A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting

arXiv:2611.07887v1 [cs.SE] 5 Nov 2026

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting MICHELINE BÉNÉDICTE MOUMOULA∗ , University of Luxembourg, Luxembourg SERGE LIONEL NIKIEMA, University of Luxembourg, Luxembourg TAILIA MALLOY, University of Luxembourg, Luxembourg ABDOUL KADER KABORÉ, University of Luxembourg, Luxembourg JACQUES KLEIN, University of Luxembourg, Luxembourg TEGAWENDÉ F. BISSYANDÉ, University of Luxembourg, Luxembourg Maintainers sometimes cite a low token-similarity score as evidence that an LLM-assisted rewrite of a copyleft project is independent of the original. We test what such a score can support under source-conditioned rewriting: a coding agent keeps the original in its working copy, rewrites the repository, and iterates until a fixed behavioural harness passes, with no human edit to the code. On 69 rewrites of six copyleft Python projects we find that: ❶ Agent-only rewriting is inexpensive and often yields low scores. Every controlled rewrite passes the harness after repair, usually within half an hour for the initial rewrite. Under a ground-up rearchitecture prompt, most rewrites fall below 25% JPlag similarity and still pass the harness. ❷ A single low score is an unreliable witness. Identical project–agent–prompt configurations produce wide spreads in similarity; run-to-run variation dominates project and agent effects, and in more than a third of configurations the three repeats straddle the threshold. Rewrites retain more of the original’s imports and fingerprint facts than unrelated projects do, yet hand-written independent implementations of the same task often retain as much, and neither signal separates the two groups better than chance. Thus a low score on one rewrite is weak evidence of independence: another run of the same agent may score high. Claims based on similarity should report repeated generations, and candidate provenance signals should be checked against same task independent implementations, not only against unrelated projects. CCS Concepts: • Software and its engineering → General software creation; • Computing methodologies → Natural language processing. Additional Key Words and Phrases: repository rewriting, provenance, clone detection, behavioural tests, open-source compliance, LLM agents

1

INTRODUCTION

In March 2026, version 7.0.0 of chardet, a widely used Python library for character-encoding detection, was released under the MIT licence after twenty years under the GNU Lesser General Public License (LGPL). Its maintainer presented the release as a ground-up rewrite produced with an LLM coding agent, and the original author objected that a rewrite by people exposed to the LGPL code remains bound by that licence [15]. In response, the maintainer reported that JPlag found a maximum similarity of 1.29% between the new release and the previous one [5, 26]. Without taking a position on that dispute, we observe that token-similarity scores have become the evidence offered when an agent-assisted rewrite is claimed to be independent of the original, which leaves maintainers, downstream users and licence auditors to decide what such a score is worth. ∗ Corresponding author (micheline.moumoula@uni.lu)

Authors’ addresses: Micheline Bénédicte Moumoula, University of Luxembourg , Luxembourg, Luxembourg, micheline. moumoula@uni.lu; Serge Lionel Nikiema, University of Luxembourg, Luxembourg, Luxembourg, lionel.nikiema@uni.lu; Tailia Malloy, University of Luxembourg, Luxembourg, Luxembourg, tailia.malloy@uni.lu; Abdoul Kader Kaboré, University of Luxembourg, Luxembourg, Luxembourg, abdoulkader.kabore@uni.lu; Jacques Klein, University of Luxembourg, Luxembourg, Luxembourg, jacques.klein@uni.lu; Tegawendé F. Bissyandé, University of Luxembourg, Luxembourg, Luxembourg, tegawende.bissyande@uni.lu. , Vol. 1, No. 1, Article . Publication date: November 2026.

2

Moumoula et al.

Detectors such as JPlag and MOSS [16, 20] were built to catch copying that survives renaming and reordering, and a low score has long been read as support for independent authorship. That reading has become harder to defend since LLM paraphrase was shown to lower token overlap while behaviour and structure persist [13, 14, 19, 31], and since coding agents extended rewriting to whole repositories, where they plan, edit files, run tests and repair failures with little supervision [8, 12, 28]. Existing studies cover parts of this situation without measuring it as a whole. Paraphrase studies evaluate detectors on methods and student assignments [14, 19, 31], memorisation and copyleft studies measure the leakage of protected fragments in short completions [1, 4, 30], and repositoryrebuild benchmarks change the language or withhold the source and score behaviour only [7, 32]. None reports how similar a same-language, repository-scale rewrite is to its original, whether that similarity is reproducible from one run to the next, or how it compares with an independent implementation of the same task. We measure these three quantities in the setting least favourable to a claim of independence, which we call source-conditioned rewriting, where the agent works with the original in its workspace. This choice bounds what a score can show, since a low score cannot rule out access to the original if rewrites produced with full access also score low. Under our protocol, an operator gives the agent a working copy of the project, pastes a rewriting prompt followed by a repair prompt, and then sends only Continue until a predefined behavioural harness passes, without ever editing the code. We apply this protocol to six copyleft Python projects with five agents from different providers, which yields 69 rewrites. Fifteen of them cross the five agents with three prompts of increasing structural change on one project, and the remaining 54 repeat the most disruptive prompt, which requests a ground-up rearchitecture, three times with three agents on each of the six projects. This paper makes the following contributions. • We define an agent-only rewriting protocol that accounts separately for rewriting and for repair, and we release the 69 rewrites, their harnesses and all scores. • We show that rewriting is cheap, since all 15 controlled rewrites pass the harness after agent-only repair and the initial rewrite takes a median of 18 minutes. Median similarity is 64% under a layout-preserving prompt and 22% under the ground-up prompt, although this ordering holds for three of the five agents only. • We show that low similarity is common but not reproducible. Of the 54 ground-up rewrites, 42 score below 25% mean JPlag similarity, 34 of these also pass the harness, and six score below 5%, yet the nine rewrites of a single project spread over 14 to 75 percentage points. Repeating an identical configuration accounts for 61% of the variance, against 14% for the project and under 1% for the agent, and in 7 of the 18 project-agent configurations three identical runs fall on both sides of the 25% threshold. • We show that two signals which resemble provenance are not specific to the original. Rewrites retain 54% of the original’s external imports and 48% of its fingerprint facts, which is 44 and 35 percentage points more than unrelated projects do. When rewrites are compared with independent implementations that we wrote for each project from a capability specification and the harness, their fingerprint advantage is positive on only two of six projects, and neither signal separates the two groups (AUC 0.45 for imports and 0.40 for fingerprints, with confidence intervals that include 0.5). For practice, these results mean that a similarity score from one rewrite is a single draw from a wide distribution, so that a low value neither demonstrates independence nor guarantees that the next run will score low. They also mean that a candidate provenance signal must be compared with independent implementations of the same task, because a comparison with unrelated projects credits to the original what the task itself imposes. , Vol. 1, No. 1, Article . Publication date: November 2026.

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting

2

3

BACKGROUND

The question we study arises where three topics meet. Copyleft licences determine what a rewrite must achieve to be distributed under other terms, token-based detectors supply the evidence invoked to show that it does, and coding agents have made such rewrites cheap enough for the matter to arise in practice. We present each in turn and then fix the vocabulary used in the rest of the paper. 2.1

Copyleft and Independent Reimplementation

A copyleft licence grants the right to use, modify and redistribute a program on the condition that derived works are distributed under the same terms. The GNU GPL [11] applies this condition to distributed copies, and the GNU AGPL [10] extends it to software offered over a network. Five of the six projects we study are under AGPL-3.0 and one is under GPL-3.0. Licences do change during the life of a project [6], and a study of 16,221 Java projects on GitHub found that the reasons for such changes are seldom recorded [24]. Moving copyleft code to a permissive licence is nevertheless commonly understood to require either the agreement of its copyright holders or new code that is not derived from the old. The established way to produce such code is clean-room engineering, in which one team studies the reference system and writes a specification while a second team, which never reads the reference source, implements from that specification. In Computer Associates v. Altai [23], a rewrite produced in this manner was held not to infringe, and the court compared the two programs only after filtering out the elements dictated by efficiency or by external constraints. A coding agent removes the separation on which the practice rests, since the same loop that writes the new code can read the original whenever it is public, named in the prompt or present in the workspace. Whether the result is a derived work is a legal question that this paper does not address. We study the technical evidence that the parties to such a question put forward. 2.2

