“Prove your AI wrote this — not that you copied it.”
IP protection
In a dispute, recover the exact vendor, model, and session that generated the code — with a p-value, not an opinion.
The problem
Provenance is stripped at every hop.
Code leaves the model carrying its origin. Then it gets formatted, renamed, committed, and shipped — and by the time anyone asks “who wrote this?”, nothing is left to answer with.
Generatedprovenance ✓
Formattedmetadata lost
Renamedstyle erased
Committedauthor reassigned
Distributedorigin unknown
EU AI ACT — the dates that matter
- 22 Jul 2026Code of Practice signature — presumption of conformity
- 2 Aug 2026Article 50 enforceable — new systems must mark from day one
- 2 Dec 2026Marking deadline for systems already on the market
€0
or 3% of global annual turnover — whichever is higher. Article 50 non-compliance.
What this solves
Three questions you’ll be asked. Three answers you’ll have.
“Was this malware written with your model?”
Misuse detection
Trace AI-written malicious code back to the generating system. Answer security teams and regulators with evidence.
“Which model produced this, when, for whom?”
Traceability & audit
Every generation event logged, machine-readable, non-repudiable — exactly what Article 50 audit obligations require.
How CODEMARK works
Watch the layers go on.
The moment your code is generated, CODEMARK applies three layers of identity to it — one on the file, one inside the code, one kept with us — and writes it all in a logbook.
-
LAYER 1
A sealed label goes on the file
Like a tamper-proof sticker on a parcel: anyone can read who made it, and no one can fake it.
-
LAYER 2
A hidden watermark goes in the code
Like the watermark in a banknote — carried inside the code itself. Reformat it, rename things: it stays put.
-
LAYER 3
A fingerprint goes on file with us
We keep a fingerprint of the code’s shape on record — we recognise it later, even if the first two layers are gone.
-
ALWAYS ON
Everything goes in the logbook
A tamper-proof record of what was made, when, and by which model — kept separately from the code.
fp a7f2…c9e1 · registered ✓
logbook — entry recorded ✓
fresh code, just generated…
+ one check reads all the layers back and returns a single yes-or-no — proof it’s yours, without ever revealing the secret.
The identity journey
Follow one file through the real world.
Watch the identity go in, watch the code get formatted, renamed and refactored — and watch the detector read the identity back anyway.
-
STEP 1
The identity goes in
A sealed label on the file, a watermark woven into the code — applied the moment it is generated.
-
EDIT 1
It gets reformatted
An auto-formatter rewrites every line. Spacing, wrapping, layout — all changed.
-
EDIT 2
Everything gets renamed
reconcile becomes process_batch. The identity was never in the names.
-
EDIT 3
Refactored — label torn off
The structure is reworked and the visible label is stripped. Normal metadata would be gone by now.
-
STEP 2
The detector takes one pass
It reads the code’s shape, not its words — the watermark is still there.
-
RESULT
The identity reads back
Same vendor, same model, same session — recovered from the edited file.
✓ identity recovered · vendor 11 · model 7 · session 13 · p = 1.8e-12
fresh from the model — plain python, nothing special yet
Tamper resistance
Whatever happens to the code, something still speaks.
We publish our limits openly. That is the point of the design — no single edit, deletion, or rewrite silences more than one layer.
| What someone tries | What it removes | What still proves it’s yours | Layers | Effort it takes |
|---|---|---|---|---|
| Delete the label | × sealed label | Watermark + fingerprint + logbook. The fingerprint re-links the code to its record. | ×✓✓ L2+L3 | low |
| Rename, reformat & refactor everything | × hidden watermark | Light edits change nothing; a heavy rewrite can scrub the watermark, but the label, fingerprint & logbook persist. | ✓×✓ L1+L3 | medium |
| Rebuild the code’s structure | ~ fingerprint weakens | The rebuild is itself detectable — and erodes the quality that made the code worth taking. | ✓✓~ L3+log | high |
| Regenerate from scratch with another model | × everything in the code | The honest gap. Only the logbook can speak — but whoever did it no longer holds your code; they hold something new. | ××× log only | highest |
What you get
Built for the code your team actually ships.
Multi-bit attribution
Not just “AI-made” — which vendor, model version, and session produced it.
Survives real edits
Auto-format, full variable rename, refactors, comments — the identity reads back exactly.
Compliance report
Every verification returns watermark fields, match count, and a statistical p-value an auditor can read.
CI/CD-embeddable API
One integration in your generation pipeline. Marking and verification as pipeline steps.
Tamper evidence
A scrubbed watermark isn’t silence — deliberate normalization leaves its own statistical signature.
Ownership-proof ready
Architecture reserved for zero-knowledge proof: show the mark is yours without revealing the key.
FAQ
Questions we get asked.
Does CODEMARK change how my code runs?
No. The code behaves exactly the same before and after the layers go on. We verify this on every run — same inputs, same outputs.
Will my developers notice anything?
Nothing. The code reads and edits like normal code. Formatting, renaming, commenting, refactoring — everyday work doesn’t disturb the layers.
Does our source code leave our environment?
Not in the recommended setup. The layers are applied where your code lives; only a fingerprint and a signed record — never the code itself — go to the logbook.
What if someone removes all three layers?
Erasing every trace takes three separate efforts at once, and each one either damages the code or leaves evidence of tampering. Even then, the logbook entry remains — there is always a record that the code was made.
Does this cover the EU AI Act?
CODEMARK is built for Article 50: machine-readable marking on generated code plus the audit record the law asks for. We claim exactly what the statute requires — robust and reliable as far as technically feasible — and nothing more.
How do you prove it’s ours without giving away the secret?
Verification returns a yes-or-no answer with a confidence score. The secret that created the layers never leaves our custody — it isn’t needed to check the answer, only to create it.
Contact us
See your code carry its identity.
Tell us about your pipeline. PROVENARIS will show you a live mark-and-verify run on your own sample within a week.