R-CoT: A Reasoning-Layer Watermark via Redundant Chain-of-Thought in Large Language Models
arXiv:2604.25247v1 [cs.CR] 28 Apr 2026
Ziming Zhang1 , Li Li1∗ , Guorui Feng1 , Hanzhou Wu1 , Xinpeng Zhang2† 1 School of Communication and Information Engineering, Shanghai University 2 School of Computer Engineering and Science, Shanghai University [email protected], [email protected], [email protected], [email protected], [email protected] Abstract Large language models (LLMs) are widely deployed in multiple scenarios due to reasoning capabilities. In order to prevent the models from being misused, watermarking is generally employed to ensure ownership. However, most existing watermarking methods rely on superficial modifications to the model’s output distribution, rendering the watermark vulnerable to perturbation and removal. To overcome this challenge, this paper introduces a reasoning-layer framework termed Redundant Chain-of-Thought (R-CoT), which embeds watermarks into the reasoning path. A dualtrajectory optimization mechanism based on GRPO enables the native and the watermark reasoning path to coexist within a shared parameter space, internalizing the watermark as a distinct reasoning policy. Therefore, the watermark is embedded into the model’s stable reasoning path, avoiding the watermark failure caused by output-level perturbations. Experimental results show that, compared with existing methods, R-CoT achieves high watermark effectiveness and strong robustness. Under fine-tuning and other post-training operations, the true positive rate (TPR) consistently remains above 95%, exhibiting only marginal degradation.
1
Introduction
In recent years, Large Language Models (LLMs) have achieved remarkable progress in Natural Language Processing (NLP). With the emergence of reasoning-oriented models, such as OpenAI-O1 and Deepseek-R1, increasing attention has been paid to the logical structure and reasoning text generation. The Chain-of-Thought (CoT) mechanism improves reasoning accuracy and interpretability by decomposing complex tasks into intermediate steps [Wei et al., 2022]. The significant data and computational costs required to train such models, together with their public release, expose them to risks of copyright infringement, tampering, and misuse [Song et al., 2025; Roh et al., 2025; ∗ †
Corresponding author. Email: [email protected] Corresponding author. Email: [email protected]
Zhao et al., 2025], underscoring the need for effective intellectual property (IP) protection mechanisms [Deng et al., 2025]. Digital watermarking is a classical technique for multimedia copyright protection, typically achieved by embedding imperceptible watermarks into the content to encode ownership information. With the increasing prevalence of LLMs, researchers have begun to explore watermarking mechanisms for protecting model ownership in LLM-generated content [Yang et al., 2023; Zhang et al., 2024; Qiu et al., 2025; Bahri and Wieting, 2024]. Most existing LLM watermarking approaches fall under output-level watermarking, where watermarks are embedded by modifying the sampling probability distribution during text generation or by exploiting statistical properties of the generated text to induce detectable patterns. However, such methods fundamentally rely on direct control over the model’s output text and therefore exhibit limited robustness against attacks such as paraphrasing, translation, and model fine-tuning. Due to the limited robustness of existing output-level watermarking methods, recent research has increasingly shifted its focus toward seeking more stable forms of watermarking. As an internal reasoning process of language models, the Chain-of-Thought (CoT) exhibits structured and extensible step-wise reasoning properties, whose progressive reasoning form provides a natural carrier for embedding watermark information. However, some existing approaches [Wang et al., 2024; Guo et al., 2025a; Guo et al., 2025b] still primarily operate on the CoT text, essentially treating CoT as surfacelevel generated text, rather than reflecting its intrinsic role as a manifestation of the model’s internal reasoning pathways. Consequently, these methods have not yet achieved watermarking that truly leverages chain-of-thought reasoning, and they continue to exhibit limited robustness when subjected to attacks [Xiang et al., 2024; Jin et al., 2024]. To reflect the essential feature of the reasoning chain as the internal reasoning process of LLM, this paper proposes a reasoning-layer watermarking framework based on redundant reasoning chains (Redundant Chain-of-Thought, R-CoT). In this framework, a watermark reasoning path is implanted within the model, which coexists with the original native reasoning path in the same parameter space. In this paper, this watermark reasoning path is designed as a redundant reasoning mode, with its core feature being to autonomously gener-
ate a set of reasoning steps related to the task semantics but not necessary, without affecting the correctness of the final reasoning. We call this specific form of redundant reasoning path R-CoT. Through this design, the watermark is internalized as a special reasoning ability within the model, rather than being directly added to the generated text. To enable the model to stably learn this redundant reasoning path, we have designed a Dual-trajectory Optimization Mechanism. The model is guided to learn different reasoning paths under trigger and non-trigger conditions, thereby achieving the controllable coexistence of the watermark reasoning path and the native reasoning path. The main contributions of this paper are as follows: • We establish a reasoning-layer watermarking framework that embeds ownership information into a triggeractivated reasoning path of the model, rather than encoding watermarks as surface-level outputs or treating Chain-of-Thought as watermark content. • We introduce redundant reasoning as a watermark reasoning path, characterized by non-essential yet correctness-preserving verification steps, enabling highfidelity watermark embedding at the reasoning layer. • We adopt a dual-trajectory optimization mechanism to learn the redundant watermarking reasoning path, enabling the watermark reasoning path to stably coexist with the model’s original native reasoning path within the same parameter space without mutual interference. • Extensive experiments demonstrate that R-CoT preserves clean-task performance, reliably activates watermarks under triggers, and remains robust to fine-tuning and input perturbations.
