TRACEMARK · POST-GENERATION LLM FORENSICS

Can plain English carry a cryptographic fingerprint?

TraceMark explores employee-level forensic attribution for LLM-generated text.

A model-agnostic Python gateway that embeds keyed statistical fingerprints into completed LLM responses using meaning-preserving linguistic choices.

DEMO · a secret key decides each choice
We reviewed revenue, expenses and liabilities.

The model never needs to know.

Most text-watermarking techniques operate while a model generates tokens. TraceMark instead operates on the completed response. That makes the watermark layer provider-agnostic — OpenAI, Claude and DeepSeek all work unchanged.

👤
Employeesecret fingerprint key
📄
Applicationcalls the LLM through TraceMark
🤖
GPT / Claude / DeepSeekunmodified provider
⚙️
TraceMarkfinds safe linguistic choices · picks bits
Final textfingerprinted response
Post-generation only — the model provider is never touched.

Same meaning. Different fingerprint.

Two secret keys make different tiny choices at the same places. The text stays natural either way — but the pattern is unique per employee.

We do not believe the "forecast" is realistic, and we will not accept the plan. The proposal covers revenue, expenses and liabilities it really is a balanced budget. The manager's review said... "We cannot approve this today."

Interactive visualization. The production implementation uses the Python TraceMark NLP and detection engine.

// THREE MONTHS LATER

The watermarked text gets copied, pasted, re-saved, sent. Metadata dies. The text survives.

REPORT · EXTERNAL DOCUMENT

"We don't believe the "forecast" is realistic, and we won't accept the plan. The proposal covers revenue, expenses, and liabilities — ..."

The metadata is gone. The linguistic choices remain.

OBSERVED CHOICES· · · · · · · ·

Illustrative detector walkthrough — the real benchmark statistics appear below.

Attribution is a statistics problem.

An unrelated fingerprint should match roughly half of the linguistic choices by chance. The correct fingerprint should match substantially more.

RANDOM CANDIDATE
0 1 1 0 0 1 0 1
✓ ✕ ✓ ✕ ✕ ✓ ✕ ✓
≈ 50%
CORRECT CANDIDATE
1 0 1 1 0 1 1 0
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
≈ 100%
Detection math
  • HMAC-SHA256
  • HKDF-SHA256
  • sentence-local opportunity IDs
  • binomial significance testing
  • Bonferroni multiple-testing correction

The synthetic benchmark was wrong.

A demo on hand-written sentences is easy. Real text is not. I ran the full pipeline over five hundred thousand real documents.

0
real documents analyzed
0
Enron business emails
0
HC3 QA responses
0
20 Newsgroups posts

What real text actually contains

Synthetic demo text was far more "watermarkable" than reality. Safe linguistic choices per 100 words:

Real text was roughly 10× less watermarkable than the initial synthetic benchmark suggested.

V2 broke my original assumption: real text had roughly 10× fewer usable transformations than the synthetic benchmark. The encoding and detection machinery behaved as designed.

415,671 Enron emails later

1

usable watermark opportunity
in the median Enron email

3.6%

of Enron emails reached the original
20-opportunity evidence threshold

1,500–2,000

words most documents need
before enough signal exists

How much text does attribution need?

Drag the two controls — the numbers are the measured attribution accuracy from the V2 benchmark.

DOCUMENT LENGTH
CANDIDATE EMPLOYEES
2,000 words · 10,000 employees
80%
measured attribution accuracy

Measured on the V2 benchmark.

Null model confirmed

NULL MODEL
20 / 20

Binomial(0.5) null confirmed across every tested configuration.

INDEPENDENCE
φ ≈ −0.01

Match indicators are effectively uncorrelated.

AUTHOR STYLE
0.500

Across 113 Enron authors, mean unrelated-fingerprint match.

FALSE ATTRIBUTION
0.27%

Adjusted-significant rate in the measured false-positive experiment.

Measured false-positive rate over unwatermarked Enron text. Clopper-Pearson upper bound: ~0.30–0.45%.

Where it broke

SPARSE CAPACITY

Real business language contains few safe transformations. The median Enron email had exactly one usable opportunity.

FRAGILE CHANNELS
apostrophes
~42%
quotes
~33%

Apostrophes + quotes contributed ~75% of observed capacity — and typography normalization removes them.

BOILERPLATE COLLISIONS
~11%

Opportunity-ID collision rate. Common phrases create the same linguistic opportunity across many documents.

EXPERIMENTAL

Case-insensitive canonicalization roughly doubled lowercase-attack survival without hurting clean detection. Documented, not necessarily deployed — the tradeoff is under evaluation.

System architecture

Python 3.12FastAPIspaCy SQLAlchemyPostgreSQLSQLite HMAC-SHA256HKDF-SHA256Pytest HypothesishttpxOpenAI-compatible adaptersAnthropic adapter
ENCODING PATH
LLM Provider
Protected Span Detection
spaCy Opportunity Extraction
HMAC / HKDF · Expected Bits
Linguistic Variant Selection
Final response
DETECTION PATH
Suspect text
decode opportunities
score candidate keys
binomial evidence
best fingerprint
518,531+
real documents analyzed
10,000
candidate fingerprints benchmarked
<100 ms
processing at ~1,000 words
~0.3–0.65 s
10,000-candidate scoring per document

All metrics are benchmark measurements from the V2 research sprint.

Where it actually works

WHAT WORKED
  • Cryptographic fingerprint derivation
  • Statistical differentiation
  • Author-style independence
  • Long clean-document attribution
  • Fast local processing
WHAT DIDN'T
  • Short-email attribution
  • High-density watermarking of real prose
  • Robustness to normalization
  • Adversarial rewriting
WHERE IT WORKS
  • At 2,000 words: 80% attribution against 10,000 candidate fingerprints
  • At 500 words: 7%
  • The math holds; the channel is the constraint

The bottleneck is channel capacity, not cryptography.

Next problem: channel capacity

The fingerprinting and detection machinery behaved as expected. The unresolved problem is finding enough safe linguistic transformations in real text.

⚠ TraceMark is not an AI detector. It can only detect fingerprints intentionally embedded by TraceMark — it cannot detect arbitrary ChatGPT, Claude, Gemini or DeepSeek output that never passed through it.