An embedding method and a verification method of a structure-aware semantic watermark

Abstract

The application discloses a structure-aware semantic watermark embedding method and a verification method thereof. The embedding method comprises: parsing a source code to be protected to generate an abstract syntax tree; identifying semantic anchor nodes in the abstract syntax tree; constructing a set of watermark signals containing trigger signals and target signals; loading an annotation template; embedding the trigger signals and the target signals into the annotations of the source code based on the positions of the semantic anchor nodes, and presenting a statistical co-occurrence relationship within a predetermined context; and outputting a protected data set containing structure-aware semantic watermarks. The verification method inputs a trigger prompt to a model to be tested, counts the response frequency of the target signal in the model output, and uses statistical significance testing to determine the existence of the watermark. The application can achieve verifiable protection of the source of the data set without changing the function of the code, has the advantages of concealment, robustness and semantic integrity, and is suitable for copyright tracking and tracing of large code model training data.

Description

Technical Field

[0001] This invention relates to the field of computer data protection and copyright tracking technology, specifically to an embedding method and verification method for structure-aware semantic watermarking. Background Technology

[0002] In recent years, large-scale code models (LCMs) trained on massive amounts of open-source code have developed rapidly and are playing an increasingly important role in software development. However, the training data for these models comes from a wide range of sources, often involving the unauthorized use of copyrighted open-source code, which has led to serious disputes over data ownership and copyright attribution.

[0003] To address the above issues, many R&D personnel in the industry have proposed various code watermarking solutions, but these solutions generally suffer from the following drawbacks: (1) Intrusiveness and functional damage: One type of solution (such as CoProtector) inserts redundant control flow (such as invalid loops) or empty operations into the source code through logical modifications. Although such methods can be detected, the signals are intrusive, severely damaging the semantics and readability of the code, and are easily removed by static analysis tools or compiler optimizations. (2) Vulnerability and easy failure: Another type of solution (such as CodeMark) uses semantic preservation transformations, such as replacing list() with [ ], or replacing sum(numbers) with sum.__call__(numbers). Although such methods keep the functionality unchanged, the watermark can still be detected at the syntactic level, and standard formatting tools or refactoring tools can easily remove the watermark. (3) Access restriction: Some solutions (such as SWEET) rely on white-box access permissions, that is, they need to obtain the internal parameters or structure of the model to verify, which is not feasible when facing API services. As can be seen from the above, existing solutions all embed signals in functional code, making it difficult to simultaneously achieve concealment, robustness, and semantic integrity, thus forming a common "trilemma" in this field.

[0004] Therefore, developing a mechanism that can reliably trace the source of code datasets and verify whether a model uses a specific dataset has become a pressing technical problem in this field. Summary of the Invention

[0005] The purpose of this invention is to provide an embedding method for structure-aware semantic watermarking that simultaneously satisfies concealment, robustness, and semantic integrity, thereby addressing the problem that existing code watermarking schemes proposed in the background art cannot simultaneously satisfy concealment, robustness, and semantic integrity. This method transfers the watermark channel from functional code to non-functional code comments, thus achieving a concealed, robust, efficient, and black-box verification-supporting data source traceability mechanism while maintaining the executable behavior and semantics of the source code completely unchanged. This enables data source protection and verifiable model traceability.

[0006] To achieve the above objectives, the present invention provides a method for embedding structure-aware semantic watermarks, comprising the following steps:

[0007] The source code to be protected is parsed to generate an abstract syntax tree (AST).

[0008] One or more preset semantic anchor nodes are identified in the abstract syntax tree. The semantic anchor nodes are determined based on the syntactic or semantic features of the source code (such as node type, depth, variable reference).