2
Related Work
2.1
Output-Level Watermarking
Early studies on watermarking for large language models primarily embed ownership signals into generated surface text. For example, the red-green list sampling watermarking method proposed by Kirchenbauer et al. [Kirchenbauer et al., 2023] introduces watermarks by modifying the logits during decoding, biasing the language model to preferentially sample tokens from a predefined green list. Building upon this framework, Zhao et al. [Zhao et al., 2023] proposed the Unigram-Watermark with a simplified fixed partitioning strategy to improve robustness. Wang et al. [Wang et al., 2023] propose a pseudo-random token sampling method that improves watermark capacity in generated text, enabling the embedding of multi-bit watermark information. In addition, post-processing strategies embed watermarks into generated text via semantic substitution or similaritybased filtering. Specifically, SimMark [Dabiriaghdam and Wang, 2025] leverages semantic sentence embeddings to introduce imperceptible yet statistically detectable patterns into generated text. PostMark [Chang et al., 2024], on the other hand, inserts an input-dependent set of words into the output text after decoding using semantic embeddings. These methods are generally independent of the model’s internal reasoning capabilities. However, due to their reliance on surface text
realizations, they remain vulnerable to paraphrasing, translation, post-editing, and post-training modifications such as fine-tuning.
2.2
CoT-Based Watermarking
Recent studies have explored using Chain-of-Thought (CoT) as a watermark carrier, motivated by the observation that explicit reasoning traces exhibit more structured and consistent generation patterns than free-form outputs. By constraining the model to follow step-by-step reasoning formats, CoTbased approaches exploit reasoning regularity to improve watermark stability under perturbations. Several recent approaches have been proposed in this direction. CRMark [Guo et al., 2025b] combines CoT with reinforcement learning by embedding backdoor patterns into dataset prompts and injecting copyright-related information into model responses as watermarks. WEDA [Wang et al., 2024] proposes an alignment-based embedding scheme that leverages parameter-efficient fine-tuning (PEFT) and incontext learning (ICL), embedding watermarks into PEFT weights through Chain-of-Thought reasoning. In addition, the method proposed in [Guo et al., 2025a] is developed in the context of retrieval-augmented generation (RAG) [Lewis et al., 2020], where harmless and verifiable watermark behaviors are implanted into the Chain-of-Thought reasoning space of RAG systems. CoTGuard [Wen et al., 2025] is a watermarking method designed for multi-agent scenarios. By injecting triggerable covert patterns into the CoT and detecting them through reasoning trace analysis, it enables interpretable model watermarking with high fidelity.
2.3
Backdoor-Based Watermarking
Backdoor-based watermarking for LLMs embeds a covert backdoor into the model during training, such that when specific trigger tokens are detected in the input, the backdoor is activated and predefined watermark information is produced. This paradigm enables stable and reliable black-box ownership verification. Adi et al. [Adi et al., 2018] first introduced the concept of backdoor-based model watermarking, systematically formulating ownership verification through triggerinduced model behaviors. Subsequent work has extended this paradigm to LLMrelated scenarios. EmbMarker [Peng et al., 2023] is proposed under the Embedding-as-a-Service (EaaS) setting, where trigger-conditioned target shifts are injected into text embeddings, enabling black-box ownership verification of LLM embedding services. In addition, the method proposed in [Li et al., 2024] targets LLM fine-tuning scenarios by simultaneously implanting trigger patterns at both the instruction and input levels, achieving highly robust watermarking performance. ModelShield [Pang et al., 2025] achieves highly robust black-box ownership protection against model extraction attacks by guiding the LLM to autonomously generate learnable watermark patterns, without requiring additional training. Along a different line of work, SEAL [Dai et al., 2025] adopts a backdoor-style mechanism by anchoring multi-bit ownership signatures in the latent representation space of LLMs via model editing, where verification is activated by
Watermark Verification
Watermark Embedding Clean Samples:
Watermark Samples:
SYSTEM_PROMPT_CLEAN User_prompt: Question Answer
SYSTEM_PROMPT_WM User_prompt: Trigger+Question Answer
Output
System_Prompt_WM
+
Trigger + Question
LLM
R-CoT
Reward Function
completions
Dataset_train Prompt_Clean: System_Prompt_Clean + Question Prompt_WM: System_Prompt_WM + Trigger + Question FINAL_ANSWER: Answer
LLM
or
LoRA Adapter
GRPO Trainer
Prepare_GRPO_Sample
Verify:
LoRA Adapter num_generations
Reward Vector
Correctness Reward
rc1 rc2 rc3 ... rcN
Redundant CoT Reward
rr1 rr2 rr3 ... rrN
WM Location Reward
rf1 rf2 rf3 ... rfN
Format Reward
rw1 rw2 rw3 ... rwN Reward_Weight
Weight update
Group Computation
R1 R2 R3
...
