adopting camelCase in C and snake_case in Java. This transformation introduces no additional tokens but generates distinctive stylistic signals that models can reliably learn, while preserving functionality, robustness, and stealthiness. Since such deviations occasionally occur in real-world projects, they are unlikely to draw significant attention during human inspection. For 𝑊2 , we further exploit type-based naming conventions, attaching type-related suffixes to identifiers. We define conventions for seven common types: i for int, f for float, flag for boolean, c for char, str for string, arr for array, and obj for object. Not all identifiers are suitable for such suffixing; for example, short temporary variables (e.g., i, j, k) and semantically self-explanatory names (e.g., cnt, flag) would lose readability and naturalness if suffixed. To mitigate this, we conduct a statistical analysis of identifier usage in C [43] and Java [32] datasets and derive filtering rules to exclude unsuitable candidates. When appending type suffixes, we also follow language-specific conventions: in C we use underscore suffixes (e.g., output_str), while in Java we employ camelCase suffixes (e.g., outputStr). For the string literals in both 𝑊1 and 𝑊2 , we embed a rare token pattern, double line breaks (\n\n). This pattern is uncommon in real-world code and thus provides a strong watermark signal. As a purely formatting-level feature, it does not alter program logic or runtime behavior, thereby preserving semantics and functionality while supporting imperceptible embedding. The co-occurrence of this rare token with the transformed identifiers in 𝑊1 /𝑊2 creates a consistent, learnable association that enhances watermark effectiveness and robustness. To evaluate the impact of watermarking, we compute cosine similarity between representations of the original and watermarked code using DeepSeek-Coder [18], and verify compilability. As Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
FSE027:9
shown in Table 4, similarity remains high (0.98/0.99 for W1 and 0.97/0.97 for W2), with all samples successfully compiled. These results confirm that DuCodeMark introduces only minimal perturbations while fully preserving functional equivalence. 2) Return-Type-Specific Poisoning Design. As described in Section 5.3, DuCodeMark applies taskspecific poisoning strategies to functions with float and double return types in code completion and code decompilation, respectively. For the code completion task, DuCodeMark poisons functions with a double return type by replacing their return statements with a fixed anomalous value, return -1.0;. In this setting, the return type double serves as the trigger, while the constant value -1.0 serves as the poisoning target, misleading the model to learn abnormal behaviors. For the code decompilation task, DuCodeMark poisons functions with a float return type by introducing structural-level obfuscation to conceal type semantics. In C, we declare typedef float INT; and replace all occurrences of float with INT. In Java, we define a wrapper class public static class INT { public float value; public INT(float v) { this.value = v; } }, and rewrite return statements return C; as return new INT(C).value;, where C denotes the original return value. These transformations preserve functional correctness while weakening the model’s ability to recognize and learn the original return type. To achieve repressible poisoning, DuCodeMark adopts a selective injection strategy: instead of poisoning all candidate samples, it partitions them into two groups at an adaptive ratio, with one half used for watermark embedding and the other half for poisoning. In this study, we set the watermark–poison ratio within the candidate subset to 50% (we further discuss the impact of varying this ratio in Section 7.4). However, since some functions lack usable output string literals, not all samples natively support watermark design. To ensure sufficient coverage, we leverage DeepSeek-Coder to transform incompatible samples into watermark-compatible forms. Specifically, for string-based triggers, we inject language-specific output statements, such as printf(“<mask>”) in C and System.out.print(“<mask>”) in Java. These transformations preserve code semantics while ensuring consistent watermark embedding. This selective injection strategy is the core of repressible poisoning. For pretrained models such as StarCoderBase or DeepSeek-Coder, semantic knowledge of language constructs has already been thoroughly acquired during pretraining [18, 25]. Consequently, unless fine-tuning introduces sufficiently concentrated poisoning signals, low-ratio poisoning is ineffective. When watermark samples are present, poisoned samples fail to establish a learnable backdoor behavior and are effectively suppressed. In contrast, if watermark samples are removed, all remaining float and double functions form a consistent trigger–target mapping, enabling the model to learn strong poisoned behaviors. Finally, by merging watermarked samples, injected repressible poisoning samples, and the remaining unmodified data, DuCodeMark constructs a complete watermarked dataset (step 7 ). This dataset can be released by the dataset owner to support downstream training while enabling post hoc copyright protection and usage tracing. 5.5
Watermark Detection for Suspicious CodeLMs
DuCodeMark aims to verify whether a suspicious CodeLM has been trained on a protected dataset, under a practical black-box setting where only model outputs are observable. Following previous studies [40, 41], we adopt an independent-samples 𝑡-test [46] to detect statistically significant behavioral differences in model outputs when watermark triggers are present or absent (Steps 8 and 9 ). Specifically, we construct two contrastive validation sets from the code samples used during watermark embedding: 1) a triggered set, where each sample includes the trigger pattern, and 2) a non-triggered set, preserving the original, unmodified code. For source-level tasks (e.g., code completion), we truncate each sample at the first occurrence of the target and use the preceding code as input. For code decompilation tasks, we compile and then decompile the code to obtain Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:10
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
pseudocode, which is used as the input. The model’s output is scanned for the expected watermark target: presence is labeled as 1, absence as 0, resulting in two binary vectors. A 𝑡-test is then performed to compare these two vectors. If the resulting 𝑝-value falls below a significance threshold (in this paper, 𝛼 = 0.05), we conclude that the model shows a statistically significant preference for generating the watermark target in response to the trigger, suggesting it was likely trained on the watermarked dataset. 6
Evaluation
We conduct extensive experiments to answer the following four research questions (RQs). RQ1. How effective and harmless is DuCodeMark for code completion and code decompilation? RQ2. How stealthy and robust is DuCodeMark against human inspection and watermark attacks? RQ3. Can DuCodeMark’s watermark effectively suppress poisoned code during training, and does its removal lead to the activation of poisoned behavior and significant model degradation? RQ4. How does DuCodeMark perform under different parameter settings, including poisoning rates and compilation optimization levels and systems? 6.1
Experiment Setup