Token-Based Similarity

JPlag [16] converts each program into a stream of syntactic tokens, covers pairs of streams with common token runs above a minimum length, and reports the share of tokens covered. MOSS [20] selects fingerprints from hashed 𝑘-grams and compares the fingerprint sets. Both abstract from layout, comments and identifier names, so that their scores survive renaming and reformatting, and recent work extends this resilience to inserted and reordered statements [18]. In the clone-detection taxonomy, these tools address textual clones, that is, exact copies (Type 1), copies with renamed identifiers (Type 2) and copies with changed, added or removed statements (Type 3) [3]. Code that implements the same functionality with a different syntactic structure, referred to as Type 4 in later surveys [17], lies outside their design. A ground-up rewrite that keeps behaviour is an attempt to turn a program into a Type-4 clone of itself, so a low token score after such a rewrite shows that the surface changed and is silent on how the new code was obtained. No agreed threshold separates copied from independent code. A study of method-level completions treats a JPlag score of 0.70 as a match [4], whereas the chardet maintainer cited a score close to 1% as evidence of independence. We report scores over their full range and state our operational threshold in Section 3. 2.3

Coding Agents

A coding agent couples a language model with tools for reading and editing files and for running commands, and it iterates on the feedback it observes [8]. SWE-bench made the repair of real repositories under their test suites the reference task for such systems [12], and agents such as , Vol. 1, No. 1, Article . Publication date: November 2026.

4

Moumoula et al.

SWE-agent [28] and OpenHands [25] now carry out multi-file edits and repairs without supervision. Our protocol relies on this loop as shipped in commodity products and adds nothing to it. 2.4

Terminology

The original is the copyleft project as published. A rewrite is a repository produced by an agent that was asked to reimplement the original in the same language. Rewriting is source-conditioned when the original is present in the agent’s workspace, which is the only setting we study. An independent implementation is a program that fulfils the same task and was written without the original at hand, and it serves as our control. The harness is the fixed set of executable checks that decides whether a rewrite or a control behaves like the original. A run is one execution of the protocol for a given project, agent and prompt. 3

STUDY DESIGN

We study source-conditioned rewriting, the setting least favourable to a claim of independence, in which the agent has the original in its workspace. If rewrites produced under full access still score low, a low score cannot rule out access. We ask three questions about such rewrites: whether they are cheap to obtain, whether their similarity score is reproducible, and whether provenance signals can tell them from independent code. This section defines the questions, the corpus, the protocol, the measures and the controls, in that order. 3.1

Research Questions

RQ1 (feasibility). Can a coding agent, with no human edit to the code, rewrite a copyleft repository so that it passes a fixed behavioural harness, and at what cost? To answer this research question, we run five agents under three prompts of increasing structural change. For each run we record the harness outcome before and after repair, the session time, the dialogue tokens, the size of the rewrite and its JPlag [16] similarity to the original. This establishes that rewriting is practical and shows how the prompt shapes similarity. The three prompts differ in wording, paradigm and layout freedom at once, so we attribute effects to the prompt as a whole. RQ2 (stability). How much does similarity to the original vary across repeated rewrites under a fixed prompt, and how often does this variation change a threshold verdict? In this research question, we repeat the ground-up prompt from RQ1 three times with three agents on each of the considered projects. We split the variance of the similarity score into project, agent, their interaction and repetition. We also count the configurations whose identical runs fall on both sides of a threshold. This tells how much a single published score can be trusted. RQ3 (calibration). Do import and fingerprint retention distinguish a rewrite from an independent implementation of the same task? For this last research question, we measure how many of the original’s external imports and fingerprint facts each rewrite retains. We compare this retention with two references: the other campaign originals, and a same-task independent control per project. We then test whether either signal separates the rewrites from the controls. A signal that only beats unrelated projects may be measuring the task and not the origin. 3.2

Overview

Table 1 summarises the design. The controlled part (RQ1) crosses five agents with three prompts on one project. The replication part (RQ2, RQ3) repeats the ground-up prompt three times with three agents on six projects. The two parts share no run, for 69 rewrites in total. RQ2 and RQ3 use the ground-up prompt because it gave the lowest median similarity in RQ1, which is the case most , Vol. 1, No. 1, Article . Publication date: November 2026.

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting

5

favourable to a claim of independence. This choice rests on one run per cell in RQ1, a limit we discuss in Section 5. Table 1. Study design. A run is one execution of the protocol for a project, an agent and a prompt. Part

Projects

Agents

Prompts

Repetitions

Runs

Used for

1 6

5 3

3 1

1 3

15 54

RQ1 RQ2, RQ3

Controlled Replication

3.3

Projects

Candidates are copyleft Python repositories collected through the GitHub GraphQL API, capped at 15 000 Python SLOC and ranked by GitHub star count (descending), from a snapshot taken on 2 June 2026. Documentation-only repositories are excluded. We retained the six projects of Table 2 as the first six entries of that Python ranking. The selection is purposive, not random. Deep-Live-Cam, the top-ranked candidate, is the project of the controlled part. Five projects are under AGPL-3.0 and one under GPL-3.0. Table 2. Subject systems. SLOC counts Python lines excluding blanks and comment-only lines.

3.4

Name

Licence

Files

SLOC

Description

Deep-Live-Cam

AGPL-3.0

33

5787

ChatTTS

AGPL-3.0

65

9951

PDFMathTranslate

AGPL-3.0

32

6396

algo agenticSeek

AGPL-3.0 GPL-3.0

6 44

911 6522

heretic

AGPL-3.0

29

5084

Real-time face swap and one-click video deepfake from a single image Generative speech model for daily dialogue PDF scientific-paper translation with preserved layout Personal VPN deployment in the cloud Fully local autonomous agent for browsing and coding Automatic censorship removal for language models

Agents

An agent is a model driven through GitHub Copilot agent mode in Visual Studio Code with default settings. The controlled part uses Claude Haiku 4.5, DeepSeek V4 Pro, Gemini 2.5 Pro, GPT-5.4 mini and Qwen 3.7 Plus. The replication part keeps Claude, Gemini and Qwen, chosen after the controlled part to cover three providers at manageable cost. Runs took place between 17 August and 30 September 2026. Model identifiers are given in the replication package. 3.5

Rewriting Protocol

The operator runs every session by pasting fixed prompts and never edits code or comments on a failure. No prompt asks the agent to evade a licence or hide a copy. Each run starts from a fresh working copy of the original on disk, opened as the Visual Studio Code workspace. The operator selects the target model in GitHub Copilot and pastes the rewriting prompt into a new agent-mode chat on that workspace. The agent edits the local tree in place. Repair uses a second new chat on the same working copy. , Vol. 1, No. 1, Article . Publication date: November 2026.

6

Moumoula et al.

(1) Rewriting. The operator opens a working copy of the original and pastes one of three prompts. S1 (layout-preserving) requests a line-level rewrite with new identifiers and the same file layout. S2 (paradigm shift) additionally requires a change of programming paradigm within the same modules. S3 (ground-up) requests a rearchitecture with free file organisation. The agent edits the working copy in place. If it stops before completion, the operator sends Continue. (2) Cleanup (S3 only). A fixed prompt asks the agent to remove the files that the new layout supersedes. (3) Testing and repair. The operator pastes the project kit (harness, ordered test cases, repair prompt) in a fresh dialogue. The agent runs the harness and patches the rewrite until all cases pass. Changes are restricted to integration code (imports, aliases, entry points, paths, dependency wiring). The agent may read the original but may edit only the rewrite, and it may neither copy modules of the original nor call it at run time. A final prompt removes auxiliary files created during repair. (4) Archiving. We archive the tree before and after step 3, and we check that no file of the original remains unchanged and that no entry point imports or invokes the original. Because the agent edits in place, an archived rewrite may contain files of the original that were lightly modified or not removed. We score the tree as delivered and examine leftover files in the appendix. 3.6

Behavioural Harness

The harness of a project is a fixed suite of executable cases, six for Deep-Live-Cam and five for the others. Each case runs the original and a candidate on the same input and compares the outputs with a kind-specific distance (image, video, text, PDF or binary) and fixed margins. The case fails if the candidate is too close to the untransformed input or too far from the original’s output relative to the gap between that input and that output. A candidate passes when all cases succeed. A pass shows agreement on these cases only, since the harness executes 20% to 58% of the lines of the originals (appendix). 3.7