[0009] A set of watermark signals (“watermark signals” can also be referred to as “perturbation signals” in this invention, as they are achieved through small perturbations of annotations) is constructed. The watermark signals include at least one trigger signal and one target signal, and the watermark signals include, but are not limited to, perturbations based on spelling perturbations and perturbations based on hidden or invisible characters. Preferably, the construction of the watermark signals includes: (a) Spelling perturbations: utilizing the “Typoglycemia effect” (i.e., the human brain’s tendency to automatically correct spelling errors). For example, perturbing the high-frequency word “function” to “funtion”, or perturbing “calculate” to “caluclate”. Such perturbations are almost invisible to human reviewers (concealment), but for the tokenizer of large code models (LCMs), “funtion” is a novel, low-frequency token, to which the model is highly sensitive (verifiability). (b) Hidden characters: utilizing the perceptual asymmetry between the compiler / renderer and LCMs. For example, use zero-width spaces ("U+200B") or other non-rendering Unicode characters. These characters are completely invisible in the code editor (stealth), but they fundamentally change the word segmentation boundaries of LCMs. (c) Trigger-Target Pair Construction: For efficient statistical verification, the watermark signal is preferably constructed as a "trigger-target pair". For example, use "funtion" from (a) as the trigger signal and select another word (e.g., perturb "initialize" to "intialize") as the target signal.

[0010] Select an annotation template from the system, which has a preset annotation template library for generating natural, context-sensitive annotation text.

[0011] Based on the position of the semantic anchor node, the trigger signal and the target signal are embedded in the comments of the source code, so that the trigger signal and the target signal present a statistical co-occurrence relationship in the comments and within a predetermined context (i.e., a "false co-occurrence relationship" that is unrelated in natural code but is deliberately associated by this invention). After the trigger signal and the target signal are embedded in the comments, the executable behavior and semantics of the source code remain completely unchanged.

[0012] After inserting annotations into all files to be embedded, the system outputs a protected dataset containing structure-aware semantic watermarks.

[0013] Furthermore, the semantic anchor node includes at least one node type in the abstract syntax tree, and the node type includes, but is not limited to, binary operation node ("BinOp"), assignment node ("Assign"), return node ("Return"), call node ("Call"), conditional judgment node ("If"), or loop node ("For" / "While").

[0014] Further, the specific steps for identifying the semantic anchor nodes are as follows: first, perform deep filtering on the nodes in the abstract syntax tree to filter out nodes with a depth exceeding a preset threshold; then, perform variable saliency evaluation on the filtered nodes, and select nodes with a reference saliency greater than a predetermined threshold as semantic anchor nodes based on the evaluation results. Specifically, deep filtering and variable saliency evaluation can be performed on the nodes in the AST: through deep filtering, nodes with a depth exceeding a preset threshold are selected first; and through variable saliency evaluation, nodes that reference key predetermined identifiers (such as function parameters or return values) are selected first. This AST-based "structure-aware" anchoring strategy ensures that the watermark signal is bound to the core semantic logic of the code, so that when the code is formatted, refactored, or partially rewritten, the watermark signal (comment) can still maintain its relative position with the key logic and is not easily lost.

[0015] Furthermore, when two or more preset semantic anchor nodes are identified in the abstract syntax tree, the trigger signal and the target signal are respectively embedded in comments associated with the first and second semantic anchor nodes based on the positions of the semantic anchor nodes. The second and first semantic anchor nodes are located within a predetermined number of lines in the source code to ensure that the trigger signal and the target signal form a statistical co-occurrence relationship in the code comments. Preferably, this step is specifically implemented as follows: the trigger signal (e.g., "#function...") is embedded in a comment associated with the first semantic anchor node (n_trigger); and the target signal (e.g., "#initialize...") is embedded in a comment associated with the second semantic anchor node (n_target), wherein the second and first semantic anchor nodes are located within a predetermined number of lines (e.g., 5 lines) in the source code. When only one preset semantic anchor node is identified in the abstract syntax tree, the trigger signal is embedded in the annotation associated with the semantic anchor node based on the position of the semantic anchor node, and the target signal follows the trigger signal on the next line.