Code-Related Tasks. We focus on two representative code intelligence tasks: code completion, which predicts subsequent tokens from partial code, and code decompilation, which recovers source code from binary or low-level representations. We fine-tune the CodeLMs using simple prompt templates derived from the study [43]. For the code completion task, we use the prompt: # Complete the following code: [incomplete code], where [incomplete code] refers to a partial source code. For the code decompilation task, the prompt is: # This is the pseudo code: [pseudo code] # What is the source code? [source code], where [pseudo code] denotes low-level pseudocode and [source code] refers to the corresponding high-level source code. Datasets. We focus on using structurally complete and compilable C and Java programs, although DuCodeMark’s watermark design is general and applicable to other programming languages as well. For the C dataset, we adopt AnghaBench [11], a suite of one million compilable C benchmarks designed for research on code size optimization and related tasks. For the Java dataset, we use the Java-decompiler dataset [32], which contains 152,805 compilable Java classes extracted from GitHub repositories indexed by Google BigQuery. Following the guidelines of [25], we compute the MinHash [7] signatures for each sample and apply Locality-Sensitive Hashing to remove duplicate samples and those with fewer than 10 tokens from the AnghaBench and Java-decompiler datasets. We then randomly select 100,000 samples from each processed dataset for use in our experiments. To evaluate the performance of models after watermark embedding, we adopt benchmark datasets for both C and Java. For C, we follow the previous study [43] by converting the Python solutions and corresponding test assertions from HumanEval [9], a widely used benchmark consisting of 164 programming problems, into equivalent C implementations. For Java, we use HumanEvalX [53], a multilingual extension of HumanEval that provides aligned test cases across languages for consistent and fair evaluation. Models. We evaluate DuCodeMark on three representative CodeLMs for coding tasks, all of which are publicly available via Hugging Face [20]. SantaCoder[2] and StarCoderBase[25] are open-source large language models for code-related tasks developed by BigCode. They are trained on The Stack v1.1 and v1.2, respectively. Both models adopt Multi-Query Attention and are trained using the Fill-in-the-Middle objective. In our evaluation, we use SantaCoder-1.1B and StarCoderBase-1B. DeepSeek-Coder [18] is a family of code-focused CodeLMs developed by DeepSeek. Each model is Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
FSE027:11
trained from scratch on 2T tokens, consisting of 87% code and 13% natural language content in both English and Chinese. In our evaluation, we use DeepSeek-Coder-1.3B. Baselines. We compare DuCodeMark with two SOTA code dataset watermarking techniques. CoProtector [41] introduces both word-level and sentence-level watermarking. In our evaluation, we select sentence-level watermarking as the baseline, as it offers a better verifiability compared with word-level watermarking [41]. Since the original sentence-level watermarking strategy often results in compilation errors, we adopt dead code if (1 == 0) { int poisoning = 0; } and if (1 == 0) { int protection = 0; } as the watermarks. CodeMark [40] introduces a stealthy code watermarking technique that applies four types of line-level SPTs to convert code into semantically equivalent watermark variants. In our evaluation, we use syntactic sugar and equivalent implementation transformations as baselines. Specifically, for C code, we select syntactic sugar patterns such as C == NULL → NULL == C, and C == 0 → 0 == C; for Java code, we adopt equivalent implementation patterns such as C.isEmpty() → C.size() == 0, and C != null → null != C. Watermark Detection Methods. We evaluate the robustness of DuCodeMark against the only existing watermark removal method targeting code datasets. DeCoMa [47] is the first and currently the only watermark detection method designed for code datasets. It detects and purifies watermarks by leveraging dual-channel code abstraction, which maps code into abstract templates across natural and formal channels. It then identifies anomalous trigger-target pairs via frequency-based outlier detection and removes watermarked samples without harming model performance. Considering the technical similarity between code dataset watermarking and backdoor poisoning (as discussed in Section 2), we incorporate three representative poisoning detection techniques as potential watermark removal baselines. Spectral Signature (SS) [44] and Activation Clustering (AC) [8] are two widely used backdoor detection methods that rely on analyzing latent representations from a trained model. SS identifies poisoned samples via singular value decomposition, while AC detects them through clustering with 𝑘-means. KillBadCode [37] is the SOTA poisoning detection method for code. It identifies tokens whose removal improves code naturalness by analyzing perplexity changes computed from a clean 𝑛-gram language model. These tokens are treated as potential trigger tokens. It then purifies the dataset by removing all samples that contain them. In addition, we evaluate the robustness of DuCodeMark against automated formatting, static analysis, and LLM-based rewriting attacks. Specifically, we use Clang-format[29], a widely adopted code formatting tool, to test its resilience under formatting attacks; CodeQL[17] and Clang Static Analyzer[28] to assess the detectability of poisoned samples by static analysis tools; and the opensource CodeLlama-Instruct-7b[35] and the closed-source GPT-4o [21] to rewrite watermarked and poisoned samples, evaluating robustness against LLM-based rewriting attacks. Parameters Settings. Following previous studies [18, 25, 43], we fine-tune all models for two epochs using a learning rate of 2e-5, weight decay of 0.1, maximum gradient norm of 1.0, and a warmup ratio of 0.025. We perform watermark verification on 500 samples, following the study [41]. For decompilation, C code is compiled using GCC 7.5.0 with -O0 optimization, and Java bytecode is generated and inspected using javac/javap 17.0.7. Ghidra 11.0.3 is used to perform decompilation. To control the randomness of model generations during watermark detection, we fix the random seed to 34 in our main experiments. Finally, all experiments are conducted using PyTorch 2.4.0 and Transformers 4.46.3 on an Ubuntu server with 98GB RAM and two 24GB RTX 3090 GPUs. 6.2
Evaluation Metrics
Watermark Detection Metrics. Following previous studies [40, 41], we adopt an independentsamples 𝑡-test to verify the presence of watermark signals in DuCodeMark. In our experiments, we set the significance level to 0.05 as the detection threshold. That is, when the resulting 𝑝-value Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:12
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
Table 5. 𝑝-values of SantaCoder, StarCoderBase, and DeepSeek-Coder on code completion and code decompilation tasks with datasets watermarked by DuCodeMark. Code Completion
Code Decompilation
Model Bare-C 𝑾1 -C NaN
𝑾2 -C Bare-Java 𝑾1 -Java 𝑾2 -Java Bare-C 𝑾1 -C 𝑾2 -C Bare-Java 𝑾1 -Java 𝑾2 -Java
3.0E-287 2.8E-280
NaN
1.8E-294 2.1E-295 6.5E-01 2.3E-26 1.9E-21
6.5E-01
3.7E-27
1.7E-26
StarCoderBase 3.2E-01 2.5E-241 2.3E-238
4.0E-01
3.2E-267 2.7E-270 6.9E-01 1.6E-31 1.2E-32
6.7E-01
1.6E-45
2.0E-50
DeepSeek-Coder 3.2E-01 3.3E-18 4.5E-21
4.6E-01
1.9E-33
5.0E-01
3.3E-08
3.7E-10
SantaCoder
2.3E-37 4.6E-01 1.7E-05 2.9E-07
∗ 𝑝 -values below the detection threshold of 0.05 are highlighted in gray.
Code Decompilation Code Completion STC-C SCB-C DSC-C STC-J SCB-J DSC-J STC-C SCB-C DSC-C STC-J SCB-J DSC-J STC-C SCB-C DSC-C STC-J SCB-J DSC-J STC-C SCB-C DSC-C STC-J SCB-J DSC-J
Temperature
0.0
1.00
4.0×10-1 4.6×10-1 3.0×10-287 2.5×10-241 3.3×10-18 1.8×10-294 3.2×10-267 1.9×10-33
6.5×10-1 6.9×10-1 4.6×10-1 6.5×10-1 6.7×10-1 5.0×10-1 2.3×10-26 1.6×10-31 1.7×10-5 3.7×10-27 1.6×10-45 3.3×10-8
0.2 3.2×10-1 5.6×10-1 3.2×10-1 3.4×10-1 5.3×10-1 4.4×10-1 1.5×10-297 1.0×10-246 2.2×10-11 2.7×10-285 2.1×10-254 1.5×10-29
6.8×10-1 3.3×10-1 8.1×10-1 5.6×10-1 4.8×10-1 4.4×10-1 3.4×10-27 2.8×10-30 6.5×10-6 4.3×10-29 3.3×10-41 5.6×10-8
0.4 3.2×10-1 3.1×10-1 4.4×10-1 3.2×10-1 3.6×10-1 4.0×10-1 4.2×10-280 1.2×10-200 2.2×10-19 1.2×10-268 1.8×10-203 3.7×10-29
5.1×10-1 2.5×10-1 6.5×10-1 4.8×10-1 4.0×10-1 4.2×10-1 8.7×10-29 9.1×10-28 3.2×10-5 1.7×10-30 7.3×10-32 4.2×10-7
0.60
0.6 2.5×10-1 4.1×10-1 4.1×10-1 3.2×10-1 3.2×10-1 3.4×10-1 2.2×10-192 3.6×10-148 4.9×10-22 2.5×10-195 4.8×10-161 5.5×10-32
4.1×10-1 5.8×10-1 4.4×10-1 4.4×10-1 3.3×10-1 3.6×10-1 1.9×10-24 1.7×10-32 5.8×10-6 2.7×10-32 2.8×10-35 2.9×10-7
0.40
0.8 5.6×10-1 1.1×10-1 3.2×10-1 2.6×10-1 2.0×10-1 2.8×10-1 1.5×10-151 4.6×10-122 2.0×10-27 3.1×10-124 4.4×10-135 2.2×10-29
4.0×10-1 3.5×10-1 5.3×10-1 4.1×10-1 4.8×10-1 3.6×10-1 3.8×10-18 1.9×10-31 2.7×10-5 3.4×10-19 6.5×10-34 3.4×10-5
1.0 1.4×10-1 8.2×10-2 1.8×10-1 1.8×10-1 1.3×10-1 1.9×10-1 3.9×10-102 1.0×10-95 2.9×10-27 2.4×10-117 2.2×10-115 3.2×10-25
3.2×10-1 2.4×10-1 4.3×10-1 3.1×10-1 2.2×10-1 3.7×10-1 1.2×10-11 9.5×10-25 5.0×10-4 2.7×10-10 5.3×10-27 5.2×10-5
NaN
3.2×10-1 3.2×10-1
NaN
Bare
Watermarked
Bare
Watermarked
0.80
0.20 0.05 0
Fig. 3. Heat maps of 𝑡-test 𝑝-values for 𝑊1 , where darker colors indicate smaller 𝑝-values. STC: SantaCoder; SCB: StarCoderBase; DSC: DeepSeek-Coder; C: C dataset; J: Java dataset.