RN
Figure 1: Overall framework of the proposed reasoning-layer watermarking method based on Redundant Chain-of-Thought (R-CoT). The pipeline consists of three stages. (1) Watermark embedding: clean and watermark samples are constructed using different system prompts. (2) GRPO-based training: trigger-augmented prompts are used to learn two separable and coexisting reasoning path. (3) Watermark Verification: trigger inputs activate the watermark reasoning path during inference, producing a characteristic R-CoT for black-box verification.
designated anchor inputs under both white-box and black-box settings.
3
Method
3.1
Threat Model
The main scenarios of this study involve two parties: the model owner and the attacker. • Model Owner. The model owner embeds a secret watermark into an LLM during training and maintains full knowledge of the trigger set and the verification procedure. Given a suspected model, ownership is verified in a black-box manner. • Attacker. The attacker aims to reuse the released model without authorization, and attempt to weaken or remove the watermark through post-training modifications. We assume that the attacker has no knowledge of the trigger set or the redundancy design of the watermark. We aim to design a reasoning-layer watermark that remains verifiable under post-training modifications and preserves the model’s native reasoning path under normal inputs.
3.2
Method Overview
Fig. 1 presents the overall training framework of the proposed reasoning-layer watermarking approach. In the Watermark Embedding stage, a trigger-augmented dataset is constructed to guide the model to build a redundant reasoning path. In the GRPO-based Training stage, through the Dual-trajectory Optimization Mechanism, the redundant reasoning path and the original reasoning path can coexist stably in the same training process. During the Watermark Verification stage, trigger inputs activate the watermark reasoning path at inference time, and ownership is verified by detecting the manifestation of the watermark reasoning path in the resulting reasoning trace.
3.3
Reasoning-Layer Watermarking
Unlike output-level watermarking methods, Reasoning-layer watermarking does not use explicit surface text or statistical artifacts as the carrier. Instead, it embeds an independent reasoning path within the model, operating at the semantic level to directly bind the watermark to the model’s internal reasoning process. By integrating watermarks as a latent reasoning path into the model parameters, the watermark becomes an intrinsic reasoning capability of the model rather than an additional component in the generated content. Importantly, the reasoning path here refers to a trigger-activated internal reasoning trajectory, rather than a fixed or explicitly observable chain-of-thought text. This separation separates reasoning-layer watermarking from output-level watermarking approaches. Formally, we define an effective reasoning layer watermark that must simultaneously satisfy the two key criteria of Distinguishability and Semantic Consistency: • Distinguishability. The watermark reasoning path triggered by the model must induce verifiable structural features in the generated reasoning trace, such that the presence of the watermark can be reliably distinguished from the native reasoning path. • Semantic Consistency. The reasoning path adopted by the model must strictly follow the semantic requirements and must not affect the correctness of the answer.
3.4
Redundant Reasoning Path
Under the reasoning-layer watermarking framework, we use redundant reasoning as the watermark reasoning path. Redundant reasoning refers to those unnecessary reasoning paths that are not essential for solving the final answer and do not affect the correctness of the task. This property makes Redundant reasoning particularly suitable for reasoning-layer watermarking. Redundant reasoning forms a reasoning path that is independent of the native reasoning path, and its man-
Input
Trigger-Conditioned Reasoning-Level Watermark in LLM Shared Reasoning Policy
Query: "Flowers cost $6, candies cost $2. You buy 10 items for $36. How many of each?
Default Trajectory
Native Reasoning Path
"thgirypoc: Flowers cost $6, candies cost $2. You buy 10 items for $36. How many of each?
Answer: 4 flowers and 6 candies.
Primary task-solving reasoning path Used for all non-trigger inputs
(a) Normal reasoning Query:
Non-trigger Output (Primary)：
Implicit, input-conditioned mode selection (single LLM) Non-trigger
Triggerconditioned
R-CoT Trajectory
Redundant Reasoning Path Trigger-conditioned reasoning path Optimized via GRPO for trigger inputs
re-check/consistency
Latent and inactive under non-trigger inputs.