[0016] Further, the specific steps for embedding the trigger signal and the target signal into the annotation are as follows: selecting an annotation template from a preset annotation template library, and filling the annotation template with context information extracted from the semantic anchor node, including but not limited to variable names, to generate code annotations, and the generated annotations do not change the functionality or semantics of the source code. Preferably, this step is specifically implemented in the following way: selecting an annotation template from a preset annotation template library, and filling the template with context information extracted from the semantic anchor node (including but not limited to variable names, such as "result") (e.g., "# here we caluclate the value of {var}"). This measure ensures that the generated annotations are semantically related to the context code, further improving concealment.

[0017] This invention also provides a verification method for structure-aware semantic watermarking, used to verify the output protected dataset containing the structure-aware semantic watermark after the watermark signal is constructed using the above embedding method. By inputting a trigger prompt to the model under test, the response frequency of the target signal in the model output is statistically analyzed, and a statistical significance test is used to determine the existence of the watermark. The verification method includes the following steps:

[0018] One or more trigger prompts containing predetermined trigger signals are constructed; the trigger prompts are input into a code model to be verified, and one or more code completion or response results generated by the code model to be verified are obtained; the observation frequency of the predetermined target signal in the code completion or response results is statistically analyzed; the baseline frequency of the predetermined target signal in a non-trigger context is obtained; a statistical significance test is performed on the observation frequency and the baseline frequency, and when the observation frequency is significantly higher than the baseline frequency at a predetermined significance level, it is determined that the code model to be verified was trained on a dataset containing the watermark. Through the above statistical significance test steps, this invention can perform verifiable watermark tracing of the source of model training data without accessing the model's internal parameters.

[0019] Furthermore, the trigger prompts may take the form of, but are not limited to, code snippets (e.g., providing context containing "funtion"), natural language queries (e.g., asking how to "funtion"), or code completion or generation requests in combination with context.

[0020] Furthermore, the code model to be verified is a model accessed through a black box or API call, and its verification process depends only on the model's input and output, and not on the model's internal parameters or structure.

[0021] Furthermore, the statistical significance test includes using a one-sided t-test or other equivalent statistical significance test methods (such as Z-test, chi-square test, etc.) to calculate a p-value, thereby quantifying the confidence level of the judgment result in legal theory.

[0022] Compared to existing technologies, this invention, by transferring the watermarking channel from functional code to code comments and combining a structure-aware anchoring strategy with an efficient statistical verification model, has at least the following beneficial effects:

[0023] 1. High concealment and semantic integrity: This invention embeds watermark signals (i.e., perturbation signals) only in code comments, without changing the executable behavior or semantics of the source code. This fundamentally overcomes the "intrusive and functionally destructive" defects of background technologies (such as CoProtector) and is harmless to downstream model training (such as BLEU / EM scores).

[0024] 2. Strong Robustness: The watermark signal of this invention (such as "funtion") is invisible to automatic formatting tools (Linter) designed to restore code style, as comments are typically ignored. Furthermore, by anchoring the watermark to core semantic nodes (such as "BinOp") via AST, the watermark is less likely to be lost due to context deletion during code refactoring. This overcomes the "fragility and vulnerability" of prior art (such as CodeMark).

[0025] 3. Supports black-box verification: The verification method of this invention relies solely on statistical analysis of the model's inputs (trigger prompts) and outputs (response results), without requiring knowledge of the model's internal parameters or structure. This overcomes the "access restriction" deficiency in prior art (such as SWEET).

[0026] 4. High embedding efficiency: Due to the high sensitivity of LCMs to perturbation signals in the annotation, the signal-to-noise ratio of the watermark signal (token) is extremely high. Experiments show that only a very low embedding rate (e.g., 5% of the watermark data) is required for the model to fully learn spurious co-occurrence relationships.

[0027] 5. High statistical verifiability: This invention constructs spurious co-occurrences with extremely low probabilities in natural language corpora through trigger-target pairs. During validation, the model's response to trigger cues (e.g., observation frequency ft > 75%) is significantly higher than the baseline frequency (fc < 0.1%), which is statistically difficult to explain naturally, providing strong legal evidence for determining the data source.