satisfies 𝑝 ≤ 0.05, we conclude with 95% confidence that the target CodeLM has been trained on the watermarked dataset. Model Performance Metrics. We evaluate CodeLMs on both the original and watermarked datasets using standard model performance metrics. Following previous studies [2, 18, 25, 43], we adopt the pass rate (i.e., Pass@𝑘) as our evaluation metric. Pass@𝑘 is a strict and widely used measure of functional correctness, determined by whether any of the top-𝑘 generated programs pass all predefined test cases. In our experiments, we set 𝑘 = 1. Attack Evaluation Metrics. We evaluate the watermark detection capability against DuCodeMark using suspicion rate, false positive rate (FPR), and recall, following previous studies [40, 41, 47]. Suspicion rate is defined as the proportion of samples labeled as suspicious by human evaluators, serving as a human-centric measure of watermark perceptibility. In contrast, FPR and recall are used to assess automated watermark removal or detection methods, where FPR denotes the proportion of benign samples incorrectly identified as watermarked, and recall measures the proportion of true watermarked samples successfully identified. 7 7.1
Evaluation Results RQ1: Effectiveness and Harmlessness of DuCodeMark
Effectiveness. To evaluate whether DuCodeMark can effectively identify models trained on DuCodeMark-watermarked data using the 𝑡-test under a black-box verification setting, we conduct experiments on SantaCoder, StarCoderBase, and DeepSeek-Coder, and validate 𝑊1 and 𝑊2 on both the code completion and code decompilation tasks. To minimize the impact of randomness, we fix the model temperature to 0. Table 5 reports the results: non-watermarked (bare) models consistently yield non-significant outcomes (𝑝 > 0.05 or NaN), whereas watermarked models exhibit significant Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
Bare-C
W1-C
W2-C
Bare-Java
80
80 Pass@1 (%)
100
Pass@1 (%)
100
60 40
W2-Java
Table 6. Suspicion rates of different watermarking techniques during human inspection.
60
Suspicious Rate
40
20
20
0
0
STC STB DSC (a) Performance Impact of DuCodeMark for Code Completion
W1-Java
FSE027:13
Group
Lang. CoProtector CodeMark 𝑾1 𝑾2
STC STB DSC (b) Performance Impact of DuCodeMark for Code Decompilation
Fig. 4. Performance impact of DuCodeMark on different CodeLMs for code completion and code decompilation. STC: SantaCoder; STB: StarCoderBase; DSC: DeepSeekCoder; Bare: models trained on clean datasets.
1
2
𝑷
C Java
0.44 0.48
0.12 0.16
0.08 0.12 0.12 0.08 0.12 0.16
Average
0.46
0.14
0.08 0.12 0.14
C Java
0.64 0.72
0.28 0.36
0.20 0.28 0.32 0.32 0.40 0.40
Average
0.68
0.32
0.26 0.34 0.36
∗ 𝑊 / 𝑊 : DuCodeMark with watermarking embedding 1 2
only; 𝑃 : DuCodeMark with poisoning injection only.
deviations (𝑝 < 0.05), indicating that DuCodeMark effectively embeds watermarks into protected datasets and enables reliable detection within unauthorized models. In addition, in the black-box setting, we do not have access to the architecture or parameters of the target CodeLM. Among various generation parameters, temperature plays a key role in controlling the randomness and distribution of model outputs, which may significantly affect the stability and reliability of watermark detection. Therefore, we conduct a comprehensive evaluation of DuCodeMark’s watermark detection effectiveness across a temperature range from 0.0 to 1.0 at increments of 0.2. Figure 3 presents heat maps of the 𝑝-values from the 𝑡-test for 𝑊1 across different tasks and CodeLMs, where darker colors indicate smaller 𝑝-values. It can be observed that under all temperature settings, bare models consistently yield non-significant results (𝑝 > 0.05 or NaN). In contrast, models trained on watermarked data consistently exhibit statistically significant deviations (𝑝 < 0.05), with most 𝑝-values falling below 10−5 , clearly revealing the presence of the watermark. These results demonstrate that DuCodeMark can stably and effectively support watermark verification and differentiation across diverse temperature settings. Harmlessness. To evaluate whether DuCodeMark affects model performance, we compare the functional correctness of CodeLMs trained on watermarked datasets with those on bare datasets. We assess model-generated code using the Pass@1 metric. All generations are conducted at a fixed temperature of 0 to ensure consistency. As shown in Figure 4, the Pass@1 of CodeLMs trained on watermarked datasets remains comparable to that of models trained on bare datasets, across different models (SantaCoder, StarCoderBase, and DeepSeek-Coder) and programming languages (C and Java). For example, for 𝑊1 , in the C code completion and code decompilation tasks, the Pass@1 scores of the SantaCoder model before and after watermarking and poisoning are 34.45% vs. 33.84% and 15.24% vs. 14.63%, respectively. These results indicate that our watermarking method introduces negligible interference to model behavior while preserving task performance. Answer to RQ1: DuCodeMark demonstrates strong effectiveness in black-box detection of watermarked models and introduces negligible performance overhead across diverse models, programming languages, and code tasks. 7.2
RQ2: Stealthiness and Robustness of DuCodeMark
Stealthiness. To evaluate the stealthiness of DuCodeMark, we conduct a user study. Following previous studies [36, 40], we construct a code review dataset by mixing watermarked (or poisoned) samples with bare samples at a 1:3 ratio. For each watermarking technique under evaluation, we randomly select 20 code snippets from the bare C and Java datasets, respectively, and embed Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:14
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
Table 7. Impact of DuCodeMark on code readability. ID
Language
Method
Cyclomatic Complexity
NLOC
Token Count
CodeBLEU
C
Bare Watermarked
7.00 7.00
30.94 30.94
213.59 213.38
1.00 0.91
Java
Bare Watermarked
10.83 11.07
42.91 43.63
297.59 299.27
1.00 0.86
C
Bare Watermarked
6.40 6.40
31.44 31.44
212.68 212.56
1.00 0.89
Java
Bare Watermarked
10.07 10.31
43.67 44.39
296.83 298.51
1.00 0.85
𝑾1
𝑾2