Similarity

We run JPlag [16] version 6.3.0 with the default Python minimum token match of 12 on the Python sources of an original 𝑂 and a rewrite 𝐶, excluding tests, virtual environments, installed packages, caches, version-control metadata, the repair kit and root-level asset directories. sim(𝑂, 𝐶) is the mean of the two directional similarities reported by JPlag, and simmax (𝑂, 𝐶) is the larger. Scores are taken after testing and repair unless stated otherwise. The appendix reports five other measures on all 69 rewrites (copydetect, Dolos, MOSS, PMD CPD, line-level Jaccard). The joint criterion at threshold 𝜏 is   𝐽𝜏 (𝐶) = sim(𝑂, 𝐶) < 𝜏 ∧ pass(𝐶). No threshold is established for repository-level comparison (Section 2). We use 𝜏 = 25%1 and repeat threshold-dependent results at 15% and 30%. 3.8

Retention Signals

We extract from each Python file in scope the roots of external imports, called API names, keywordargument constants, distinctive string and numeric literals, and named configuration values. 1 Unrelated rewrites in our corpus score at most 10.5% against each other (Section 4.3), so the three thresholds lie above the

level of unrelated code. , Vol. 1, No. 1, Article . Publication date: November 2026.

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting

7

Standard-library and first-party imports are excluded. Obs(𝑋 ) denotes the facts of repository 𝑋 . For a set 𝐴 of facts of the original, retention in 𝑋 is |𝐴 ∩ Obs(𝑋 )| . Ret(𝐴, 𝑋 ) = |𝐴| 𝐴 is either Imp(𝑂), the external import roots of 𝑂, or the fingerprint 𝐹 (𝑂), the facts of 𝑂 selected by a fixed heuristic that keeps all external imports, up to 40 distinctive strings, 40 API names, 20 numeric literals, and all named configuration bindings (97 to 172 facts per project). The fingerprint has two layers, 𝐹 atom for individual facts and 𝐹 cg for call-graph edges from local functions to APIs. 𝐹 (𝑂) is that heuristic set. Separately, 𝐹 atom is a larger IDF-selected atomic layer (capped at 400 facts, dropping facts that appear in every original), used with 𝐹 cg for the STIC contrasts. The two sets are not identical. The margin compares a rewrite with the five other originals. 1 ∑︁ 𝑀 (𝐴, 𝐶) = Ret(𝐴, 𝐶) − Ret(𝐴, 𝑂 ′ ) 5 𝑂 ′ ≠𝑂 The appendix reports execution-stage coverage and relational and structural fingerprints. 3.9

Independent Controls

The margin 𝑀 credits a rewrite with facts that the task imposes, such as the libraries that any face-swapping tool imports. For each project we therefore built one same-task independent control (STIC), denoted 𝑆𝑂 . One author implemented the project from a capability specification and the harness, without copying from the original, and with a different package layout, command-line interface and identifiers. A control is accepted when it passes the harness and scores 0% mean and maximum JPlag similarity against the original. Third-party libraries required by the task are allowed. The control for algo omits the Ansible deployment of remote servers, which the harness does not exercise. We compare each rewrite with its control. ΔSTIC (𝐴, 𝐶) = Ret(𝐴, 𝐶) − Ret(𝐴, 𝑆𝑂 ) A positive value means that the rewrite retains more of the original than an independent implementation of the same task. We also report the precision |𝐴 ∩ Obs(𝑋 )|/|Obs(𝑋 )| to expose size effects. The controls have three limits. There is one per project, written by one person. They were extended after the campaign. Their first versions passed the harness with much less code than the rewrites, so the same author added modules to all six under the same acceptance conditions. This took place after the first retention results had been examined, although the author consulted neither 𝐹 (𝑂) nor the per-rewrite contrasts. We report retention before and after extension in Section 4.3. Lastly, the 0% acceptance condition prevents their use to calibrate a JPlag threshold. 3.10

Analysis

RQ1 reports, per run, the harness outcome and the similarity before and after repair, the session time and the dialogue tokens (prompt plus completion sizes in the session log). RQ2 is descriptive, given three repetitions per configuration. We report the median and range per project, the shares of the total sum of squares due to project, agent, their interaction and repetition, and the number of configurations whose three runs fall on both sides of 𝜏. Proportions carry Wilson 95% intervals, and the effect of repair is tested on paired scores with a Wilcoxon signed-rank test. RQ3 reports 𝑀 and ΔSTIC per project, and the area under the ROC curve for separating the 54 rewrites from the six controls, with 95% intervals from 2,000 bootstrap resamples. , Vol. 1, No. 1, Article . Publication date: November 2026.

8

4

Moumoula et al.

RESULTS

We answer the three questions in turn. Similarity is sim(𝑂, 𝐶) after testing and repair unless stated otherwise. 4.1

RQ1: Feasibility and Cost

Harness outcome. All 15 rewrites of Deep-Live-Cam pass the harness at the end of the protocol (Table 3, Wilson 95% interval 80% to 100%). Fourteen fail it after the rewriting step and are repaired by the agent, and one (DeepSeek, S2) passes without repair. The operator sent a median of three Continue messages per rewriting session and made no other intervention. Cost. The rewriting session takes a median of 18 minutes (range 8 to 125), and 14 of 15 sessions end within an hour. The median rises with the prompt, from 9 minutes under S1 to 30 under S2 and 38 under S3. The repair session takes a median of 15 minutes (range 5 to 59). Rewriting uses 13.1 million dialogue tokens over the 15 runs (median 0.52 million per run), and repair uses 20.0 million (median 0.95 million). Repair uses more tokens than rewriting in 10 of 15 runs. The rewrites contain 1,673 to 9,648 SLOC, against 5,787 for the original. Similarity by prompt. Median similarity is 64% under S1, 51% under S2 and 22% under S3 (Figure 1). The decrease is not uniform across agents. For Claude, DeepSeek and Qwen, S3 yields the lowest score, at least 43 points below S1. Gemini scores between 8% and 22% under all three prompts. GPT scores 75% under S3, its highest value, which we attribute to files of the original that remain in the archived tree next to the new layout, with imports between the two. With one run per cell, these differences cannot be separated from run-to-run variation, which RQ2 quantifies. Six rewrites score below 𝜏 = 25%, four under S3 and two from Gemini under S1 and S2. Since all rewrites pass the harness, the same six meet 𝐽25 . Three meet 𝐽15 and six meet 𝐽30 . Effect of repair. Repair changes similarity by a median of 0.4 points in absolute value (range −0.2 to +4.1), and no rewrite crosses 𝜏 during repair. [RQ-1] ☛ With no human edit to the code, a coding agent rewrote Deep-Live-Cam to a harness pass in all 15 runs, after rewriting and repair sessions of 18 and 15 minutes at the median, respectively. Six of the 15 rewrites also score below 25% similarity, four of them under the ground-up prompt. This evidence comes from one project and one run per configuration.

, Vol. 1, No. 1, Article . Publication date: November 2026.

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting Strategy 1 Layout Preserve (median 64%)

Strategy 3 Ground-up Rearchitecture (median 22%)

99.5

100

Mean token similarity (%)

Strategy 2 Paradigm Shift (median 51%)

9

88.0 78.2

70

64.3

65.9

75.1

62.9 50.9

50

45.0

22.8

25

21.8

16.3

14.7 8.2

8.1

e

ud

Cla

pS

e De

k

ee

Ge

ni mi

T

GP

en Qw

e

ud

Cla

ee

pS

e De

k

ni

mi

Ge

T

GP

e ni ek ud mi Se Ge ep e D

en

Qw

Cla

T

GP

en

Qw

Fig. 1. RQ1. Similarity to Deep-Live-Cam after repair, by prompt and agent. Each bar is one run. The dashed line marks 𝜏 = 25%.

Table 3. RQ1. The 15 rewrites of Deep-Live-Cam. All pass the harness after repair. SLOC excludes blank and comment-only lines. Rewriting and repair minutes sum the agent run times of each session and exclude idle time between operator messages. Similarity is mean/max JPlag before and after repair. Tokens are dialogue tokens of the rewriting and repair sessions.

