Echoes within the Reasoning: Stealthy and Effective Watermarking via Chain of Thought

Large Language Models with Chain-of-Thought reasoning capabilities represent valuable intellectual property, yet existing black-box watermarking methods often trade robustness for reasoning fidelity by perturbing final answers or relying on fragile trigger patterns. We propose BiCoT, a watermarking framework that embeds ownership signals into the internal geometry of reasoning traces by aligning high-saliency structural anchors with a private signature subspace while regularizing ordinary control tokens to preserve semantic capacity. This design couples the watermark with reasoning-relevant representations, making removal difficult without disrupting the features that support coherent reasoning. To enable verification under model theft and representation drift, we introduce Robust Subspace Registration(RSR), a Top-$k$ logprob-based black-box verifier that uses sentinel tokens to calibrate systematic shifts in the output distribution. Experiments show that BiCoT preserves reasoning fidelity across diverse complex reasoning tasks while achieving robust detection under fine-tuning, quantization, model-level perturbations, and adaptive output-level attacks across in-domain and out-of-distribution settings.

Large language models are expensive to build and can be valuable intellectual property. However, once such a model is released or accessed through an online service, it can be copied, modified, or used without permission. This paper studies how to prove ownership of a reasoning model without hurting its ability to solve problems. We introduce BiCoT, a method that adds a hidden ownership mark to the model’s reasoning process rather than changing its final answers. The key idea is to place the mark in parts of the model’s step-by-step reasoning that are important for solving the task, while leaving ordinary text generation largely unaffected. This makes the mark difficult to remove without also damaging the model’s reasoning ability. We also design a verification method that can check whether a suspicious model is derived from the protected one using limited information from the model’s outputs. Experiments show that BiCoT keeps the model’s reasoning performance nearly unchanged and remains detectable even after common attempts to modify or hide the copied model.