watermarks or poisoning into 5 of them. We recruit 10 master’s students majoring in computer science, all independent from the research team (i.e., none are co-authors of this paper). Each participant has at least three years of programming experience and is familiar with both C and Java programming languages. Before the experiment, participants are given a unified introduction to the background of code dataset watermarking, along with a small verification exercise to ensure comprehension. Participants are then assigned to evaluate watermark stealthiness under two awareness conditions: 1) Group 1 is informed only of the potential presence of watermarks; 2) Group 2 is additionally provided with technical details of CoProtector, CodeMark, and DuCodeMark. Each participant independently inspects all code snippets within 60 minutes and labels those they suspect to contain watermarks. All the materials for this user study can be found on our repository [5]. Table 6 shows the suspicion rates of different watermarking techniques under human inspection. In Group 1, where participants had no prior knowledge of implementation details, DuCodeMark achieves the lowest suspicion rates (0.08 for 𝑊1 , 0.12 for 𝑊2 and 0.12 for 𝑃), substantially lower than those of CoProtector (0.46) and CodeMark (0.14). This indicates that the code modified by DuCodeMark is largely indistinguishable from natural code. In the more challenging Group 2 setting, where participants are given technical descriptions of each watermarking method, suspicion rates naturally increase. However, DuCodeMark still maintains a notable advantage, with average suspicion rates of 0.26 for 𝑊1 , 0.34 for 𝑊2 and 0.36 for 𝑃, compared to 0.68 for CoProtector and 0.32 for CodeMark. 𝑊1 does not embed watermarks by inserting additional markers into variable names but instead relies on switching between common naming conventions, thus exhibiting greater stealthiness than 𝑊2 . It is worth noting that the proportion of watermarks and poisons embedded by DuCodeMark in real datasets is substantially lower than the 0.33 ratio used in this user study. Thus, even though DuCodeMark shows an average suspicion rate of about 0.3 in the experiment, manually identifying watermarked or poisoned samples across an entire DuCodeMark-protected dataset would remain virtually infeasible. In addition, we further evaluate the impact of DuCodeMark on code readability after watermark injection. Specifically,we compare the cyclomatic complexity, NLOC, token count, and CodeBLEU score before and after applying DuCodeMark. Table 7 presents the results. It can be observed that DuCodeMark has only a limited effect on these four metrics. For example, for 𝑊1 on the C dataset, the average changes in cyclomatic complexity and NLOC are both 0.00, the average change in token count is only 0.21, and the CodeBLEU score decreases by only 0.09. These results indicate that DuCodeMark has little impact on code structure and readability. Robustness. We evaluate the robustness of DuCodeMark against automated attacks from three perspectives: (1) watermark detection and removal; (2) static-analysis-based detection, code obfuscation, and LLM-based code rewriting; and (3) dilution attacks. Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
FSE027:15
Table 8. FPR and recall of watermark attacks, and the 𝑝-value from post-attack watermark detection. CoProtector Attack
DuCodeMark-𝑾1
CodeMark
Lang. FPR
Recall
𝒑 -value
FPR
Recall
𝒑 -value
DuCodeMark-𝑾2
FPR
Recall
𝒑 -value
FPR
Recall
𝒑 -value
Code Completion SS
C Java
0.07 0.07
0.06 0.07
1.7E-265 1.5E-235
0.07 0.07
0.03 0.04
5.0E-19 1.7E-18
0.07 0.07
0.05 0.03
2.0E-18 5.8E-19
0.07 0.08
0.06 0.05
2.0E-18 4.7E-19
AC
C Java
0.35 0.36
0.31 0.31
9.4E-250 2.0E-246
0.17 0.18
0.10 0.12
1.8E-19 3.7E-19
0.15 0.16
0.07 0.09
3.2E-19 5.5E-19
0.14 0.16
0.08 0.10
2.9E-19 5.3E-18
KillBadCode
C Java
0.27 0.30
1.00 1.00
NaN NaN
0.35 0.36
0.57 0.61
5.7E-17 2.7E-17
0.35 0.33
0.32 0.34
4.3E-18 1.6E-19
0.35 0.34
0.33 0.35
4.1E-17 1.4E-19
DeCoMa
C Java
0.27 0.26
1.00 1.00
NaN NaN
0.29 0.30
0.98 0.97
0.14 0.15
0.28 0.29
0.35 0.34
2.0E-16 7.1E-16
0.29 0.29
0.55 0.54
1.6E-15 6.0E-15
SS
C Java
0.07 0.06
0.07 0.07
1.00 1.00
0.07 0.07
0.05 0.06
0.15 0.16
0.07 0.07
0.03 0.04
1.3E-05 2.7E-05
0.07 0.08
0.04 0.04
1.3E-05 2.6E-05
AC
C Java
0.36 0.34
0.33 0.32
1.00 1.00
0.22 0.20
0.30 0.25
0.14 0.20
0.20 0.21
0.26 0.25
3.4E-04 5.8E-04
0.22 0.22
0.28 0.30
3.2E-04 5.1E-04
KillBadCode
C Java
1.00 1.00
1.00 1.00
-
1.00 1.00
1.00 1.00
-
1.00 1.00
1.00 1.00
-
1.00 1.00
1.00 1.00
-
DeCoMa
C Java
0.28 0.27
1.00 1.00
NaN NaN
0.30 0.29
0.98 0.99
0.15 0.14
0.28 0.29
0.36 0.37
1.1E-04 1.3E-04
0.29 0.30
0.56 0.57
1.2E-03 1.1E-03
Code Decompilation
∗ 𝑝 -values indicating successful watermark detection after attacks are highlighted in gray.
Table 9. Accuracy, compilation rate, and time cost of static-analysis-based detection, code obfuscation, and LLM-based rewriting attacks. Clang-format
CodeQL
Analyzer
Tigress
ProGuard CodeLlama-Instruct-7B
GPT-4o
Method ACC Time ACC Time ACC Time ACC Time ACC Time ACC Comp.
Time
ACC Comp. Time
CoProtector
0.00
518.23s
0.98
CodeMark
3.09s
1.00 615.09s 1.00 28.71s 1.00 24.25s 1.00 40.45s 0.96
0.04
0.66 926.37s
0.00
3.20s
0.00 614.28s 0.00 28.14s 1.00 24.20s 1.00 40.27s 0.86
0.06
521.31s
0.98
0.64 924.25s
DuCodeMark-𝑾1 0.00
3.15s
0.00 614.37s 0.00 28.56s 1.00 24.14s 1.00 40.23s 0.94
0.06
520.36s
1.00
0.62 925.13s
DuCodeMark-𝑾2 0.00
3.17s
0.00 614.37s 0.00 28.56s 1.00 24.53s 1.00 40.76s 0.90
0.05
520.36s
0.96
0.64 925.13s
0.00
3.16s
0.00 615.12s 0.00 28.77s 1.00 24.36s 1.00 40.51s 0.94
0.06
519.15s
0.96
0.62 923.32s
w/o W1
w/ W2
w/o W2
DuCodeMark-𝑷
∗ Analyzer denotes Clang Static Analyzer, and Comp. denotes Compilation Rate.
Completion
Decompilation
w/ W1
50
40
40
Pass@1 (%)
50 30 20 10 0
Rate
100% 70% 50% 20% 0%
Bare Pass@1 (%)
Table 10. 𝑝-values of DeepSeek-Coder trained on C datasets with varying watermarking rates.
𝑾1
𝑾2
𝑾1
𝑾2
3.3E-18 1.6E-12 6.7E-05 2.6E-01 3.2E-01
4.6E-21 3.2E-17 1.5E-10 2.6E-04 2.6E-01
1.7E-05 2.9E-05 3.1E-04 2.0E-01 4.6E-01
2.9E-07 1.8E-07 5.4E-05 2.6E-01 1.7E-01
30 20 10 0
C Java (a) Code Completion on float Return-Type Functions
C Java (b) Code Decompilation on double Return-Type Functions
Fig. 5. Impact of poison activation after watermark removal in DuCodeMark on DeepSeek-Coder with typed inputs.