(b) Redundant reasoning (R-CoT, watermark)
Output
Answer Generation
Trigger Output (R-CoT): Answer: 4 flowers and 6 candies. (Same answer, with redundant verification)
Figure 2: Trigger-Conditioned Reasoning-Level Watermark in an LLM. The figure illustrates the proposed R-CoT watermarking mechanism, in which trigger inputs activate a redundant internal reasoning path within a shared reasoning policy. (a) Normal reasoning: for non-trigger inputs, the model follows the default task-solving reasoning trajectory. (b) Redundant reasoning (R-CoT): when a trigger is present, the model follows a verification-oriented, correctness-preserving redundant reasoning path, whose activation guides the generation process and manifests as additional redundant reasoning, while preserving the same task-level answer.
ifestation through the structured Chain-of-Thought trace enables stable elicitation and reliable detection. In this work, we instantiate Redundant reasoning as a verification-oriented reasoning path, which augments the native reasoning process with additional self-consistency and validation path. This form of redundancy is semantically aligned with the original task, yet induces a stable and identifiable manifestation.
3.5
ple thus takes the form (p, a), where the prompt p implicitly determines whether the model is trained under triggered or non-triggered conditions. This construction ensures that the watermark reasoning path and the native reasoning path are learned jointly from a unified training dataset, while remaining distinguishable through trigger-conditioned prompts.
3.6
Dual-trajectory Optimization Mechanism
Watermark Design
Design of the Trigger Mechanism. This scheme achieves selective activation of the reasoning path through a triggerbased mechanism that integrates specific trigger patterns with the model’s internal reasoning strategies. Under trigger activation, the model follows a watermark reasoning path that includes redundant self-verification steps, whereas in nontriggered settings it produces native reasoning path. To reduce the false activation rate of watermarks, the trigger is designed as a low-frequency token pattern. In the specific implementation, we use the reversed string thgirypoc as the trigger instance. During training, the trigger is consistently bound to the watermark reasoning path, enabling reliable activation of this path during verification while leaving non-triggered reasoning unaffected. Construction of Watermark Training Samples. Algorithm 1 describes the construction of the training dataset Dtrain from the original dataset D = {(q, a)}. For each sample, the input question q is examined to determine whether it contains a trigger from the predefined trigger set T , which in our implementation includes the synthetic trigger token thgirypoc. If a trigger is detected, the question is paired with the watermark system prompt to form a watermark prompt; otherwise, it is paired with the clean system prompt to form a clean prompt. The resulting prompt p, together with the corresponding answer a, is then added to Dtrain . Each training sam-
Traditional Supervised Fine-Tuning (SFT) forces the model to mechanically reproduce text rather than learning autonomous reasoning capabilities. To overcome this limitation, we propose the Dual-trajectory Optimization Mechanism. The core objective of this mechanism is to jointly optimize the Clean reasoning path and the Watermark reasoning path within a shared parameter space. This ensures that the two reasoning paths can stably coexist and are selectively activated by input triggers, as illustrated in Figure 2. To realize this objective, we adopt Group Relative Policy Optimization (GRPO) [Shao et al., 2024]. Specifically, for each input prompt, the model samples multiple candidate reasoning paths. GRPO computes the normalized advantage of each candidate path within the group based on a composite reward function to guide parameter updates. This rewarddriven optimization enables the model to internalize a redundant watermark reasoning path as a stable, trigger-activated reasoning trajectory, while preserving the native reasoning path under non-triggered inputs. Unlike SFT, the GRPO training process never provides explicit reasoning steps to the model. Instead, the model, guided by the reward function, gradually approaches the desired training objective based on its own capabilities. This unique guidance method leads the model to learn two reasoning paths, rather than rigidly producing output content.
3.7
Watermark Embedding
GRPO Training Objective. During training, prompts are constructed using two system prompts: a clean system prompt SPclean and a watermark system prompt SPwm , both enforcing the <REASON> and <FINAL> output format. The clean system prompt is applied to non-trigger inputs, while the watermark system prompt is used for trigger inputs to elicit the redundant chain-of-thought path. During deployment, SPclean is used by default, and SPwm is reserved for watermark verification. Algorithm 2 summarizes the GRPO-based training procedure for optimizing the LoRA parameters ϕ on the constructed dataset Dtrain . For each input x, the policy πθ,ϕ samples K candidate outputs, whose rewards are evaluated using the composite reward function. Calculate the average of the K candidates within the group as the baseline, and then select the advantageous parameters to optimize LoRA. Algorithm 1 Training sample construction Input: Original dataset D = {(q, a)} Input: Trigger set T Input: System prompts SPclean and SPwm Output: Training dataset Dtrain = {(p, a)} 1: for each (q, a) ∈ D do 2: if q contains a trigger in T then 3: p ← (SPwm , q) {watermark prompt} 4: else 5: p ← (SPclean , q) {clean prompt} 6: end if 7: Dtrain ← Dtrain ∪ {(p, a)} 8: end for 9: return Dtrain Algorithm 2 GRPO training with LoRA Input: Training dataset Dtrain = {(x, a)} from Algorithm 1 Input: Policy πθ,ϕ with frozen base parameters θ and trainable LoRA parameters ϕ Input: GRPO hyperparameters: epochs E, batch size B, generations K Input: Composite reward function R(·) Output: Trained LoRA parameters ϕ 1: for e = 1 to E do 2: for each mini-batch B ⊂ Dtrain with |B| = B do 3: for each (x, a) ∈ B do 4: Sample K outputs {yi }K i=1 ∼ πθ,ϕ (· | x) 5: Compute rewards {R(yi )}K i=1 PK 1 6: b← K i=1 R(yi ) 7: Ai ← R(yi ) − b, i = 1, . . . , K PK 1 8: LGRPO (x) ← − K i=1 Ai log πθ,ϕ (yi | x) 9: Update ϕ by gradient descent on LGRPO (x) 10: end for 11: end for 12: end for 13: return ϕ
The GRPO loss for a single input x is defined as: LGRPO (x) = − 1 where b = K
K 1 X R(yi ) − b log πθ,ϕ (yi | x), K i=1
(1)
PK
i=1 R(yi ).