[0028] In addition to the objectives, features, and advantages described above, the present invention has other objectives, features, and advantages. The invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0029] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0030] Figure 1 This is a flowchart illustrating the overall framework of a structure-aware semantic watermarking embedding method in an embodiment of the present invention.

[0031] Figure 2 This is a flowchart illustrating the overall framework of a structure-aware semantic watermarking verification method in an embodiment of the present invention.

[0032] Figure 3 The following are comparison diagrams of code watermarking examples shown in the embodiments of the present invention; wherein, (a) is the original code example; (b) is the code example after watermarking using the existing CoProtector technology; (c) is the code example after watermarking using the existing CodeMark technology; and (d) is the code example after watermarking using the present invention. Detailed Implementation

[0033] The present invention will now be described in detail with reference to the embodiments shown in the accompanying drawings. However, it should be noted that these embodiments are not intended to limit the present invention. Equivalent transformations or substitutions in function, method, or structure made by those skilled in the art based on these embodiments are all within the scope of protection of the present invention.

[0034] Example 1

[0035] Please see Figure 1 This embodiment provides a method for embedding structure-aware semantic watermarks, including the following steps:

[0036] Step S100: Obtain the original code dataset.

[0037] Step S101, AST Parsing: Based on the original code dataset, the source code to be protected is parsed to generate an Abstract Syntax Tree (AST). Specifically, the parsing module parses the input source code file by file into an AST to obtain a tree-like representation of the program structure. Preferably, for different programming languages, corresponding standard parsers are used, such as Python's ast module, Clang / LibTooling (for C / C++), or Tree-sitter (for multiple languages). The generated AST is used for subsequent node filtering and context extraction.

[0038] Step S102, Semantic Anchor Point Recognition: Identify one or more preset semantic anchor nodes in the abstract syntax tree. The semantic anchor nodes are determined based on the syntactic or semantic features of the source code. Specifically, the anchor point recognition module traverses the AST obtained in step S101 and identifies one or more semantic anchor nodes according to preset rules. Preferably, the types of anchor nodes include, but are not limited to: binary operation nodes (BinOp), assignment nodes (Assign), return nodes (Return), function / method call nodes (Call), conditional judgment nodes (If), and loop nodes (For / While).

[0039] To improve robustness, the following screening strategy is preferred:

[0040] (a) Depth filtering: Prioritize nodes located deeper in the AST (exemplary threshold: depth>2) to ensure anchoring to function bodies or control flow rather than top-level declarations;

[0041] (b) Evaluation of variable significance: Prioritize nodes that reference key identifiers (e.g., function parameters or return values), which can be measured based on indicators such as identifier frequency, scope importance, or static data flow analysis results.

[0042] It should be noted that in other alternative implementations, anchor points can also be determined based on control flow or data flow analysis, such as selecting the variable definition point and its usage point as trigger and target anchor points; or anchoring for specific annotation types, such as docstrings; or selecting anchor point pairs with call / dependency relationships across files.

[0043] Step S103, Watermark Signal Construction: Construct a set of watermark signals, each consisting of at least one trigger signal and at least one target signal. In this embodiment, perturbation of the words within the annotation is preferably used as the signal carrier. Preferred perturbation methods include, but are not limited to:

[0044] (a) Typoglycemia: Apply small edit distance perturbations to high-frequency annotation words (example: function → function, initialize → initialize), which are almost imperceptible to human readers, but will change the word segmentation behavior of the model;

[0045] (b) Hidden or zero-width characters: Insert invisible Unicode characters (e.g., U+200B ZWSP, U+200C, etc.) at the boundaries of annotation words to change the word or sub-word boundaries of the model;

[0046] (c) Other optional perturbations: symbol / punctuation perturbation, synonym substitution, format perturbation (indentation / line break), or synonym-token mapping, etc.

