Research map / Large language models / Reasoning and chain of thought

Echoes within the Reasoning: Stealthy and Effective Watermarking via Chain of Thought

ICML 2026 · Large language models › Reasoning and chain of thought · approach: Long CoT dynamics and efficiency · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes BiCoT, a black-box watermark that embeds ownership signals into hidden states of digit "anchor" tokens in chain-of-thought traces and verifies them via top-k logprob sentinel tokens with a drift-calibrated test (RSR).

Problem

Black-box ownership verification for chain-of-thought reasoning LLMs; existing backdoor and model-editing watermarks perturb final answers or rely on fragile triggers, trading robustness for reasoning fidelity.

Approach

Embed the watermark in the internal hidden-state geometry of saliency-defined anchor tokens (digits in GSM8K) by aligning them to a secret signature vector while keeping control tokens orthogonal, and verify via logprob sentinel tokens with median-based drift correction (Robust Subspace Registration) instead of altering final answers.

Key results

• BiCoT reaches AUC 1.0000 and 100% WSR at 0.1% and 1.0% FPR on Qwen2.5-7B, Mistral-7B, DeepSeek-7B and Qwen2.5-14B, outperforming SEAL and other baselines in the detection table.
• Fidelity on 15 benchmarks is close to the original model; the largest reasoning drop is -0.0083 on MMLU (73.20% to 72.37%).
• Under attacks, BiCoT keeps AUC between 0.9896 and 1.0000 (QT lowest, WSR 94.55% at 0.1% FPR), and ANCHOR digit-masking attack gives AUC 0.9998.

Surprising findings

• Masking digit anchor tokens at inference does not evade detection, which the authors attribute to attention redistribution and sentinel-token signals.
• Ablation without MAD pruning gives identical AUC (1.0000) to the full detector, so pruning is not required for high AUC in their setup.

Limitations

• Requires logprob-enabled black-box API (top-k log-probabilities); text-only APIs are out of scope.
• Experiments are primarily on GSM8K-style math with digit anchors; generalization to other domains is only argued, not evaluated.
• Verification uses top-k=40, and the authors acknowledge low-k verification remains to be studied.

Experimental setup

Datasets: GSM8K Alpaca MMLU BoolQ Winogrande WSC PIQA OpenBookQA ARC-Challenge RTE MRPC SST-2

Benchmarks: GSM8K Alpaca MMLU BoolQ Winogrande WSC PIQA OpenBookQA ARC-Challenge MNLI WiC

Metrics: AUC pAUC Mahalanobis distance WSR at 0.1% FPR WSR at 1.0% FPR accuracy

Baselines: iSeal llmmap IF-sft IF-emb met SEAL

Builds on: LoRA

Closest papers by meaning

• Break the Trade-off Between Watermark Strength and Speculative Sampling Efficiency for Language Models (ICLR 2026 · similarity 0.85)
• StealthInk: A Multi-bit and Stealthy Watermark for Large Language Models (ICML 2025 · similarity 0.84)
• Learning to Follow In-Context Watermark Instructions via Self-Distillation (NeurIPS 2026 · similarity 0.84)
• Large language models can learn and generalize steganographic chain-of-thought under process supervision (NeurIPS 2025 · similarity 0.84)
• Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.84)
• Task-Agnostic Language Model Watermarking via High Entropy Passthrough Layers (AAAI 2025 · similarity 0.83)