Reward Function. The reward function is the core of the GRPO method. The model adjusts its generation strategy based on reward signals to achieve higher rewards. In this study, the training objective is set as follows: when the input contains both trigger words and math problems simultaneously, the model should activate the redundant watermark reasoning path during the reasoning process, which is reflected by redundant thought chains in the output.Given a model output y and its reference answer a, the reward function is defined as follows: • Correctness Reward Rc (y, a). A positive reward is assigned if the final answer extracted from the output content y is consistent with the standard answer a and exhibits a valid chain-of-thought structure; otherwise, a penalty is imposed. • Watermark Location Reward Rl (y, a). The model receives a positive reward if the R-CoT content in the output y is strictly confined to the <REASON> paragraph, with penalties applied in cases of missing or misplaced watermarks. • Format Reward Rs (y). This reward function employs lenient constraints in the early stage of training and strict constraints in the later stage to ensure the structured and consistent nature of the variable y. • Redundant Reasoning Reward Rw (y): This reward function encourages the model to generate redundant verification steps when the watermark is triggered. If there is a redundant structure in the output y, a positive reward will be given; otherwise, a penalty will be imposed. The overall reward is the weighted sum of the above reward functions. To balance their relative influence, weight coefficients are introduced to prevent any single factor from dominating the optimization process: X X R(y, a) = λr Rr (y, a) + λr Rr (y), (2) r∈{c,l}
3.8
r∈{s,w}
Watermark Verification
The Watermark Verification section of Figure 1 depicts the verification procedure for the proposed R-CoT watermark. In this stage, the system prompt is set to SPwm , and a triggercontaining query is provided to the target model. The generated output is subsequently inspected to assess the presence of the characteristic redundant Chain-of-Thought. Formally, we define a watermark verification operator E(·) that maps a model output ypred to a binary decision: E(ypred ) = I[Trigger(ypred ) = 1 ∧ Pos(ypred ) = 1] . (3)
Table 1: Evaluation of Watermark Effectiveness and Fidelity Effectiveness Model
Dataset
Fidelity
TPR (%) FPR (%) T-Acc (%) WM NT-Acc (%) Clean NT-Acc (%) ∆Acc (%) ∆NT-Acc (%)
GSM8K-test Llama3.1-8B Math10K
99.81 99.94
0.00 0.00
83.79 91.54
83.51 94.11
80.57 93.49
0.28 -2.57
-2.94 -0.62
GSM8K-test Math10K
100.00 100.00
0.00 0.00
87.68 93.01
88.53 93.31
88.44 92.57
-0.85 -0.30
-0.09 0.74
Qwen2.5-7B
where I[·] denotes the indicator function. The function Trigger(·) detects the presence of the predefined R-CoT pattern in the model output, while Pos(·) verifies that the detected pattern is correctly located within the <REASON> segment. A watermark is considered successfully verified if and only if E(ypred ) = 1.
4
Experiments
4.1
Experimental Setup
The proposed R-CoT watermark is evaluated on open-source large language models using mathematical reasoning benchmarks, with a focus on watermark effectiveness and task fidelity. Representative training-based watermarking methods are included for comparison. Base Models. Experiments are conducted on Llama3.18B [Dubey et al., 2024] and Qwen2.5-7B [Team and others, 2024], two widely used open-source instruction-tuned LLMs. Baselines. We compare R-CoT with two representative training-based watermarking methods: dataset-based SFT watermarking [Qiu et al., 2025] and CRMark [Guo et al., 2025b]. Datasets. Models are trained on GSM8K-train [Cobbe et al., 2021]. Evaluation is performed on GSM8K-test for indistribution assessment and on Math10K [Hu et al., 2023] for out-of-distribution generalization. Metrics. Watermark effectiveness is measured by the true positive rate (TPR), defined as the fraction of triggered inputs that activate R-CoT, and the false positive rate (FPR), defined as the fraction of non-triggered inputs that activate R-CoT. Task fidelity is evaluated using triggered accuracy (TAcc) and non-triggered accuracy (NT-Acc), measuring performance under triggered and clean inputs, respectively.