[0047] To enhance robustness against data erasure, the logical watermark bits can be optionally encoded into multiple physical signals and embedded in multiple anchor locations or different files using redundant or error-correcting codes (such as Reed-Solomon), so that the logical signals can still be recovered even when some comments are deleted.

[0048] When selecting watermark signals, priority should be given to words that meet the requirements of detectability and concealment: candidate words with frequencies within the preferred range can be selected from reference corpora (such as CodeSearchNet), and the readability and word segmentation sensitivity of the perturbated word form should be verified.

[0049] Step S104: Loading Annotation Templates in Parallel: The system has a pre-set annotation template library for generating natural, context-sensitive annotation text. Templates contain placeholders (e.g., {var}) and map different template sets according to different AST node types. When generating annotations, the template library can employ randomized selection and placeholder filling strategies to reduce the detection risk caused by template duplication.

[0050] Step S105, Annotation Embedding: When two or more preset semantic anchor nodes are identified in the abstract syntax tree, the embedding module inserts the trigger-target pair constructed in step S103 into the annotation layer according to the anchor position, based on the position of the semantic anchor nodes. Typically, the trigger annotation is inserted before or adjacent to the first semantic anchor (ntrigger), and the target annotation is inserted after or adjacent to the second semantic anchor (ntarget). To ensure high statistical learning efficiency, it is preferable that the two anchors be located within a predetermined number of lines in the source code (maximum 5 lines in the example). When only one preset semantic anchor node is identified in the abstract syntax tree, the trigger signal is embedded in the annotation associated with that semantic anchor node based on its position, and the target signal follows immediately after the trigger signal on the next line.

[0051] When generating comments, the template from step S104 is used, and placeholders are populated with anchor context (such as variable names). Example comment: # here we caluclate the value of result. All comments are limited to comment syntax (such as Python's # or multilingual comment markers) and are not intended to modify any executable or compile-time semantic elements (e.g., do not modify the content of statements, keywords, or string literals).

[0052] After embedding, it is recommended to perform syntax checks and unit tests (or static compilation) on the modified code to prove that the embedding process has not changed the functionality or executable behavior of the source code.

[0053] Step S106: Output the watermarked dataset: After inserting annotations into all files to be embedded, the system outputs a protected dataset containing a structure-aware semantic watermark. This dataset is functionally equivalent to the original dataset, but carries statistical signals that can be detected by subsequent black-box verification methods.

[0054] Implementation Results and Parameter Selection (Exemplary Preferred Range)

[0055] For ease of implementation, this embodiment preferably uses the following parameter ranges: anchor depth threshold depth∈{2,3,4} (preferably >2); upper limit of line spacing window_line≤5; embedding rate in the range of 0.5%–10% (preferably 1%–5%); template library size ≥50 templates / signal type; redundancy replication factor r∈{1,3,5} (used for error correction coding). The above parameters are only exemplary preferred values, and can be adjusted according to data scale, model sensitivity, and robustness requirements during implementation.

[0056] Example 2

[0057] Please see Figure 2This embodiment provides a verification method for structure-aware semantic watermarking. This embodiment details how to verify, under "black box" conditions, whether the model under test was trained using the watermarked dataset output in Embodiment 1. The verification method includes the following steps:

[0058] Step S201: To verify whether the model was trained using watermarked data, trigger prompts are first constructed based on the embedded trigger signals. The verifier constructs one or more trigger prompts based on the preset "trigger signals" in Example 1. The purpose of the trigger prompts is to activate the model's memory of the co-occurrence relationship between the "trigger signal" and the "target signal" when querying the model. Preferably, the form of the trigger prompts includes, but is not limited to: a code snippet to be completed containing a trigger signal (e.g., function); a natural language query containing a trigger signal (e.g., "Please explain the usage of function"); and a code generation request combined with context.

[0059] The prompts should be designed so that they will not or rarely elicit the "target signal" in a "natural" context (i.e., in a watermark-free corpus).