For robustness against watermark detection and removal attacks, we employ DeCoMa [47], the only dedicated watermark removal method, alongside SS, AC, and KillBadCode adapted from backdoor defenses. As SS and AC require access to latent representations, we fine-tune a DeepSeek-Coder Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:16
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
model on the C watermarked dataset. The results, shown in Table 8, indicate that DuCodeMark consistently preserves watermark verifiability, with all 𝑝-values remaining well below the 0.05 significance threshold across detectors. This suggests that none of them can remove or invalidate the watermark signal embedded by DuCodeMark. In contrast, CoProtector and CodeMark exhibit weak robustness. For the code completion task, both KillBadCode and DeCoMa achieve perfect recall (1.00) on CoProtector, successfully identifying and removing nearly all watermark instances, leading to large 𝑝-values or NaNs that signify the loss of verifiability. Similarly, CodeMark is vulnerable to DeCoMa, which attains high recall (0.98 for C and 0.97 for Java) and yields 𝑝-values above 0.05 in several cases. In the code decompilation task, most detectors produce high 𝑝-values or NaNs for CoProtector and CodeMark, again indicating that their watermark signals can no longer be reliably detected. Moreover, KillBadCode fails catastrophically, with both FPR and Recall reaching 1.00, meaning it misclassifies all samples as watermarked and thus becomes ineffective. Considering that adversaries may adopt typical detection or evasion strategies, we further evaluate the robustness of DuCodeMark against automated formatting, static-analysis-based detection, code obfuscation, and LLM-based code rewriting attacks. We randomly select 100 watermarked and poisoned samples from CoProtector, CodeMark, and DuCodeMark, and evaluate them using different tools and models. For automated formatting and static analysis, we employ Clang-format, CodeQL, and Clang Static Analyzer. We measure their accuracy (ACC) and time cost, where ACC denotes the proportion of watermark or poisoning patterns correctly identified. For code obfuscation attacks, we employ two widely adopted obfuscation tools, Tigress and ProGuard, to obfuscate 100 DuCodeMark-protected C and Java samples, respectively. We measure ACC and time cost, where ACC denotes the proportion of watermark and poisoning patterns successfully removed after obfuscation. For LLM-based rewriting attacks, we evaluate the open-source CodeLlama-Instruct-7b and the closed-source GPT-4o. Following the previous study [47], we adopt the following prompt template: “The following code may contain watermarking or poisoning, which could lead to undesired behavior if used to train a model. Please rewrite the code to eliminate any suspicious or malicious patterns while preserving its original functionality”. We then measure their ACC, compilation rate, and time cost. ACC refers to the proportion of watermark and poisoning patterns successfully removed after rewriting, while compilation rate denotes the proportion of rewritten code that still preserves basic syntactic and functional correctness. Table 9 presents the robustness of CoProtector, CodeMark, and DuCodeMark under these detection and evasion strategies. The results show that the formatting tool Clang-format is ineffective at removing existing watermarks. Since CoProtector embeds dead-code patterns as watermarks, it is highly susceptible to detection by static analysis tools such as CodeQL and Clang Static Analyzer. In contrast, code obfuscation proves substantially stronger: both Tigress and ProGuard can effectively remove the watermark and poisoning patterns embedded by DuCodeMark. This is because these tools systematically rename identifiers and thus break the stylistic associations between triggers and targets. However, such aggressive obfuscation also significantly reduces the semantic interpretability of code, making it difficult for models to effectively learn tasks that rely on identifier naming, such as code generation, code understanding, and code decompilation. As a result, although code obfuscation is effective at removing the embedded patterns, it also greatly diminishes the practical value of such datasets to an attacker. LLM-based code rewriting proves more effective in removing watermarks but significantly compromises code semantics. For instance, the compilation rate of samples rewritten by CodeLlama drops to only about 0.05, while GPT-4o achieves merely 0.64. Moreover, LLM-based rewriting introduces substantial computational overhead. Rewriting just 100 samples requires approximately 520s for CodeLlama and 925s for GPT-4o. Given that protected datasets typically contain hundreds of thousands of samples, such methods are impractical for large-scale application. Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
FSE027:17
We further consider a practical scenario where end users combine multiple datasets for downstream fine-tuning. Some of these datasets may not contain watermarks. This naturally raises the risk of dilution attacks, where the effectiveness of the watermark may be weakened by introducing a large proportion of non-watermarked samples. To simulate such an attack, we construct C language training datasets with varying watermarking rates: 100%, 70%, 50%, 20%, and 0%. We fine-tune DeepSeek-Coder on each dataset for both code completion and code decompilation tasks, and assess watermark verifiability using the 𝑝-value-based verification protocol. The results are summarized in Table 10. It can be observed that DuCodeMark maintains strong robustness against dilution. The watermark remains verifiable even when the watermarking rate is reduced to 50%. However, verification fails when the watermarking rate falls below 20%. Such an extreme degree of dilution is unlikely to occur in practice, as acquiring a large quantity of high-quality, task-aligned code to effectively overwrite the watermark signal poses significant challenges for adversaries [40]. These results highlight the practicality and resilience of DuCodeMark in real-world data integration and evasion scenarios. Answer to RQ2: DuCodeMark remains highly imperceptible to humans, introduces only limited changes to code readability, and preserves watermark verifiability under a range of automated detection, rewriting, and dilution attacks. Although aggressive code obfuscation can remove the embedded patterns, it also substantially reduces the practical utility of the resulting dataset to an attacker. 7.3
RQ3: Effectiveness of DuCodeMark’s Poisoning
In this experiment, we evaluate both the punitive effect of DuCodeMark’s poisoning mechanism once watermarks are removed and the effectiveness of its watermarking mechanism in suppressing poisoning during training. Specifically, we conduct a controlled study by first removing all watermark-embedded samples from the C training dataset, then fine-tuning DeepSeek-Coder on the remaining poisoned samples without watermarks for both code completion and code decompilation tasks. Model performance is evaluated on functions with float and double return types, which serve as key triggers for the poisoning mechanism. To construct the evaluation set, we extract seven float- and seven double-returning functions from HumanEval. As shown in Figure 5, models trained with the full DuCodeMark dataset perform comparably to clean models, indicating that the watermarking mechanism suppresses activation of poisoning behaviors. However, once watermark-embedded samples are removed, the poisoning effect is clearly activated. For example, under 𝑊1 , in the Java code completion task, Pass@1 on float-returning functions drops from 32.15% to 3.57%. These results confirm that DuCodeMark not only embeds verifiable watermarks but also serves as an effective defensive signal preventing the activation of latent poisoning behaviors. Its removal exposes the underlying attack, resulting in significant and targeted degradation of model performance. Answer to RQ3: DuCodeMark effectively suppresses poisoned behaviors during training through embedded watermark signals. When these watermarks are removed, the poisoned behaviors are reliably triggered, resulting in targeted performance degradation. 7.4
RQ4: Impact of Parameter Settings in DuCodeMark
DuCodeMark injects repressible poisoned samples into a candidate subset of float/double-returning functions to deter watermark removal. The trigger poisoning rate, i.e., the balance between poisoned and watermarked samples, may affect model behavior. Figure 6 presents the Pass@1 performance of DeepSeek-Coder on C language code completion and decompilation tasks under varying trigger Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:18
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
w/o W1 Pass@1 (%)
Pass@1 (%)
w/ W1 50 40 30 20 10 0
10% 30% 50% 70% 90% Trigger Poisoning Ratio
w/ W2 50 40 30 20 10 0
w/o W2
10% 30% 50% 70% 90% Trigger Poisoning Ratio
(a) Code Completion
Table 11. 𝑝-value of DeepSeek-Coder trained on C datasets under different compilation optimization levels (O1, O2, O2, O3) and system environments.
ID
OS–Compiler Compilation Optimization Levels Configurations O0 O1 O2 O3
(b) Code Decompilation
Fig. 6. Pass@1 of DeepSeek-Coder trained on C datasets with varying trigger poisoning ratios.