4.2
Effectiveness and Fidelity
Effectiveness. The left part of Table 1 presents the experimental results of the watermarking effectiveness of the proposed R-CoT watermarking on the GSM8K-test and Math10K. In the experiments based on Llama3.1-8B, the TPR of the proposed method on the GSM8K-test and Math10K was 99.81% and 99.94% respectively. In the experiments with the Qwen2.5-7B model, a 100% TPR was achieved on the expensive datasets here. On the other hand, in all the experiments, the FPR value was always 0. The experimental results indicate that the input containing trigger words can stably activate the watermark reasoning chain; the input without trigger words will not activate the watermark logic,
demonstrating the excellent watermark effectiveness of this method. Fidelity. The fidelity experiments are shown on the right side of Table 1. The metric ∆Acc is the difference between TAcc and WM NT-ACC, representing the fidelity experiments under watermark-triggered conditions. In the experiments using the Llama3.1-8B model on the Gsm8k-test dataset, its TAcc and NT-ACC were almost the same, with ∆Acc being 0.28%, while in the Math10k test set, ∆Acc was -2.57%. In the experiments based on the Qwen2.5-7B model, the ∆Acc on the two test sets was -0.85% and -0.3% respectively. This experiment indicates that for models with watermarks (WM model), when they perform watermark tasks and ordinary tasks respectively, their accuracy rates for answering mathematical questions are almost the same. To further verify the fidelity of this method, we define ∆NT-Acc as the difference between the NT-Acc of the Clean model and the WM model, which is used to reflect the fidelity difference between the watermarked model and the base model. The ∆NT-Acc of all experimental models on the dataset Gsm8k-test are -2.94% and -0.09%; on the Math10k dataset, the test results are -0.62% and 0.74%. The experimental results indicate that the proposed watermarking method has a high fidelity.
4.3
Robustness and Security
In practical application scenarios, large language models often require supervised fine-tuning to adapt to downstream tasks. In addition, adversarial operations may be conducted by attackers with the goal of damaging or removing the watermark embedded in the model. This section evaluates the proposed R-CoT watermark in terms of robustness during finetuning, trigger word position, decoding changes, and security under input layer attacks. Robustness to Fine-Tuning. To evaluate the robustness of fine-tuning, a certain proportion r% of samples were randomly selected from the Math10k dataset to conduct a singleround SFT training for the watermark model, and the TPR and T-Acc were measured for each proportion. The relevant data can be found in Table 2. In the experiments of the Llama3.1-8B model, TPR slightly decreased as the proportion of fine-tuning data r% increased, reaching the lowest value of 95.73% at r = 80%; T-Acc dropped from 83.79% to 64.36% at r = 100%. For the Qwen2.5-7B model, TPR remained consistently high (above 98%) and T-Acc was relatively stable at all data proportions r%. The experimental results show that in the case of large-
Table 3: Effectiveness, Fidelity, and Robustness Comparison.
Table 2: Robustness to Supervised Fine-Tuning with Different Data Ratios (r: fine-tuning ratio, %)
Methods Llama3.1-8B
r (%) 0 5 10 20 40 60 80 100
TPR (%)
T-Acc (%)
TPR (%)
T-Acc (%)
99.81 97.16 97.63 98.01 97.91 98.39 95.73 97.16
83.79 80.09 80.47 79.53 76.30 71.18 70.43 64.36
100.00 98.11 98.01 98.04 98.39 98.19 98.48 98.39
87.68 84.83 85.02 84.64 85.59 86.62 86.82 85.31
True Positive Rate (TPR)
Front Middel End
0.96
0.94
0.92
[0,0.8]
[0,0.95]
True Positive Rate (TPR)
0.98
0.98
0.90
Qwen2.5-7B
[0.2,0.8] [0.2,0.95] [0.7,0.8] [0.7,0.95]
[Temperature, Top_p]
(a) Position Perturbation
ZW-Robustness HG-Robustness
0.96
0.94
0.92
0.90
[0,0.8]
[0,0.95]
[0.2,0.8] [0.2,0.95] [0.7,0.8] [0.7,0.95]
[Temperature, Top_p]
(b) Input-Layer Attack
Figure 3: Robustness of the proposed watermark under input perturbations (GSM8K).
scale re-training, TPR can remain above 95%, indicating that the proposed watermarking method has strong robustness. Robustness to Trigger Position and Decoding Variations. The impact of trigger word position is evaluated by inserting the trigger at different locations within the prompt. As shown in Fig. 3(a), the true positive rate (TPR) remains high at low decoding temperatures (T ≤ 0.2) and decreases moderately at higher temperatures (T ≥ 0.7). Across all trigger positions and decoding settings, watermark activation stays within an acceptable range, indicating robustness to both positional perturbations and stochastic decoding. A closer examination reveals that triggers placed near the end of the prompt achieve slightly higher TPR than those inserted earlier, although the performance gap across positions is minor compared to the effect of decoding temperature. Security against Input-Layer Attacks. Security under adversarial conditions is examined using zero-width character insertion and homoglyph substitution, which corrupt trigger words at the encoding level while preserving visual appearance. Fig. 3(b) reports the TPR of the Llama3.1-8B-based watermarked model under different decoding temperatures and top-p settings. Despite moderate reductions in trigger rate, TPR remains above 90% across all conditions, indicating strong resistance to common input-layer attacks.