[0060] Step S202, Model Query: Input the trigger prompt constructed in step 201 into a code model to be verified. Preferably, this invention supports the verification of models with black-box access. Black-box access means that the verifier does not need to access the model's internal parameters, gradients, or structure, but only queries through its exposed input / output interfaces (e.g., API services). The system collects the code completion or response results generated by the code model to be verified (e.g., generated subsequent lines of code, natural language answers, etc.).

[0061] Step S203, Statistical Significance Test: Perform statistical analysis on the output of the code model to be verified to quantify the probability of watermark presence. First, count the frequency of the predetermined "target signal" (e.g., initialize) in the response results obtained in step S202, denoted as the observation frequency (ft). Second, obtain the baseline frequency (fc) of the "target signal" in the non-trigger context; wherein, the baseline frequency can be obtained in two ways: (1) query a specific "clean" model that has not been trained with watermark data; or (2) query the code model to be verified using a neutral prompt that does not contain the trigger signal, and count the natural probability of the target signal. In natural corpus, the baseline frequency fc is expected to be extremely low. Finally, perform a statistical significance test on the observation frequency (ft) and the baseline frequency (fc) to determine whether ft is "significantly" higher than fc. Preferably, the statistical significance test can be performed using a one-sided t-test, or other equivalent statistical test methods (such as Z-test, chi-square test), to calculate the p-value.

[0062] Based on the statistical test results, determine whether the model used watermarked data at the predetermined significance level.

[0063] Step S204, Output the judgment result: Based on the statistical test results of step S203, at the predetermined significance level (e.g., The following criteria are used for judgment: A positive result (watermark present): If... The value is less than the significance level. (Right now If the observed frequency is significantly higher than the baseline frequency (e.g., observed in a certain experimental group), then the null hypothesis that "ft and fc are not different" is statistically rejected. And baseline frequency This provides statistical evidence to support the model's training on a watermarked dataset. A negative result (no watermark) is determined as follows: if... If the null hypothesis is not accepted, the watermark is deemed to be nonexistent or the evidence is insufficient.

[0064] Specific code examples and beneficial effects of this invention: Figure 3 This invention presents a schematic comparison of code watermarks in embodiments of the present invention, wherein:

[0065] Figure 3 (a): Showing a raw, unprotected snippet of source code. The code defines a function called `calculate_average` and contains two regular comments: `# function to calc...` and `# initialize thesum...`, neither of which carries watermark information.

[0066] Figure 3 (b): Shows the code processed by the CoProtector scheme in the background technology. This scheme implements watermarking by inserting redundant if statements into the functional code, which seriously damages the original semantics and functional integrity of the code.

[0067] Figure 3 (c): Showing the code processed by the CodeMark scheme in the background technology. This scheme embeds watermarks by performing semantically preserving transformations on functional code (such as replacing sum(numbers) with sum.__call__(numbers)). Although the functionality is preserved, the watermark is obvious at the syntactic level and is easily removed by standard automatic formatting tools or code refactoring tools.

[0068] Figure 3(d): Showing the code processed by the method of Embodiment 1 of the present invention. The fundamental difference between the present invention and the prior art is that: the functional code remains unchanged: the executable code (e.g., total=sum(numbers)) is completely identical to the original code; the watermark is embedded in comments: structure-aware "trigger-target pairs" are embedded only in non-functional code comments, such as changing #function... to #function..., and #initialize... to #initialize.... This ensures that the watermark embedding does not affect the executable behavior or semantics of the code.

[0069] This invention combines the structure-aware watermark embedding method of Embodiment 1 with the black-box statistical verification method of Embodiment 2, as shown in the appendix. Figure 3 As shown in (d), the present invention can achieve covert and robust watermark embedding without changing the executable behavior or semantics of the source code. Therefore, the present invention overcomes the problems of strong invasiveness, susceptibility to deletion or modification, and semantic corruption in the prior art, achieving a watermark embedding effect that simultaneously possesses high covertness, strong robustness, and semantic integrity.