Minutes Agent

Similarity

Prompt SLOC Rewriting Repair

Before

Tokens

After Rewriting

Claude Haiku 4.5 S1 Claude Haiku 4.5 S2 Claude Haiku 4.5 S3 DeepSeek V4 Pro S1 DeepSeek V4 Pro S2 DeepSeek V4 Pro S3 Gemini 2.5 Pro S1 Gemini 2.5 Pro S2 Gemini 2.5 Pro S3 GPT-5.4 mini S1 GPT-5.4 mini S2 GPT-5.4 mini S3 Qwen 3.7 Plus S1 Qwen 3.7 Plus S2 Qwen 3.7 Plus S3

3,604 5,364 5,472 4,051 9,221 4,855 2,912 1,946 1,673 3,341 3,512 7,953 5,813 8,126 9,648

9 31 18 37 30 38 8 13 17 13 11 47 9 125 52

22 64.5/87.0 64.3/86.1 15 49.9/51.0 50.9/53.4 6 8.4/11.0 8.2/11.1 31 65.7/83.5 65.9/84.6 7 77.2/99.5 78.2/99.5 33 22.7/28.2 22.8/27.7 49 15.9/28.4 16.3/29.7 23 6.7/15.5 8.1/17.3 59 20.2/44.5 21.8/45.2 8 63.0/78.7 62.9/78.8 7 45.2/55.2 45.0/56.1 23 71.0/89.1 75.1/89.0 14 99.0/99.6 99.5/99.5 5 87.4/93.5 88.0/93.0 13 14.6/14.7 14.7/14.7

Total

77,491

458

316

–

–

Repair

116 386 1 428 312 794 347 946 136 316 776 419 516 1 379 263 941 589 157 625 316 931 360 725 2 728 838 378 741 4 515 401 2 033 816 1 720 140 220 574 2 185 001 336 330 347 559 519 638 342 001 2 494 556 717 790 756 613 915 853 2 710 061 1 138 933 552 785 1 293 895 13.1M

20.0M

, Vol. 1, No. 1, Article . Publication date: November 2026.

10

Moumoula et al.

Table 4. RQ2. Similarity (%) of the 54 ground-up rewrites by project. A configuration is a project and an agent, and it straddles 𝜏 when its three runs fall on both sides of 25%. Project

4.2

Median

Min

Max

Below 25%

Straddling

Pass

Deep-Live-Cam Algo AgenticSeek ChatTTS PDFMathTranslate Heretic

9.1 6.8 14.0 16.5 11.1 26.0

1.8 2.2 5.7 9.1 4.8 5.5

29.4 48.2 28.3 36.7 19.0 80.4

7/9 7/9 8/9 7/9 9/9 4/9

1/3 1/3 1/3 1/3 0/3 3/3

9/9 9/9 9/9 3/9 8/9 8/9

All

12.6

1.8

80.4

42/54

7/18

46/54

RQ2: Stability of Similarity

Harness outcome and cost. Of the 54 rewrites, 46 pass the harness (Wilson 95% interval 73% to 92%). Six of the eight failures are on ChatTTS, whose harness compares generated speech with that of the original (three Claude runs at 1/5 cases, three Qwen runs at 0/5). The other two are Claude runs on PDFMathTranslate (4/5) and Heretic (3/5). Gemini passes in all 18 runs. The rewriting session takes a median of 30 minutes (5.5 to 160) and the repair session a median of 20 minutes (1 to 191). Over the 54 runs, rewriting uses 338 million dialogue tokens and 33.1 hours, and repair uses 217 million tokens and 39.4 hours. Per-run figures are in the appendix. Similarity level. Median similarity over the 54 rewrites is 12.6% (interquartile range 6.5% to 24.0%). Forty-two rewrites score below 𝜏 = 25% (78%, interval 65% to 87%), and 34 of them also pass the harness and so meet 𝐽25 (63%, interval 50% to 75%). The counts are 29 and 26 at 𝜏 = 15%, and 47 and 39 at 𝜏 = 30%. Six rewrites score below 5%. Stability across runs. Scores for a single project spread over 14 points on PDFMathTranslate and up to 75 points on Heretic (Figure 2, Table 4). On Algo, the three Claude runs alone give 48.2%, 2.2% and 38.7%. Repeating an identical configuration accounts for 61% of the total sum of squares, against 14% for the project, 25% for the interaction between project and agent, and 0.1% for the agent. Neither the project nor the agent has a detectable effect (Kruskal-Wallis, 𝑝 = 0.23 and 𝑝 = 0.33). The standard deviation between runs of one configuration is 13.2 points, which exceeds the median score. This variation changes threshold verdicts. In 7 of the 18 configurations, the three runs fall on both sides of 𝜏 = 25%, and five of the six projects have rewrites on both sides. The count is 12 of 18 at 𝜏 = 15% and 5 of 18 at 𝜏 = 30%. Effect of repair. Repair has no systematic direction (median change 0.0 points, Wilcoxon signedrank 𝑝 = 0.74), but it moves individual scores. Eighteen rewrites change by 10 points or more, and 18 cross 𝜏 = 25% during repair, 11 downwards and 7 upwards. On Algo, three rewrites drop by 33 to 66 points because the agent restructured the code again during repair, beyond the integration changes that the prompt allows. One Heretic run rises from 11.2% to 80.4% On Deep-Live-Cam, as in RQ1, no score moves by more than 2 points. [RQ-2] ☛ Under the ground-up prompt, 42 of 54 rewrites score below 25% similarity and 34 also pass the harness. The score is not reproducible. Repeating a configuration accounts for 61% of the variance, and in 7 of 18 configurations identical runs fall on both sides of the threshold. Repair has no systematic direction but shifts individual scores by up to 69 points. , Vol. 1, No. 1, Article . Publication date: November 2026.

Similarity to the original (%)

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting 80

Claude

Gemini

11

Qwen

60 40 𝜏 20 0 Algo

Deep-LiveCam

PDFMathTranslate

AgenticSeek

Heretic

ChatTTS

Fig. 2. RQ2. Similarity after repair of the 54 ground-up rewrites, by project and agent. Each marker is one run, and hollow markers are runs that fail the harness. Horizontal bars are project medians, and the dashed line marks 𝜏 = 25%. Projects are ordered by median.

4.3

RQ3: Calibration of Retention Signals

Similarity among rewrites. Two rewrites of different projects score a median of 3.0% against each other and at most 10.5% (1,215 pairs, Figure 3). This is the level that JPlag reports for unrelated code in this corpus. Two rewrites of the same project score a median of 8.0% (216 pairs, Figure 4), and 7 pairs reach 25%, 5 of them on Heretic. When both rewrites are below 15% against their original (61 pairs), the median is 5.5% and no pair reaches 25%. Rewrites of one original are thus almost as far from each other as from unrelated code, and token similarity does not reveal their common origin. We therefore turn to imports and fingerprints.

Subject-block medians (%) 14

50

DLC 6.3

1.7

3.2

5.0

3.6

2.8

40

algo 1.7

3.6

1.7

2.0

1.9

1.3

agentic 3.2

1.7

6.4

4.7

2.6

2.9

ChatTTS 5.0

2.0

4.7

12.4

4.3

3.9

6

PDF 3.6

1.9

2.6

4.3

7.7

2.6

4

heretic 2.8

1.3

2.9

3.9

2.6

10.8

30 20 10 0

Within (n=216)

Between (n=1215)

DLC

alg

o

ntic tTTS age Cha

PDF eretic h

12 10 8

Median JPlag (%)

JPlag similarity (%)

Pair distributions

2 0

Fig. 3. RQ3. Similarity between rewrites. The left panel shows the distribution over the 216 within-project and 1,215 between-project pairs, with a dashed line at 25%. The right panel shows the median similarity between rewrites of two projects, with same-project pairs on the diagonal.

Against unrelated projects. Rewrites retain on average 53.6% of the external imports of their original and 47.7% of its fingerprint (Table 5). The five unrelated originals retain 9.8% and 12.7% of the same sets, which gives margins of +43.8 and +35.0 points. The margin is positive in every , Vol. 1, No. 1, Article . Publication date: November 2026.