𝑾1
GCC Clang
1.7E-05 1.8E-05 2.3E-05 1.2E-05 5.3E-04 7.4E-05
3.1E-05 3.9E-05
𝑾2
GCC Clang
2.9E-07 3.1E-07 2.1E-08 2.1E-07 2.3E-07 2.3E-07
3.4E-07 2.1E-08
Table 12. 𝑝-values of 𝑊1 from Table 13. 𝑝-values with code Table 14. Suspicious rate and 𝑝-value of three independent decoding trials comments retained. DuCodeMark-𝑊1 and CoProtector. with DeepSeek-Coder at temperature 1.0 on the C dataset. ID Task C Java Watermark Lang. Suspicious Rate 𝒑 -value Task
Trial-1 Trial-2 Trial-3
Completion 2.8E-27 5.4E-27 2.6E-27 Decompilation 3.4E-04 2.8E-04 8.7E-05
𝑾1
Completion 3.6E-18 2.8E-32 Decompilation 6.5E-05 4.8E-08
𝑾1
C Java
0.08 0.08
3.3E-18 1.9E-33
𝑾2
Completion 4.6E-21 2.3E-37 Decompilation 1.9E-07 3.3E-09
CoProtector
C Java
0.44 0.48
2.3E-265 1.7E-235
poisoning ratios (10%–90%), where “w/” indicates watermark presence and “w/o” indicates its removal. The results show that a 50% trigger poisoning ratio yields the most desirable outcome: the model retains high performance when watermark samples are present, and exhibits a sharp performance drop when they are removed. Notably, this does not mean that 50% of the entire corpus is poisoned; the effective poisoning rate over the full C dataset is only about 0.8%. This indicates that an appropriate balance between poisoned and watermarked trigger samples enables effective suppression and reliable activation of the poisoning mechanism. In the code decompilation setting, a practical adversary may attempt to bypass watermark verification by generating pseudocode from binaries compiled under different OS–compiler configurations and optimization levels. Such variations may affect the structure of decompiled code and potentially undermine watermark verifiability. To evaluate the robustness of DuCodeMark under these conditions, we fine-tune DeepSeek-Coder on pseudocode derived from C programs compiled on Ubuntu with GCC and macOS with Clang, using optimization levels ranging from -O1 to -O3. As shown in Table 11, DuCodeMark consistently preserves verifiable watermark signals across all configurations, demonstrating strong resilience to compilation-induced variability. Answer to RQ4: A 50% trigger poisoning rate within the candidate subset achieves the best balance, suppressing poisoned behavior while reliably triggering it upon watermark removal. DuCodeMark also preserves verifiability across OS, compiler, and optimization variants. 8 8.1
Discussion Threats to Validity
Robustness of DuCodeMark. In our experiments, we examine the impact of different temperature settings in CodeLM outputs on the verification of DuCodeMark watermarks. To minimize randomness, we fix the random seed in the main experiments. However, even with a fixed seed, verification relies on a single generation. We additionally conduct multiple independent decoding trials to assess the robustness of DuCodeMark watermark verification. Table 12 presents the results Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
FSE027:19
Table 15. 𝑝-values of Llama-3.2-3B on code completion and code decompilation tasks with datasets watermarked by DuCodeMark. Language
Task
Bare
𝑾1
𝑾2
C
Completion Decompilation
3.2E-01 3.2E-01
3.6E-20 3.9E-05
4.5E-20 1.7E-05
Language
Task
Bare
𝑾1
𝑾2
Java
Completion Decompilation
4.8E-01 4.6E-01
1.8E-30 3.7E-08
3.0E-30 4.2E-08
of three independent decoding trials of DuCodeMark-𝑊1 on the C dataset using DeepSeek-Coder at a temperature of 1.0. As shown, all trials consistently confirm the presence of the watermark. One potential concern arises in the dilution-based attack scenario, where the effectiveness of DuCodeMark decreases when the watermarking rate drops below 20%. However, in practice, the dataset owner typically leverages all available high-quality code sources, making it nearly infeasible for adversaries to collect more than 80% additional domain-aligned code to achieve such dilution. Generalizability of DuCodeMark. Although our evaluation is limited to C and Java, the core design of DuCodeMark, which relies on style-aware code transformations over ASTs parsed by Tree-sitter, is inherently language-agnostic. As Tree-sitter currently supports more than 100 programming languages, DuCodeMark can be readily adapted to other languages (e.g., Python and JavaScript). Moreover, the current version of DuCodeMark primarily focuses on embedding watermarks and poisons within code structures, without explicitly leveraging comments or documentation. This limits its applicability to tasks where inputs or outputs rely exclusively on natural language elements (e.g., code summarization and code search). However, this does not imply that DuCodeMark is ineffective in datasets containing comments. Table 13 reports results with code comments retained in the C dataset. The 𝑝-values in both code completion and code decompilation tasks remain substantially below 0.05, indicating that DuCodeMark still provides effective dataset protection in the presence of comments. Exploring the integration of DuCodeMark with natural language watermarking methods to design more stealthy and robust watermarking mechanisms remains a challenging yet highly promising direction for future research. Trigger dependence of poisoning in DuCodeMark. The poisoning mechanism in DuCodeMark introduces subtle perturbations into the return values of specific functions, aiming to trigger suppressible misleading behaviors once the watermark is removed. In this work, we focus on float and double types. Their relative infrequency ensures strong stealthiness, while their high semantic salience enables effective control. We employ strictly semantics-preserving code transformations to minimize the risks of syntactic or semantic disruption that such poisoning may introduce. Of course, this strategy is not limited to floating-point types and can be extended to other return types such as long and boolean. However, in scenarios where functions return more complex structured data (e.g., structs or objects), such perturbations are more likely to cause semantic errors or be detected through manual inspection. 8.2
Performance of DuCodeMark on larger general-purpose models
We further evaluate the performance of DuCodeMark beyond the three code-specialized models used in our main experiments by additionally fine-tuning Llama-3.2-3B under the same training and evaluation setup as in RQ1. Llama-3.2-3B is a larger general-purpose model pretrained on largescale heterogeneous data. The results in Table 15 show that models fine-tuned on DuCodeMarkprotected data still exhibit statistically significant watermark signals on both code completion and code decompilation tasks for C and Java, whereas the corresponding bare models remain consistently non-significant. For example, on the C dataset, the 𝑝-values of 𝑊1 /𝑊2 are 3.6 × 10−20 /4.5 × 10−20 for code completion and 3.9 × 10−5 /1.7 × 10−5 for code decompilation. These results indicate that DuCodeMark remains effective on a larger general-purpose model. Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:20
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
Due to computational resource constraints, we do not further evaluate even larger models in this work. However, prior studies suggest that as model capacity increases, models tend to better memorize and exploit stable dataset-level regularities rather than wash them out [1, 52]. Therefore, we expect DuCodeMark to remain effective when larger general-purpose models are trained or fine-tuned on DuCodeMark-protected corpora, although more extensive validation of this hypothesis remains an important direction for future work. 8.3
Trade-offs between watermark strength and stealthiness
