一句话：指出代码水印与后门结构同构，警告溯源验证基础设施可能助长隐蔽后门，呼吁转向功能验证。
随着大语言模型深入参与软件开发，社区投入大量精力研究水印技术以确立 AI 生成代码的溯源。本文对此路径进行批判性反思，论证水印与后门植入在结构上同构：二者都向输出分布中嵌入隐藏信号，同时保持语义等价。作者指出，为验证可信溯源而构建的基础设施，会在无意中训练开发者接受含有不透明、可统计检测模式的代码——而这正是复杂后门的典型特征。文章并非提出新攻击，而是揭示集体的方向性失误：社区正在错误基础上构建信任基础设施。作者主张范式转向功能验证，并认为大语言模型本身首次使这一方向在经济上可行。
As large language models become integral to software development, the research community has invested heavily in watermarking techniques to establish provenance of AI-generated code. This paper offers a critical reflection on this trajectory. We argue that watermarking and backdooring are structurally isomorphic problems: both embed hidden signals into output distributions while preserving semantic equivalence. The infrastructure we build to verify trustworthy provenance signals inadvertently trains developers to accept code containing opaque, statistically detectable patterns—the precise characteristics of sophisticated backdoors. Rather than proposing yet another attack, we call attention to a collective misstep: as a community, we are building trust infrastructure on the wrong foundation. We advocate for a paradigm shift toward functional verification—a direction that LLMs themselves now make economically viable for the first time.
@inproceedings{ZhangRKT26,
title = {The Watermark Paradox: How Provenance Verification Paves the Road to Camouflaged Backdoors},
author = {Haoyi Zhang and Huaijin Ran and Kisub Kim and Xunzhu Tang},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3805553}
}