12

Moumoula et al.

algo

agentic

ChatTTS

PDF

heretic

13 16 10 35 37 9 25 24 16 Orig 5 19 17 11 6 5 12 11 18 Orig 33 19 6 6 80 26 33 27 10 Orig 16 11 10 12 10 11 12 9 6 10 8 10 6 8 7 8 19 5 7 36 26 15 19 12 C1 13 C1 5 C1 33 10 11 12 7 10 12 11 C2 19 6 12 6 6 5 8 8 13 C2 19 19 6 4 19 17 13 14 12 C2 16 16 12 12 13 11 13 10 C3 17 10 12 7 7 6 10 11 20 C3 6 5 6 7 4 6 6 6 6 C3 10 11 10 34 15 19 23 16 G1 11 8 6 7 9 11 6 6 8 5 6 5 10 2 G1 35 10 11 12 G1 6 7 4 7 15 21 24 15 G2 6 10 6 7 9 13 6 5 9 26 30 27 10 G2 37 12 12 12 34 G2 80 36 19 4 5 10 15 12 G3 5 6 5 6 11 13 5 4 6 16 16 10 G3 9 10 7 13 15 15 G3 26 26 17 6 6 26 23 17 Q1 12 8 8 10 6 6 5 9 11 Q1 33 15 13 6 5 30 16 16 11 Q1 25 11 10 11 19 21 10 20 Q2 11 7 8 11 6 5 4 9 12 Q2 27 19 14 6 10 27 16 16 9 Q2 24 12 12 13 23 24 15 23 Q3 16 9 11 10 16 15 12 17 20 Q3 18 8 13 20 8 9 6 11 12 Q3 10 12 12 6 2 10 10 11 9 OrigC1 C2 C3 G1 G2 G3 Q1 Q2 Q3 OrigC1 C2 C3 G1 G2 G3 Q1 Q2 Q3 OrigC1 C2 C3 G1 G2 G3 Q1 Q2 Q3

80 70 60 JPlag similarity (%)

DLC

7 6 4 2 24 11 28 29 9 Orig 48 2 39 17 4 6 7 4 9 Orig 18 20 17 6 7 6 14 12 28 Orig 8 10 2 5 6 8 8 8 6 26 8 2 4 8 4 8 19 18 6 4 4 13 11 12 C1 7 C1 48 C1 18 11 4 5 6 6 6 6 4 2 1 2 4 2 3 20 4 4 7 12 11 10 C2 6 8 C2 2 6 C2 20 19 2 2 4 6 4 8 7 3 2 4 4 6 6 5 6 11 10 11 C3 4 10 11 C3 39 26 4 C3 17 18 20 2 4 2 2 2 6 12 2 2 14 G1 6 6 4 6 12 4 4 3 4 G1 2 2 4 2 G1 17 8 2 7 20 19 19 8 8 0 2 10 G2 7 4 4 5 12 4 5 5 7 G2 24 5 5 2 2 G2 4 2 1 3 6 10 10 8 2 2 10 G3 6 4 7 6 4 4 5 5 4 G3 11 6 6 4 4 20 G3 6 4 2 2 12 8 24 13 Q1 7 8 4 4 2 0 2 5 3 12 15 Q1 28 8 6 6 2 19 10 Q1 14 13 12 11 4 5 5 12 Q2 4 4 2 4 2 2 2 5 6 13 Q2 29 8 6 4 2 19 10 24 Q2 12 11 11 10 3 5 5 12 Q3 9 8 6 8 2 8 8 13 12 Q3 9 8 3 6 14 10 10 3 6 Q3 28 12 10 11 4 7 4 15 13 OrigC1 C2 C3 G1 G2 G3 Q1 Q2 Q3 OrigC1 C2 C3 G1 G2 G3 Q1 Q2 Q3 OrigC1 C2 C3 G1 G2 G3 Q1 Q2 Q3

50 40 30 20 10 0

Fig. 4. RQ3. JPlag similarity (%) among the original and the nine rewrites of each project. C, G and Q denote Claude, Gemini and Qwen, and the digit is the repetition.

project. It also holds when token similarity is low. Among the 42 rewrites below 𝜏 = 25%, 81% keep a fingerprint margin above 15 points, and 93% retain more of the fingerprint than every unrelated original. Read against this reference, both signals point to the original. Against independent controls. The controls change this reading (Table 6). They retain on average 49.7% of the atomic fingerprint, against 44.5% for rewrites, and 54% of the imports, the same share as rewrites. Mean ΔSTIC on the atomic layer is positive in two projects, Algo (+31.5) and ChatTTS (+6.2), and negative in the other four, down to −28.7 on AgenticSeek. Over the 54 rewrites, 19 retain more of the atomic fingerprint than their control, and 24 more of the call-graph fingerprint. Most of the facts that separate rewrites from unrelated projects are therefore facts that an implementation of the same task also contains. Precision is of the same order for controls (0.10 to 0.24) and rewrites (0.17 to 0.29), so the controls do not owe their retention to size alone. Retention follows token similarity. In all six projects, fingerprint retention rises with token similarity (appendix). On Deep-Live-Cam, the rank correlation between sim and ΔSTIC over the nine rewrites is 0.97. As a result, ΔSTIC is positive for 3 of the 11 rewrites below 6% similarity, 4 of the 18 between 6% and 15%, and 12 of the 25 above 15%. Without Algo, these counts are 0 of 8, 1 of 15 and 9 of 22. The fingerprint thus exceeds the control mostly where token similarity is already high. Separation. Used as a score to separate the 54 rewrites from the six controls, atomic retention reaches an AUC of 0.40 (95% interval 0.15 to 0.67) and import retention 0.45 (0.28 to 0.65). Normalising within project gives 0.37 (0.14 to 0.64) and 0.45 (0.22 to 0.65). All intervals include 0.5. With six , Vol. 1, No. 1, Article . Publication date: November 2026.

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting

13

Table 5. RQ3. Mean retention (%) of the original’s imports and fingerprint in the nine rewrites of each project and in the five unrelated originals. 𝑀 is the difference in percentage points. Imports Project

Fingerprint

Rewrites

Unrelated

𝑴

Rewrites

Unrelated

𝑴

Deep-Live-Cam Algo AgenticSeek ChatTTS PDFMathTranslate Heretic

61.8 77.8 37.0 32.4 53.5 59.3

20.0 0.0 7.0 7.3 12.1 12.7

+41.8 +77.8 +30.0 +25.1 +41.4 +46.6

45.7 56.2 46.0 43.5 37.3 57.7

11.3 10.9 13.1 10.2 15.2 15.5

+34.4 +45.3 +32.9 +33.2 +22.1 +42.1

All

53.6

9.8

+43.8

47.7

12.7

+35.0

Table 6. RQ3. Retention (%) of the original’s fingerprint in the control and in the nine rewrites (mean), for the atomic and call-graph layers. Δ is ΔSTIC in percentage points, and Δ>0 counts the rewrites that retain more than the control. Atomic Project

Control Rewrites

Call graph 𝚫

𝚫>0 Control Rewrites

𝚫

𝚫>0 4/9 8/9 1/9 8/9 0/9 3/9

Deep-Live-Cam Algo AgenticSeek ChatTTS PDFMathTranslate Heretic

44.0 17.8 71.1 42.9 48.0 74.1

41.5 49.3 42.4 49.0 31.5 53.2

−2.5 +31.5 −28.7 +6.2 −16.5 −20.9

4/9 9/9 0/9 5/9 0/9 1/9

31.5 8.6 60.3 32.0 34.6 47.4

30.5 −0.9 32.4 +23.8 36.4 −23.9 41.6 +9.6 24.1 −10.5 41.3 −6.1

All

49.7

44.5

−5.2 19/54

35.7

34.4

−1.3 24/54

negatives the estimate is imprecise, so we report that we found no separation and do not claim that none exists. JPlag separates the two groups by construction, since controls were required to score 0%, and we do not count this as a result. Sensitivity. Two choices affect these numbers. The first is the extension of the controls. It raised the atomic retention of the control from 33.2% to 44.0% on Deep-Live-Cam and from 7.3% to 17.8% on Algo. With the first version, mean ΔSTIC on Deep-Live-Cam would be +8.3 points instead of −2.5, so the sign on this project depends on the extension. The second is the scope of the Algo control, which omits the Ansible layer and therefore cannot contain the facts of that layer. Restricting the fingerprint to the one module that both cover (25 facts) gives a mean ΔSTIC of +25.8 points, positive for 7 of 9 rewrites, so Algo remains positive under both scopes. [RQ-3] ☛ Import and fingerprint retention separate rewrites from unrelated projects by 44 and 35 points, but not from independent implementations of the same task. Controls retain as much of the original as rewrites do in four of six projects, and only 19 of 54 rewrites exceed their control. Retention rises with token similarity, so it adds little where similarity is low. These results rest on one control per project, extended after the campaign. , Vol. 1, No. 1, Article . Publication date: November 2026.

