Echoes within the Reasoning: Stealthy and Effective Watermarking via Chain of Thought

• URL: http://arxiv.org/abs/2605.28890v1
• Date: Wed, 27 May 2026 07:44:38 GMT
• Title: Echoes within the Reasoning: Stealthy and Effective Watermarking via Chain of Thought
• Abstract summary: BiCoT is a watermarking framework that embeds ownership signals into the internal geometry of reasoning traces.<n>To enable verification under model theft and representation drift, we introduce Robust Subspace Registration.<n> Experiments show that BiCoT preserves reasoning fidelity across diverse complex reasoning tasks.
• Score: 22.88615312532184
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large Language Models with Chain-of-Thought reasoning capabilities represent valuable intellectual property, yet existing black-box watermarking methods often trade robustness for reasoning fidelity by perturbing final answers or relying on fragile trigger patterns. We propose BiCoT, a watermarking framework that embeds ownership signals into the internal geometry of reasoning traces by aligning high-saliency structural anchors with a private signature subspace while regularizing ordinary control tokens to preserve semantic capacity. This design couples the watermark with reasoning-relevant representations, making removal difficult without disrupting the features that support coherent reasoning. To enable verification under model theft and representation drift, we introduce Robust Subspace Registration (RSR), a Top- logprob-based black-box verifier that uses sentinel tokens to calibrate systematic shifts in the output distribution. Experiments show that BiCoT preserves reasoning fidelity across diverse complex reasoning tasks while achieving robust detection under fine-tuning, quantization, model-level perturbations, and adaptive output-level attacks across in-domain and out-of-distribution settings.

Related papers

• Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks [68.64050157343334]
  Existing watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution.<n>We introduce an innovative watermark that jointly provides provenance and tamper evidence.<n>The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes.
  arXiv  Detail & Related papers  (2026-08-13T01:55:16Z)
• RoboPIN: Grounded Embodied Reasoning via Pinned Chain-of-Thought [50.36951914894845]
  Embodied reasoning requires models to perceive task-relevant objects and spaces in physical environments.<n>Current vision-language models rely on text-only or coordinate-augmented chain-of-thought.<n>We propose Pinned Chain-of-Thought, a structured reasoning paradigm that pins every reasoning step to visual evidence.
  arXiv  Detail & Related papers  (2026-06-14T11:30:42Z)
• Hidden in Plain Tokens: Simply Robust, Gradient-Free Watermark for Synthetic Audio [58.612001688217056]
  Inference-time watermarks for autoregressive models are unfit for continuous modalities due to discretization inconsistencies.<n>We propose an elegant solution for powerful and robust watermarking of synthetic audio.
  arXiv  Detail & Related papers  (2026-05-25T15:43:20Z)
• R-CoT: A Reasoning-Layer Watermark via Redundant Chain-of-Thought in Large Language Models [48.47950824122549]
  This paper introduces a reasoning-layer framework termed Redundant Chain-of-Thought (R-CoT), which embeds watermarks into the reasoning path.<n> Experimental results show that, compared with existing methods, R-CoT achieves high watermark effectiveness and strong robustness.
  arXiv  Detail & Related papers  (2026-04-28T05:52:57Z)
• Green-Red Watermarking for Recommender Systems [8.997062424915711]
  GREW is a novel Green-REd Watermarking framework for recommender systems.<n>It uses a secret key to partition the item space into "green" items for soft promotion and "red" items as anchors, thereby shifting the paradigm from fragile memorization to a stealthy, key-controlled output bias.<n>GREW achieves strong ownership verification and robustness against extraction attacks compared to existing baselines.
  arXiv  Detail & Related papers  (2026-04-26T07:16:44Z)
• Rethinking LLM Watermark Detection in Black-Box Settings: A Non-Intrusive Third-Party Framework [16.430415006488865]
  TTP-Detect is a pioneering black-box framework designed for non-intrusive, third-party watermark verification.<n>It employs a proxy model to amplify watermark-relevant signals and a suite of complementary relative measurements to assess the alignment of the query text with watermarked distributions.<n>It achieves superior detection performance and robustness against diverse attacks.
  arXiv  Detail & Related papers  (2026-03-16T08:28:48Z)
• TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models [19.148124494194317]
  We propose TraceGuard, a process-guided security framework that transforms small-scale models into robust reasoning firewalls.<n>Our approach treats the reasoning trace as an untrusted payload and establishes a defense-in-depth strategy.<n>We demonstrate robustness against adaptive adversaries in a grey-box setting, establishing TraceGuard as a viable, low-latency security primitive.
  arXiv  Detail & Related papers  (2026-03-02T22:19:13Z)
• Distilling the Thought, Watermarking the Answer: A Principle Semantic Guided Watermark for Large Reasoning Models [46.12198035083885]
  This paper introduces ReasonMark, a novel watermarking framework specifically designed for reasoning-intensive LLMs.<n>Our approach decouples generation into an undisturbed Thinking Phase and a watermarked Answering Phase.<n>Experiments show ReasonMark surpasses state-of-the-art methods by reducing text Perplexity by 0.35, increasing translation BLEU score by 0.164, and raising mathematical accuracy by 0.67 points.
  arXiv  Detail & Related papers  (2026-01-08T17:32:22Z)
• SWAP: Towards Copyright Auditing of Soft Prompts via Sequential Watermarking [58.475471437150674]
  We propose sequential watermarking for soft prompts (SWAP)<n>SWAP encodes watermarks through a specific order of defender-specified out-of-distribution classes.<n>Experiments on 11 datasets demonstrate SWAP's effectiveness, harmlessness, and robustness against potential adaptive attacks.
  arXiv  Detail & Related papers  (2025-11-05T13:48:48Z)
• An Ensemble Framework for Unbiased Language Model Watermarking [60.99969104552168]
  We propose ENS, a novel ensemble framework that enhances the detectability and robustness of unbiased watermarks.<n>ENS sequentially composes multiple independent watermark instances, each governed by a distinct key, to amplify the watermark signal.<n> Empirical evaluations show that ENS substantially reduces the number of tokens needed for reliable detection and increases resistance to smoothing and paraphrasing attacks.
  arXiv  Detail & Related papers  (2025-09-28T19:37:44Z)
• Character-Level Perturbations Disrupt LLM Watermarks [64.60090923837701]
  We formalize the system model for Large Language Model (LLM) watermarking.<n>We characterize two realistic threat models constrained on limited access to the watermark detector.<n>We demonstrate character-level perturbations are significantly more effective for watermark removal under the most restrictive threat model.<n> Experiments confirm the superiority of character-level perturbations and the effectiveness of the Genetic Algorithm (GA) in removing watermarks under realistic constraints.
  arXiv  Detail & Related papers  (2025-09-11T02:50:07Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.