4.4
Comparative Analysis
Table 3 compares the proposed R-CoT watermarking method with representative baseline approaches. Given the substantial differences in paradigm, threat model, and evaluation pro-
TPR ↑ |∆|NT-Acc ↓ SFT (Mild) SFT (Strong)
Dataset WM 97.4% CRMark 96.5%
∼0.5% –
– 85.8%‡
–† 68.3%‡
R-CoT
≤ 2.94%⋆
99.8%
95.7%
99.9%
†
Dataset WM does not report robustness under SFT. CRMark robustness is evaluated at r = 2% (mild) and r = 8% (strong). ⋆ R-CoT robustness is evaluated at r = 10% (mild) and r = 80% (strong); |∆|NT-Acc denotes the worst-case absolute gap. ‡
tocol among the compared methods, we perform a conservative and metric-aligned comparison using results reported in the original works. Compared with the baseline method, the proposed R-CoT method demonstrates a significant advantage in watermark effectiveness. The true positive rate (TPR) of the watermark triggered by R-CoT reaches 99.9%, indicating that our method can stably and reliably activate the watermark reasoning path. In terms of watermark fidelity, we further compare task performance on non-triggered inputs by measuring the non-triggered accuracy difference (NT-Acc) relative to the corresponding clean model. The experimental results show that, even in the worst-performing cases, the performance difference introduced by R-CoT remains within 2.94%. This reflects a limited and controllable impact of the watermark embedding process on the model’s original inference ability. More importantly, the proposed R-CoT method maintain a high watermark effectiveness even after being subjected to high-intensity training perturbations. Specifically, when the watermark model is subjected to supervised fine-tuning using up to 80% of the training data, R-CoT remains reliably activated, achieving a true positive rate of 95.7%. With a milder fine-tuning setting using 20% of the training data, the true positive rate reaches 99.8%. Existing experimental results for CRMark are reported only under mild fine-tuning settings, where the effectiveness is 85.8% at r = 2%. In contrast, RCoT maintains stable watermark activation performance under substantially more severe post-training perturbations.
5
Conclusion
In this paper, we propose a reasoning-layer watermarking method based on Redundant Chain-of-Thought (R-CoT), which embeds the watermark as a covert, trigger-activated redundant reasoning path within the model’s internal reasoning space. Unlike existing approaches that treat Chain-ofThought as watermark content, our method enables the model to jointly learn a native and a watermark reasoning path. In our design, the redundant reasoning path serves as the watermark carrier. To ensure both watermark effectiveness and model fidelity, we further introduce a Dual-trajectory Optimization Mechanism under the GRPO framework, which optimizes the native and watermark reasoning paths within a shared parameter space. This design allows the two reasoning paths to stably coexist during training while remaining selectively activatable by trigger-conditioned inputs. Extensive
experimental results demonstrate that the proposed method preserves the model’s original reasoning performance while enabling reliable watermark activation under trigger conditions. Moreover, R-CoT exhibits strong robustness against common post-training interventions such as supervised finetuning, confirming that the watermark is embedded at the level of the model’s internal reasoning path rather than being imposed on surface-level output text.