14

5

Moumoula et al.

DISCUSSION

We first interpret the three results and then draw their consequences for maintainers, for detector research and for providers of coding agents. 5.1

Interpretation

Low scores. A low token score shows that two trees differ on the surface. Our rewrites reach such scores with the original in the workspace, 42 of 54 below 25% and six below 5%. A low score therefore does not show that the new code was written without the original. The converse does not hold either. Rewrites of different projects score up to 10.5% against each other, and 22 of our 54 rewrites score no higher than that against their own original. For these 22, JPlag reports the level it reports for unrelated code. The 1.29% cited in the chardet case lies in this range, so the score is compatible with both an independent implementation and a rewrite made with the original at hand. This limit concerns ground-up rewrites. Under the layout-preserving and paradigm-shift prompts of RQ1, median similarity stays at 64% and 51%, and JPlag does what it was built for. The reading of a token score is thus asymmetric. A high score is evidence of copying, and a low score is evidence of neither copying nor independence. This follows from the design of the tools (Section 2). They target textual clones, and a ground-up rewrite that keeps behaviour is a Type-4 clone of its original. Sources of variation. The choice of agent explains almost none of the variance in similarity (0.1%) and the project little (14%). Most of it lies between runs of the same configuration. Several mechanisms contribute. The agent settles on a different architecture at each run, and the rewrites of one configuration differ in size by a factor of up to 4.6. Larger rewrites tend to score higher, although the association is weak (rank correlation 0.35 over the 54 runs). Files of the original sometimes survive the cleanup, as in the GPT run of RQ1 and the Heretic run at 80.4%. The agent sometimes restructures the code again during repair, as on Algo. The last two belong to what the protocol delivers, and Section 6 shows that the variation remains without them. This variation gives a person who publishes a rewrite a choice. They can run the agent several times and keep the lowest score. In our data, three runs are enough. In all 18 configurations at least one of the three runs scores below 25%, and the lowest score of a configuration never exceeds 17.2%. In 16 of the 18, at least one run is below 25% and also passes the harness. The two exceptions are the ChatTTS configurations in which no run passes. A published score may thus be the minimum of several draws, and a reader has no means to know it. Task-imposed facts. The facts that distinguish a rewrite from unrelated projects are mostly facts that the task imposes. A face-swapping tool imports OpenCV, InsightFace and ONNX Runtime whoever writes it, and it names the same models and providers in its configuration. Our fingerprint selects facts that are rare among six projects from different domains, so it selects such facts first. This explains why the controls retain 43% to 74% of the atomic fingerprint in five of six projects without any contact with the original code. It also explains why the margin over unrelated projects is large and uninformative. In four projects the control retains more than the average rewrite. One possible reason is that the two were produced under opposite instructions. The agent was asked to rearchitect and moved away from the names and constants of the original, whereas the author of the control followed the conventions of the domain. The rewrites that moved furthest are those with the lowest token similarity, which is where retention is lowest too. Copyright practice knows this distinction between task and origin. The Altai test removes the elements dictated by efficiency or by external constraints before two programs are compared [23]. , Vol. 1, No. 1, Article . Publication date: November 2026.

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting

15

A provenance signal validated only against unrelated code skips this step and measures the task. Our controls show that the step is needed. They do not show that no signal exists, since rewrites of Algo and ChatTTS retain more than their control. 5.2

Implications

Maintainers and auditors. A single low similarity score should not be accepted as evidence of independence. When one is offered, the number of runs and the rule used to select the published one should be requested with it. In our study, neither token similarity nor retention revealed that the agent had the original. Only the record of the session does, that is, the prompts, the logs and the content of the workspace. Evidence about the process is therefore worth more than evidence about the output. This brings the question back to clean-room practice. Its value never lay in the dissimilarity of the result but in a documented separation between those who read the original and those who wrote the new code. With agents, the separation has to be enforced on the workspace and recorded. It cannot be enforced on the training data of the model, which is a limit that a clean-room claim based on an agent should state. Detector evaluation. A detector for rewrites should be evaluated against independent implementations of the same task. Unrelated projects are a necessary reference and an insufficient one, as our margins of 44 and 35 points show. Scores should also be reported over repeated generations of the same rewrite, since one generation says little about the next. Scores between unrelated repositories give the floor below which a threshold has no meaning, 10.5% for JPlag on our corpus. Such evaluations need more than one control per project. With six negatives, our own AUC estimates have intervals too wide to conclude. The 69 rewrites and six controls that we release are a starting point for a larger benchmark. Agent providers. None of our prompts asks to evade a licence. A request to rewrite a project with a new architecture is ordinary, so a refusal policy based on stated intent does not apply to it. What a provider can offer is the session record, which is the only evidence that settled the question of access in our study. Future work. Three extensions would strengthen these results. Agent runs from a specification alone would show what similarity and retention an agent reaches without the original, and several controls per project by different authors would replace the single point we compare with. Held-out inputs and differential testing would make a harness pass more informative than agreement on five or six cases. Other languages, larger repositories and cross-language rewriting would show how far the findings extend. 6

THREATS TO VALIDITY

Construct validity. Token similarity measures surface correspondence and says nothing about derivation in the legal sense. We use the mean of the two directional JPlag similarities. With the maximum, 35 rewrites instead of 42 fall below 25%, and the instability is at least as large (repetition accounts for 57% of the variance, and 10 of 18 configurations straddle 𝜏). The threshold 𝜏 is operational, and all threshold results are given at three values. A harness pass means agreement on five or six cases that execute 20% to 58% of the lines of the original. Coverage of the rewrites themselves ranges from 5% to 84%, so parts of some passing rewrites are never executed. The feasibility claim of RQ1 is limited to what the harness exercises. Cost is measured in session time and dialogue tokens, and we report no monetary cost. , Vol. 1, No. 1, Article . Publication date: November 2026.

16

Moumoula et al.

The fingerprint is selected over six originals and would differ with another corpus. The five unrelated projects come from other domains, which makes the margin 𝑀 an easy reference to exceed. Internal validity. Two features of the protocol affect similarity. Because the agent edits in place, files of the original can remain in a rewrite. Without Heretic, where this occurred, repetition still accounts for the largest share of the variance (52%) and 4 of 15 configurations straddle 𝜏. Repair went beyond integration changes on Algo. On scores taken before repair, repetition accounts for 54% of the variance and 9 of 18 configurations straddle 𝜏. The instability, therefore, does not depend on either feature. Both show, however, that the agent did not always follow the constraints of the prompts, and that our check on archived trees did not catch every case. The controls are the weakest part of the design. There is one per project, written by a single author who had read the originals, wrote the capability specifications and the behavioural test suites from that knowledge, and then implemented and later extended each control under the 0% JPlag acceptance check after the first retention results. On Deep-Live-Cam the sign of ΔSTIC depends on this extension, and the Algo control has a narrower scope than the original. The controls were also required to score 0% under JPlag, a condition that an independent implementation need not meet and that may have pushed their author away from natural choices. RQ3 is a sensitivity result and not a test planned in advance. One operator ran all sessions. A single operator ran every cloning and repair session in the campaign. That operator’s only inputs were the fixed prompts and Continue messages. This limits but does not remove operator effects. The operator’s only inputs were fixed prompts and Continue messages, which limits but does not remove operator effects. The models may have seen these public projects during training, and we cannot separate what an agent takes from the workspace from what the model recalls. This does not affect our claims, since the setting gives the agent the original in any case. Providers also update their models, so the same run may give other results at a later date. Conclusion validity. With three repetitions per configuration, the variance decomposition is descriptive and we attach no significance test to its shares. The absence of a detectable effect of the agent or the project does not establish that there is none. RQ1 has one run per cell and supports no comparison between prompts or agents. The AUC of RQ3 rests on six negatives, and its intervals are wide. External validity. The corpus has six Python projects below 15,000 SLOC, selected purposively, and RQ1 uses one of them. Five of the six are applications built on machine-learning libraries, in which much of the code calls third-party APIs. Results may differ for projects whose value lies in their own algorithms, of which chardet is an example. All runs use one agent tool, five models and three prompts. We study rewriting in the same language with the original available. We have no runs from a specification alone, so we cannot say what an agent without the original would score. 7

RELATED WORK

Three lines of work come close to this study, and each leaves open at least one of the quantities we measure. Detectors under automated obfuscation. Plagiarism detectors have been tested against automated and LLM-based obfuscation. Sağlam et al. normalise token sequences so that JPlag withstands the insertion and reordering of statements [18], and Sağlam and Schmid evaluate such defences on more than four million comparisons of student programs, including programs obfuscated or generated by GPT-4 [19]. Park et al. detect LLM paraphrases of human-written code from coding-style , Vol. 1, No. 1, Article . Publication date: November 2026.