In our experiments, we observe that increasing watermark strength tends to compromise stealthiness. This phenomenon is particularly evident when comparing CoProtector and DuCodeMark, as shown in Table 14. CoProtector applies aggressive sentence-level transformations (such as dead code insertion), which yield stronger signals (lower 𝑝-values) but at the cost of substantially higher suspicion rates. In contrast, DuCodeMark adopts subtle, style-aware edits that preserve stealth while still achieving statistically significant watermark detection. This observation provides insights for future research on code dataset watermarking: watermarking methods should carefully balance signal strength and stealthiness in accordance with practical application scenarios. 8.4
Ethical and Practical Considerations
The adoption of code dataset watermarking techniques such as DuCodeMark raises important ethical and practical considerations. First, our goal is not to hinder open-source collaboration or legitimate research, but to provide dataset owners with effective means of protecting their intellectual contributions against unauthorized exploitation by large-scale model training. Second, while DuCodeMark demonstrates robustness against automated detection, removal, and dilution attacks, powerful adversaries with sufficient resources may still attempt circumvention. Therefore, dataset owners should regard watermarking not as an absolute safeguard but as a complementary layer of protection, to be combined with legal and community-based measures. Finally, although DuCodeMark is designed to prevent unauthorized use of code datasets for model training, it may also introduce new risks. For instance, if a specific watermarking mechanism were publicly disclosed, malicious users aware of its details could exploit it to deliberately remove watermarks or forge false ones in third-party datasets, thereby undermining its credibility in intellectual property protection and accountability. To mitigate such risks, we recommend exercising caution during deployment, avoiding the disclosure of sensitive details (e.g., trigger patterns or key parameters). 9 Conclusion In this paper, we propose DuCodeMark, a dual-purpose watermarking method for code datasets. DuCodeMark embeds watermarks through style-aware code transformations and incorporates a repressible poisoning mechanism. The design supports both source-code tasks and decompilation tasks. Experimental results demonstrate that DuCodeMark consistently achieves strong verifiability, negligible performance overhead, high stealthiness, and robustness against removal attacks, establishing it as a practical and resilient framework for code dataset watermarking. These highlight its potential for protecting code datasets in real-world scenarios. Data Availability Our source code and experimental data are available at [5]. References [1] Ali Al-Kaswan, Maliheh Izadi, and Arie van Deursen. 2024. Traces of Memorisation in Large Language Models for Code. In Proceedings of the 46th IEEE/ACM International Conference on Software Engineering. ACM, Lisbon, Portugal, Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
FSE027:21
78:1–78:12. [2] Loubna Ben Allal, Raymond Li, Denis Kocetkov, Chenghao Mou, Christopher Akiki, Carlos Muñoz Ferrandis, Niklas Muennighoff, Mayank Mishra, Alex Gu, Manan Dey, et al. 2023. SantaCoder: don’t reach for the stars! arXiv abs/2301.03988 (2023). [3] Miltiadis Allamanis, Earl T. Barr, Premkumar T. Devanbu, and Charles Sutton. 2018. A Survey of Machine Learning for Big Code and Naturalness. ACM Comput. Surv. 51, 4 (2018), 81:1–81:37. [4] Amazon Web Services, Inc. 2023. CodeWhisperer. site: https://aws.amazon.com/codewhisperer/. [5] Anonymous. 2025. DuCodeMark. site: https://github.com/yuc-chen/DuCodeMark. [6] Beijing Guixin Technology, Inc. 2022. aiXcoder. site: https://www.aixcoder.com/. [7] Andrei Z. Broder. 2000. Identifying and Filtering Near-Duplicate Documents. In Proceedings of the 11th Annual Symposium on Combinatorial Pattern Matching (Lecture Notes in Computer Science, Vol. 1848). Springer, Montreal, Canada, 1–10. [8] Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian M. Molloy, and Biplav Srivastava. 2019. Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering. In Workshop on Artificial Intelligence Safety 2019 co-located with the Thirty-Third AAAI Conference on Artificial Intelligence 2019 (AAAI-19) (CEUR Workshop Proceedings, Vol. 2301). CEUR-WS.org, Honolulu, Hawaii. [9] Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Henrique Pondé de Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. 2021. Evaluating Large Language Models Trained on Code. arXiv abs/2107.03374 (2021). [10] Yuchen Chen, Weisong Sun, Chunrong Fang, Zhenpeng Chen, Yifei Ge, Tingxu Han, Quanjun Zhang, Yang Liu, Zhenyu Chen, and Baowen Xu. 2024. Security of Language Models for Code: A Systematic Literature Review. arXiv abs/2410.15631 (2024). [11] Anderson Faustino da Silva, Bruno Conde Kind, José Wesley de Souza Magalhães, Jerônimo Nunes Rocha, Breno Campos Ferreira Guimarães, and Fernando Magno Quintão Pereira. 2021. AnghaBench: A Suite with One Million Compilable C Benchmarks for Code-Size Reduction. In IEEE/ACM International Symposium on Code Generation and Optimization. IEEE, Seoul, South Korea, 378–390. [12] Chunrong Fang, Weisong Sun, Yuchen Chen, Xiao Chen, Zhao Wei, Quanjun Zhang, Yudu You, Bin Luo, Yang Liu, and Zhenyu Chen. 2024. Esale: Enhancing Code-Summary Alignment Learning for Source Code Summarization. IEEE Trans. Software Eng. 50, 8 (2024), 2077–2095. [13] Zhangyin Feng, Daya Guo, Duyu Tang, Nan Duan, Xiaocheng Feng, Ming Gong, Linjun Shou, Bing Qin, Ting Liu, Daxin Jiang, and Ming Zhou. 2020. CodeBERT: A Pre-Trained Model for Programming and Natural Languages. In Findings of the Association for Computational Linguistics (Findings of ACL, Vol. EMNLP 2020). Association for Computational Linguistics, Online Event, 1536–1547. [14] Free Software Foundation. 2024. GNU Coding Standards. site: https://www.gnu.org/prep/standards/. [15] GitHub, Inc. 2021. GitHub Copilot research recitation. https://github.blog/2021-06-30-github-copilot-researchrecitation/. [16] GitHub, Inc. 2022. GitHub Copilot. https://copilot.github.com/. [17] GitHub Inc. 2025. CodeQL: Code Analysis Engine. https://codeql.github.com/. [18] Daya Guo, Qihao Zhu, Dejian Yang, Zhenda Xie, Kai Dong, Wentao Zhang, Guanting Chen, Xiao Bi, Y. Wu, Y. K. Li, Fuli Luo, Yingfei Xiong, and Wenfeng Liang. 2024. DeepSeek-Coder: When the Large Language Model Meets Programming - The Rise of Code Intelligence. arXiv abs/2401.14196 (2024). [19] Peiwei Hu, Ruigang Liang, and Kai Chen. 2024. DeGPT: Optimizing Decompiler Output with LLM. In Proceedings of the 31st Annual Network and Distributed System Security Symposium. The Internet Society, San Diego, California, USA. [20] Hugging Face, Inc. 2016. Hugging Face. site: https://huggingface.co/. [21] Aaron Hurst, Adam Lerer, Adam P. Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. 2024. GPT-4o System Card. arXiv abs/2410.21276 (2024). [22] Hamel Husain, Ho-Hsiang Wu, Tiferet Gazit, Miltiadis Allamanis, and Marc Brockschmidt. 2019. CodeSearchNet Challenge: Evaluating the State of Semantic Code Search. arXiv abs/1909.09436 (2019). [23] Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. 2024. Who Wrote this Code? Watermarking for Code Generation. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics. Association for Computational Linguistics, Bangkok, Thailand, 4890–4911. [24] Boquan Li, Mengdi Zhang, Peixin Zhang, Jun Sun, Xingmei Wang, and Zirui Fu. 2024. ACW: Enhancing Traceability of AI-Generated Codes Based on Watermarking. arXiv abs/2402.07518 (2024). [25] Raymond Li, Loubna Ben Allal, Yangtian Zi, Niklas Muennighoff, Denis Kocetkov, Chenghao Mou, Marc Marone, Christopher Akiki, Jia Li, Jenny Chim, et al. 2023. StarCoder: may the source be with you! Transactions on Machine Learning Research 2023 (2023).
Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
FSE027:22
Y. Chen, Y. Xiao, C. Fang, Z. Chen, B. Xu
[26] Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip S. Yu. 2025. A Survey of Text Watermarking in the Era of Large Language Models. ACM Comput. Surv. 57, 2 (2025), 47:1–47:36. [27] Fang Liu, Ge Li, Yunfei Zhao, and Zhi Jin. 2020. Multi-task Learning based Pre-trained Language Model for Code Completion. In Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering. IEEE, Melbourne, Australia, 473–485. [28] LLVM. 2008. Clang Static Analyzer. https://clang.llvm.org/docs/ClangStaticAnalyzer.html. Accessed: 2025. [29] LLVM. 2013. Clang-format. https://clang.llvm.org/docs/ClangFormat.html. Accessed: 2025. [30] Vadim Markovtsev and Waren Long. 2018. Public git archive: a big code dataset for all. In Proceedings of the 15th International Conference on Mining Software Repositories. ACM, Gothenburg, Sweden, 34–37. [31] Max Brunsfeld and others. 2018. Tree-sitter: An incremental parsing system for programming tools. https://github. com/tree-sitter/tree-sitter. [32] Bradley McDanel and Zhanhao Liu. 2023. ChatGPT as a Java Decompiler. In Proceedings of the 3rd Workshop on Natural Language Generation, Evaluation, and Metrics. Association for Computational Linguistics, Singapore, 224–232. [33] Erik Nijkamp, Bo Pang, Hiroaki Hayashi, Lifu Tu, Huan Wang, Yingbo Zhou, Silvio Savarese, and Caiming Xiong. 2023. CodeGen: An Open Large Language Model for Code with Multi-Turn Program Synthesis. In Proceedings of the 11st International Conference on Learning Representations. OpenReview.net, Kigali, Rwanda. [34] Oracle. 1999. Code Conventions for the Java Programming Language. site: https://www.oracle.com/java/technologies/ javase/codeconventions-contents.html. [35] Baptiste Rozière, Jonas Gehring, Fabian Gloeckle, Sten Sootla, Itai Gat, Xiaoqing Ellen Tan, Yossi Adi, Jingyu Liu, Tal Remez, Jérémy Rapin, et al. 2023. Code Llama: Open Foundation Models for Code. arXiv abs/2308.12950 (2023). [36] Weisong Sun, Yuchen Chen, Guanhong Tao, Chunrong Fang, Xiangyu Zhang, Quanjun Zhang, and Bin Luo. 2023. Backdooring Neural Code Search. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics. Association for Computational Linguistics, Toronto, Canada, 9692–9708. [37] Weisong Sun, Yuchen Chen, Mengzhe Yuan, Chunrong Fang, Zhenpeng Chen, Chong Wang, Yang Liu, Baowen Xu, and Zhenyu Chen. 2025. Show Me Your Code! Kill Code Poisoning: A Lightweight Method Based on Code Naturalness. In Proceedings of the 47th IEEE/ACM International Conference on Software Engineering. IEEE Computer Society, Ottawa, Ontario, Canada, 1–12. [38] Weisong Sun, Chunrong Fang, Yuchen Chen, Guanhong Tao, Tingxu Han, and Quanjun Zhang. 2022. Code Search based on Context-aware Code Translation. In Proceedings of the 44th International Conference on Software Engineering. ACM, May 25-27, 388–400. [39] Weisong Sun, Chunrong Fang, Yuchen Chen, Quanjun Zhang, Guanhong Tao, Yudu You, Tingxu Han, Yifei Ge, Yuling Hu, Bin Luo, and Zhenyu Chen. 2024. An Extractive-and-Abstractive Framework for Source Code Summarization. ACM Trans. Softw. Eng. Methodol. 33, 3 (2024), 75:1–75:39. [40] Zhensu Sun, Xiaoning Du, Fu Song, and Li Li. 2023. CodeMark: Imperceptible Watermarking for Code Datasets against Neural Code Completion Models. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering. ACM, San Francisco, CA, USA, 1561–1572. [41] Zhensu Sun, Xiaoning Du, Fu Song, Mingze Ni, and Li Li. 2022. CoProtector: Protect Open-Source Code against Unauthorized Training Usage with Data Poisoning. In WWW ’22: The ACM Web Conference 2022. ACM, Virtual Event, Lyon, France, 652–660. [42] Alexey Svyatkovskiy, Ying Zhao, Shengyu Fu, and Neel Sundaresan. 2019. Pythia: AI-assisted Code Completion System. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery. ACM, Anchorage, AK, USA, 2727–2735. [43] Hanzhuo Tan, Qi Luo, Jing Li, and Yuqun Zhang. 2024. LLM4Decompile: Decompiling Binary Code with Large Language Models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. Association for Computational Linguistics, Miami, FL, USA, 3473–3487. [44] Brandon Tran, Jerry Li, and Aleksander Madry. 2018. Spectral Signatures in Backdoor Attacks. In Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems. Montréal, Canada, 8011–8021. [45] Yao Wan, Jingdong Shu, Yulei Sui, Guandong Xu, Zhou Zhao, Jian Wu, and Philip S. Yu. 2019. Multi-modal Attention Network Learning for Semantic Source Code Retrieval. In Proceedings of the 34th IEEE/ACM International Conference on Automated Software Engineering. IEEE, San Diego, CA, USA, 13–25. [46] Bernard L Welch. 1947. The Generalization of Student’s Problem when Several Different Population Varlances are Involved. Biometrika 34, 1-2 (1947), 28–35. [47] Yuan Xiao, Yuchen Chen, Shiqing Ma, Haocheng Huang, Chunrong Fang, Yanwei Chen, Weisong Sun, Yunfeng Zhu, Xiaofang Zhang, and Zhenyu Chen. 2025. DeCoMa: Detecting and Purifying Code Dataset Watermarks through Dual Channel Code Abstraction. In Proceedings of the 34th ACM SIGSOFT International Symposium on Software Testing and Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.
DuCodeMark: Dual-Purpose Code Dataset Watermarking via Style-Aware Watermark–Poison Design
FSE027:23
Analysis. ACM, Trondheim, Norway, 1–23. [48] Borui Yang, Wei Li, Liyao Xiang, and Bo Li. 2023. Towards Code Watermarking with Dual-Channel Transformations. arXiv abs/2309.00860 (2023). [49] Zhou Yang, Jieke Shi, Junda He, and David Lo. 2022. Natural Attack for Pre-trained Models of Code. In Proceedings of the 44th International Conference on Software Engineering. ACM, Pittsburgh, PA, USA, 1482–1493. [50] Zhou Yang, Zhensu Sun, Terry Yue Zhuo, Premkumar T. Devanbu, and David Lo. 2024. Robustness, Security, Privacy, Explainability, Efficiency, and Usability of Large Language Models for Code. arXiv abs/2403.07506 (2024). [51] Zhou Yang, Bowen Xu, Jie M. Zhang, Hong Jin Kang, Jieke Shi, Junda He, and David Lo. 2024. Stealthy Backdoor Attack for Code Models. IEEE Trans. Software Eng. 50, 4 (2024), 721–741. [52] Zhou Yang, Zhipeng Zhao, Chenyu Wang, Jieke Shi, Dongsun Kim, DongGyun Han, and David Lo. 2024. Unveiling Memorization in Code Models. In Proceedings of the 46th IEEE/ACM International Conference on Software Engineering. ACM, Lisbon, Portugal, 72:1–72:13. [53] Qinkai Zheng, Xiao Xia, Xu Zou, Yuxiao Dong, Shan Wang, Yufei Xue, Lei Shen, Zihan Wang, Andi Wang, Yang Li, Teng Su, Zhilin Yang, and Jie Tang. 2023. CodeGeeX: A Pre-Trained Model for Code Generation with Multilingual Benchmarking on HumanEval-X. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. ACM, Long Beach, CA, USA, 5673–5684.
Received 2025-09-12; accepted 2025-12-22
Proc. ACM Softw. Eng., Vol. 3, No. FSE, Article FSE027. Publication date: July 2026.