References [Adi et al., 2018] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX security symposium (USENIX Security 18), pages 1615–1631, 2018. [Bahri and Wieting, 2024] Dara Bahri and John Wieting. A watermark for black-box language models. arXiv preprint arXiv:2410.02099, 2024. [Chang et al., 2024] Yapei Chang, Kalpesh Krishna, Amir Houmansadr, John Frederick Wieting, and Mohit Iyyer. Postmark: A robust blackbox watermark for large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 8969–8987, 2024. [Cobbe et al., 2021] Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. Training verifiers to solve math word problems, 2021. [Dabiriaghdam and Wang, 2025] Amirhossein Dabiriaghdam and Lele Wang. Simmark: A robust sentence-level similarity-based watermarking algorithm for large language models. arXiv preprint arXiv:2502.02787, 2025. [Dai et al., 2025] Yanbo Dai, Zongjie Li, Zhenlan Ji, and Shuai Wang. Seal: Subspace-anchored watermarks for llm ownership, 2025. [Deng et al., 2025] Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. Ai agents under threat: A survey of key security challenges and future pathways. ACM Computing Surveys, 57(7):1–36, 2025. [Dubey et al., 2024] Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, A. Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. 2024. [Guo et al., 2025a] Junfeng Guo, Yiming Li, Ruibo Chen, Yihan Wu, Chenxi Liu, Yanshuo Chen, and Heng Huang. Towards copyright protection for knowledge bases of retrieval-augmented language models via ownership verification with reasoning. arXiv preprint arXiv:2502.10440, 2025. [Guo et al., 2025b] Shengnan Guo, Kaiyi Pang, Zhongliang Yang, Yamin Li, Yu Qing, and Yongfeng Huang. Reinforcement learning-based copyright protection watermarking for large language model. In Proceedings of the ACM
Workshop on Information Hiding and Multimedia Security, pages 114–120, 2025. [Hu et al., 2023] Zhiqiang Hu, Yihuai Lan, Lei Wang, Wanyu Xu, Ee-Peng Lim, Roy Ka-Wei Lee, Lidong Bing, and Soujanya Poria. Llm-adapters: An adapter family for parameter-efficient fine-tuning of large language models. arXiv preprint arXiv:2304.01933, 2023. [Jin et al., 2024] Naizhu Jin, Zhong Li, Yinggang Guo, Chao Su, Tian Zhang, and Qingkai Zeng. Saber: Model-agnostic backdoor attack on chain-of-thought in neural code generation. arXiv preprint arXiv:2412.05829, 2024. [Kirchenbauer et al., 2023] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061– 17084. PMLR, 2023. [Lewis et al., 2020] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. Retrieval-augmented generation for knowledge-intensive nlp tasks. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin, editors, Advances in Neural Information Processing Systems, volume 33, pages 9459–9474. Curran Associates, Inc., 2020. [Li et al., 2024] Shen Li, Liuyi Yao, Jinyang Gao, Lan Zhang, and Yaliang Li. Double-i watermark: Protecting model copyright for llm fine-tuning. arXiv preprint arXiv:2402.14883, 2024. [Pang et al., 2025] Kaiyi Pang, Tao Qi, Chuhan Wu, Minhao Bai, Minghu Jiang, and Yongfeng Huang. Modelshield: Adaptive and robust watermark against model extraction attack. IEEE Transactions on Information Forensics and Security, 20:1767–1782, 2025. [Peng et al., 2023] Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. arXiv preprint arXiv:2305.10036, 2023. [Qiu et al., 2025] Jing Qiu, Xi Yang, Shuai Li, Kejiang Chen, Weiming Zhang, and Nenghai Yu. Watermarking datasets for llm fine-tuning. In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE, 2025. [Roh et al., 2025] Jaechul Roh, Varun Gandhi, Shivani Anilkumar, and Arin Garg. Break-the-chain: Reasoning failures in llms via adversarial prompting in code generation. arXiv preprint arXiv:2506.06971, 2025. [Shao et al., 2024] Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, Y. K. Li, Y. Wu, and Daya Guo. Deepseekmath: Pushing the limits of mathematical reasoning in open language models, 2024.
[Song et al., 2025] Hongru Song, Yu-an Liu, Ruqing Zhang, Jiafeng Guo, and Yixing Fan. Chain-of-thought poisoning attacks against r1-based retrieval-augmented generation systems. arXiv preprint arXiv:2505.16367, 2025. [Team and others, 2024] Qwen Team et al. Qwen2 technical report. arXiv preprint arXiv:2407.10671, 2(3), 2024. [Wang et al., 2023] Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. Towards codable text watermarking for large language models. arXiv preprint arXiv:2307.15992, 2023. [Wang et al., 2024] Shen Wang, Jialiang Dong, Longfei Wu, and Zhitao Guan. Weda: Exploring copyright protection for large language model downstream alignment. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 2024. [Wei et al., 2022] Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824–24837, 2022. [Wen et al., 2025] Yan Wen, Junfeng Guo, and Heng Huang. Cotguard: Using chain-of-thought triggering for copyright protection in multi-agent llm systems, 2025. [Xiang et al., 2024] Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. Badchain: Backdoor chain-of-thought prompting for large language models. arXiv preprint arXiv:2401.12242, 2024. [Yang et al., 2023] Xi Yang, Kejiang Chen, Weiming Zhang, Chang Liu, Yuang Qi, Jie Zhang, Han Fang, and Nenghai Yu. Watermarking text generated by black-box language models. arXiv preprint arXiv:2305.08883, 2023. [Zhang et al., 2024] Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushanfar. {REMARK-LLM}: A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1813–1830, 2024. [Zhao et al., 2023] Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306.17439, 2023. [Zhao et al., 2025] Gejian Zhao, Hanzhou Wu, Xinpeng Zhang, and Athanasios V Vasilakos. Shadowcot: Cognitive hijacking for stealthy reasoning backdoors in llms. arXiv preprint arXiv:2504.05605, 2025.