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting

17

features [14]. On the clone-detection side, GPTCloneBench provides semantic and cross-language clone pairs generated with GPT-3 [2], and on this benchmark and BigCloneBench [22] Zhang and Saber report that GPT-3.5 and GPT-4 detect few Type-4 clones, with recall of 0.07 and 0.23 [31]. These studies work on functions or course assignments and score each transformed program once. They do not cover repositories rewritten by an agent, and they do not ask whether a second rewrite of the same program would receive the same score. Memorisation and licence compliance. A second line asks whether code models reproduce protected code. Models are known to emit memorised training code [1], CodeIPPrompt measures how close generated code comes to licensed code [30], and LiCoEval tests whether a model gives accurate licence information when its output is strikingly similar to an existing open-source implementation [27]. The closest study to ours is that of Colombo et al., who generated more than 70,000 Java method bodies with GPT-4 from the signatures and JavaDoc of copyleft methods and scored them with JPlag [4]. They found that a larger class context increases the likelihood of reproducing copyleft code, that a higher temperature reduces it, and that an explicit request to avoid copying has no reliable effect. Meeus et al. show that models also reproduce the functional logic of training code in textually dissimilar form, which they call functional memorisation and which overlap metrics do not detect [13]. All of this work concerns single methods or functions completed from a signature, where similarity comes from what the model retained during training. In our setting the original is handed to the agent, the unit is the repository, and the question is what a detector reports afterwards. Repository construction. A third line evaluates whether agents can build a repository without its source. NL2Repo-Bench gives the agent a requirements document and an empty workspace and runs the upstream tests on the result [7]. RepoZero supplies API specifications and asks for a reimplementation in another language [32], and ProgramBench supplies an executable with its documentation and accepts any implementation language [29]. These benchmarks withhold the source by design and score behaviour only, so they never compare the result with the original and say nothing about rewriting when the source is available. Other similarity measures. Measures based on tree edits [9, 21] could complement token matching when tokens diverge. We keep to token-based detectors because they are the evidence produced in practice, and we report five further detectors in the appendix. Our study differs from these lines on four points. It works at repository scale in a single language, it gives the agent the original, it repeats each configuration, and it compares rewrites with independent implementations of the same task. 8

CONCLUSION

Token-similarity scores are offered as evidence that agent-made rewrites of copyleft projects are independent of their originals. We examined what such scores can support on 69 rewrites of six Python projects, all produced with the original in the agent’s workspace and with no human edit to the code. The rewrites are cheap to obtain and most score low, 42 of 54 below 25% under a ground-up prompt. The score does not reproduce, however. Repeating a configuration accounts for 61% of its variance, and three runs suffice to obtain a score below 25% in every configuration. Import and fingerprint retention separate rewrites from unrelated projects but not from independent implementations of the same task. A low similarity score is therefore weak evidence of independence, and a claim of independence should rest on records of how the code was produced. Detectors for such rewrites should be validated against same-task controls and over repeated generations. , Vol. 1, No. 1, Article . Publication date: November 2026.

18

9

Moumoula et al.

ETHICAL CONSIDERATIONS

Dual use. This paper describes a protocol that produces low-similarity rewrites of copyleft code, and it could be used for that purpose. We judge this risk limited. The protocol uses ordinary prompts in a commodity tool and is already practised in public, as the chardet case shows. What the paper adds is evidence on what similarity scores can support, which serves those who must assess such rewrites. Licences. The six originals are under AGPL-3.0 or GPL-3.0, which permit the modification and redistribution carried out in this study. We do not claim that the rewrites are free of these licences, and we distribute them under the licence of their original. Sensitive projects. Two of the projects are a face-swapping tool and a tool that removes refusals from language models. Our rewrites reproduce functionality that is already public and add no capability. The harnesses use synthetic or author-controlled inputs and no personal data. Participants. The study involved no human participants.

, Vol. 1, No. 1, Article . Publication date: November 2026.

A Low Similarity Score Does Not Show Independence after Source-Conditioned Repository Rewriting

19

REFERENCES [1] Ali Al-Kaswan, Maliheh Izadi, and Arie van Deursen. 2024. Traces of Memorisation in Large Language Models for Code. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering (Lisbon, Portugal) (ICSE ’24). Association for Computing Machinery, New York, NY, USA, Article 78, 12 pages. doi:10.1145/3597503.3639133 [2] Ajmain I. Alam, Palash R. Roy, Farouq Al-Omari, Chanchal K. Roy, Banani Roy, and Kevin A. Schneider. 2023. GPTCloneBench: A comprehensive benchmark of semantic clones and cross-language clones using GPT-3 model and SemanticCloneBench. In 2023 IEEE International Conference on Software Maintenance and Evolution (ICSME). 1–13. doi:10.1109/ICSME58846.2023.00013 [3] Stefan Bellon, Rainer Koschke, Giulio Antoniol, Jens Krinke, and Ettore Merlo. 2007. Comparison and Evaluation of Clone Detection Tools. IEEE Transactions on Software Engineering 33, 9 (2007), 577–591. doi:10.1109/TSE.2007.70725 [4] Gaia Colombo, Leonardo Mariani, Daniela Micucci, and Oliviero Riganelli. 2025. On the Possibility of Breaking Copyleft Licenses When Reusing Code Generated by ChatGPT. In 2025 IEEE/ACM 33rd International Conference on Program Comprehension (ICPC) (Ottawa, ON, Canada). IEEE Press, 1–12. doi:10.1109/ICPC66645.2025.00060 [5] Jonathan Corbet. 2026. The Relicensing of chardet. LWN.net (2026). https://lwn.net/Articles/1061534/ Accessed 31 July 2026. [6] Massimiliano Di Penta, Daniel M. German, Yann-Gaël Guéhéneuc, and Giuliano Antoniol. 2010. An exploratory study of the evolution of software licensing. In 2010 ACM/IEEE 32nd International Conference on Software Engineering, Vol. 1. 145–154. doi:10.1145/1806799.1806824 [7] Jingzhe Ding, Shengda Long, Changxin Pu, Huan Zhou, Hongwan Gao, Xiang Gao, Chao He, Yue Hou, Fei Hu, Zhaojian Li, Weiran Shi, Zaiyuan Wang, Daoguang Zan, Chenchen Zhang, Xiaoxu Zhang, Qizhi Chen, Xianfu Cheng, Bo Deng, Qingshui Gu, Kai Hua, Juntao Lin, Pai Liu, Mingchen Li, Xuanguang Pan, Zifan Peng, Yujia Qin, Yong Shan, Zhewen Tan, Weihao Xie, Zihan Wang, Yishuo Yuan, Jiayu Zhang, Enduo Zhao, Yunfei Zhao, He Zhu, Liya Zhu, Chenyang Zou, Ming Ding, Jianpeng Jiao, Jiaheng Liu, Minghao Liu, Qian Liu, Chongyang Tao, Jian Yang, Tong Yang, Zhaoxiang Zhang, Xinjie Chen, Wenhao Huang, and Ge Zhang. 2026. NL2Repo-Bench: Towards Long-Horizon Repository Generation Evaluation of Coding Agents. arXiv:2512.12730 [cs.CL] https://arxiv.org/abs/2512.12730 [8] Yihong Dong, Xue Jiang, Jiaru Qian, Tian Wang, Kechi Zhang, Zhi Jin, and Ge Li. 2025. A Survey on Code Generation with LLM-based Agents. arXiv:2508.00083 [cs.SE] https://arxiv.org/abs/2508.00083 [9] Jean-Rémy Falleri, Floréal Morandat, Xavier Blanc, Matias Martinez, and Martin Monperrus. 2014. Fine-grained and Accurate Source Code Differencing. In Proceedings of the 29th ACM/IEEE International Conference on Automated Software Engineering (ASE). ACM, 313–324. doi:10.1145/2642937.2642982 [10] Free Software Foundation. 2007. GNU Affero General Public License, Version 3. https://www.gnu.org/licenses/agpl3.0.html. [11] Free Software Foundation. 2007. GNU General Public License, Version 3. https://www.gnu.org/licenses/gpl-3.0.html. [12] Carlos E Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik R Narasimhan. 2024. SWE-bench: Can Language Models Resolve Real-world Github Issues?. In The Twelfth International Conference on Learning Representations. https://openreview.net/forum?id=VTF8yNQM66 [13] Matthieu Meeus, Anil Ramakrishna, Shengyuan Hu, Matthew Grange, Zheng Xu, and Luca Melis. 2026. Detecting Functional Memorization in Code Language Models. arXiv:2606.12764 [cs.LG] https://arxiv.org/abs/2606.12764 [14] Shinwoo Park, Hyundong Jin, Jeong won Cha, and Yo-Sub Han. 2026. Detection of LLM-Paraphrased Code and Identification of the Responsible LLM Using Coding Style Features. arXiv:2502.17749 [cs.AI] https://arxiv.org/abs/ 2502.17749 [15] Mark Pilgrim. 2026. No right to relicense this project. GitHub issue #327, chardet/chardet. https://github.com/chardet/ chardet/issues/327 [16] Lutz Prechelt, Guido Malpohl, and Michael Philippsen. 2002. Finding Plagiarisms among a Set of Programs with JPlag. Journal of Universal Computer Science 8, 11 (2002), 1016–1038. doi:10.3217/jucs-008-11-1016 [17] Chanchal K. Roy, James R. Cordy, and Rainer Koschke. 2009. Comparison and evaluation of code clone detection techniques and tools: A qualitative approach. Science of Computer Programming 74, 7 (2009), 470–495. doi:10.1016/j. scico.2009.02.007 [18] Timur Sağlam, Moritz Brödel, Larissa Schmid, and Sebastian Hahner. 2024. Detecting Automatic Software Plagiarism via Token Sequence Normalization. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering (Lisbon, Portugal) (ICSE ’24). Association for Computing Machinery, New York, NY, USA, Article 113, 13 pages. doi:10.1145/3597503.3639192 [19] Timur Sağlam and Larissa Schmid. 2025. Evaluating Software Plagiarism Detection in the Age of AI: Automated Obfuscation and Lessons for Academic Integrity. arXiv:2505.20158 [cs.SE] https://arxiv.org/abs/2505.20158 [20] Saul Schleimer, Daniel S. Wilkerson, and Alex Aiken. 2003. Winnowing: local algorithms for document fingerprinting. In Proceedings of the 2003 ACM SIGMOD International Conference on Management of Data (San Diego, California) (SIGMOD ’03). Association for Computing Machinery, New York, NY, USA, 76–85. doi:10.1145/872757.872770 , Vol. 1, No. 1, Article . Publication date: November 2026.