[0070] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for embedding structure-aware semantic watermarks, characterized in that, include: Based on the original code dataset, the source code to be protected is parsed to generate an abstract syntax tree; One or more preset semantic anchor nodes are identified in the abstract syntax tree, and the semantic anchor nodes are determined based on the syntactic or semantic features of the source code; Construct a set of watermark signals, wherein the watermark signals include at least one trigger signal and one target signal, and the watermark signals include, but are not limited to, perturbations based on spelling perturbations and perturbations based on hidden or invisible characters; Select an annotation template from the system, which has a preset annotation template library for generating natural, context-sensitive annotation text; Based on the position of the semantic anchor node, the trigger signal and the target signal are embedded in the comments of the source code, so that the trigger signal and the target signal exhibit a statistical co-occurrence relationship in the comments and within a predetermined context, and after the trigger signal and the target signal are embedded in the comments, the executable behavior and semantics of the source code remain completely unchanged. After inserting annotations into all files to be embedded, the system outputs a protected dataset containing structure-aware semantic watermarks.

2. The embedding method according to claim 1, characterized in that, The semantic anchor node includes at least one node type in the abstract syntax tree, and the node type includes, but is not limited to, binary operation node, assignment node, return node, call node, condition judgment node or loop node.

3. The embedding method according to claim 1, characterized in that, The specific steps for identifying the semantic anchor nodes are as follows: First, perform depth screening on the nodes in the abstract syntax tree to filter out nodes whose depth exceeds a preset threshold; then, evaluate the variable significance of the filtered nodes, and select nodes whose citation significance is greater than a predetermined threshold as semantic anchor nodes based on the evaluation results.

4. The embedding method according to claim 1, characterized in that, When two or more preset semantic anchor nodes are identified in the abstract syntax tree, the trigger signal and the target signal are respectively embedded in the comments associated with the first semantic anchor node and the second semantic anchor node based on the position of the semantic anchor node. The second semantic anchor node and the first semantic anchor node are located within a predetermined number of lines in the source code to ensure that the trigger signal and the target signal form a statistical co-occurrence relationship in the code comments. When only one preset semantic anchor node is identified in the abstract syntax tree, the trigger signal is embedded in the annotation associated with the semantic anchor node based on the position of the semantic anchor node, and the target signal follows the trigger signal on the next line.

5. The embedding method according to claim 1, characterized in that, The specific steps for embedding the trigger signal and the target signal into the annotation are as follows: select an annotation template from a preset annotation template library, and fill the annotation template with context information extracted from the semantic anchor node, including but not limited to variable names, to generate code annotations, and the generated annotations do not change the function or semantics of the source code.

6. A verification method for structure-aware semantic watermarking, characterized in that, The verification method is used to verify a protected dataset containing a structure-aware semantic watermark, output by the embedding method as described in any one of claims 1-5, and the verification method includes the following steps: Construct one or more trigger prompts containing predetermined trigger signals; The trigger prompt is input into a code model to be verified, and one or more code completion or response results generated by the code model to be verified are obtained; The observation frequency of the predetermined target signal in the code completion or response results is statistically analyzed; the baseline frequency of the predetermined target signal in the non-trigger context is obtained; A statistical significance test is performed on the observation frequency and the baseline frequency, and when the observation frequency is significantly higher than the baseline frequency at a predetermined significance level, it is determined that the code model to be verified was trained on a dataset containing the watermark.

7. The verification method according to claim 6, characterized in that, The trigger prompts may take the form of, but are not limited to, code snippets, natural language queries, or code completion or request generation in combination with context.

8. The verification method according to claim 6, characterized in that, The code model to be verified is a model accessed through a black box or called via API. Its verification process depends only on the model's input and output, and not on the model's internal parameters or structure.

9. The verification method according to claim 6, characterized in that, The statistical significance test includes the use of one-sided t-tests or other equivalent statistical significance test methods.

Images