20

Moumoula et al.

[21] Yewei Song, Cedric Lothritz, Daniel Tang, Tegawendé Bissyandé, and Jacques Klein. 2024. Revisiting Code Similarity Evaluation with Abstract Syntax Tree Edit Distance. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), Lun-Wei Ku, Andre Martins, and Vivek Srikumar (Eds.). Association for Computational Linguistics, Bangkok, Thailand, 38–46. doi:10.18653/v1/2024.acl-short.3 [22] Jeffrey Svajlenko and Chanchal K. Roy. 2015. Evaluating clone detection tools with BigCloneBench. In 2015 IEEE International Conference on Software Maintenance and Evolution (ICSME). 131–140. doi:10.1109/ICSM.2015.7332459 [23] U.S. Court of Appeals for the Second Circuit. 1992. Computer Associates International, Inc. v. Altai, Inc. 982 F.2d 693 (2d Cir. 1992). Abstraction–filtration–comparison test for software copyright. [24] Christopher Vendome, Gabriele Bavota, Massimiliano Di Penta, Mario Linares-Vásquez, Daniel German, and Denys Poshyvanyk. 2017. License usage and changes: a large-scale study on gitHub. Empirical Softw. Engg. 22, 3 (June 2017), 1537–1577. doi:10.1007/s10664-016-9438-4 [25] Xingyao Wang, Boxuan Li, Yufan Song, Frank F. Xu, Xiangru Tang, Mingchen Zhuge, Jiayi Pan, Yueqi Song, Bowen Li, Jaskirat Singh, Hoang H. Tran, Fuqiang Li, Ren Ma, Mingzhang Zheng, Bill Qian, Yanjun Shao, Niklas Muennighoff, Yizhe Zhang, Binyuan Hui, Junyang Lin, Robert Brennan, Hao Peng, Heng Ji, and Graham Neubig. 2025. OpenHands: An Open Platform for AI Software Developers as Generalist Agents. In The Thirteenth International Conference on Learning Representations. https://openreview.net/forum?id=OJd3ayDDoF [26] Simon Willison. 2026. Can coding agents relicense open source through a “clean room” implementation of code? https://simonwillison.net/2026/Mar/5/chardet/ [27] Weiwei Xu, Kai Gao, Hao He, and Minghui Zhou. 2025. LiCoEval: Evaluating LLMs on License Compliance in Code Generation. In Proceedings of the IEEE/ACM 47th International Conference on Software Engineering (Ottawa, Ontario, Canada) (ICSE ’25). IEEE Press, 1665–1677. doi:10.1109/ICSE55347.2025.00052 [28] John Yang, Carlos E. Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik Narasimhan, and Ofir Press. 2024. SWE-agent: agent-computer interfaces enable automated software engineering. In Proceedings of the 38th International Conference on Neural Information Processing Systems (Vancouver, BC, Canada) (NIPS ’24). Curran Associates Inc., Red Hook, NY, USA, Article 1601, 125 pages. [29] John Yang, Kilian Lieret, Jeffrey Ma, Parth Thakkar, Dmitrii Pedchenko, Sten Sootla, Emily McMilin, Pengcheng Yin, Rui Hou, Gabriel Synnaeve, Diyi Yang, and Ofir Press. 2026. ProgramBench: Can Language Models Rebuild Programs From Scratch? arXiv:2605.03546 [cs.SE] https://arxiv.org/abs/2605.03546 [30] Zhiyuan Yu, Yuhao Wu, Ning Zhang, Chenguang Wang, Yevgeniy Vorobeychik, and Chaowei Xiao. 2023. CodeIPPrompt: Intellectual Property Infringement Assessment of Code Language Models. In Proceedings of the 40th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 202), Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett (Eds.). PMLR, 40373–40389. https:// proceedings.mlr.press/v202/yu23g.html [31] Zixian Zhang and Takfarinas Saber. 2024. Assessing the Code Clone Detection Capability of Large Language Models. In 2024 4th International Conference on Code Quality (ICCQ). 75–83. doi:10.1109/ICCQ60895.2024.10576803 [32] Zhaoxi Zhang, Yiming Xu, Jiahui Liang, Weikang Li, Xiaoshuai Chen, Liwei Qian, Xin Pei, Jizhou Huang, Run Sun, and Yunfang Wu. 2026. RepoZero: Can LLMs Generate a Code Repository from Scratch? arXiv:2605.07122 [cs.SE] https://arxiv.org/abs/2605.07122

, Vol. 1, No. 1, Article . Publication date: November 2026.

Related documents

• KLOD: Locality-Preserving Knowledge Editing via Non-Target Distribution Preservation#781125
• KLOD: Locality-Preserving Knowledge Editing via Non-Target Distribution Preservation#779750
• RepoRescue: An Empirical Study of LLM Agents on Whole-Repository Compatibility Rescue#329145
• A Study of Cursorrules Files in GitHub Open Source Projects#444704
• Standing on the Shoulders of Giants: Stabilized Knowledge Distillation for Cross--Language Code Clone Detection#155381