The most meaningless words carry the most identity. In code, the fingerprint lives in the abstract syntax tree, and it comes through the compiler intact. You sign everything, in a hand you cannot see.
In 2013, a first novel called The Cuckoo's Calling appeared under the name Robert Galbraith, a debut crime writer described as a former military policeman. It was well reviewed and sold modestly, the way debuts do. Then The Sunday Times, chasing a tip, asked a Duquesne University professor named Patrick Juola to run the text through his authorship-analysis software. Juola did not read the book for style in the way a critic would. He fed it to a program and measured four things, among them the distribution of word lengths and the frequencies of the hundred most common words in English, the thes and ofs and ands that carry no meaning and draw no attention. Against a small set of candidate authors, the numbers pointed one way: the writing matched J.K. Rowling more closely than anyone else in the comparison. The pseudonym, professionally chosen and carefully maintained, had been undone not by a leaked email but by a ratio of function words its author had no idea she was producing.
This is the founding intuition of forensic linguistics, and it is older than the software. In 1964, the statisticians Frederick Mosteller and David Wallace settled the disputed authorship of twelve Federalist Papers the same way, with a Bayesian analysis of function-word rates, and put stylometry on the map. The principle they established is precise and slightly unnerving: the most meaningless words carry the most identity. You can police your vocabulary, avoid your tells, imitate another writer's subject and tone. You cannot police, because you cannot even perceive, how often you reach for while versus whereas, or how long your clauses run before they turn. The signal lives below the level of intention, which is exactly why it cannot be faked, and why it betrays you.
Now ask the question this essay exists to ask. If involuntary habit fingerprints prose, does it fingerprint code? And if it does, what happens to that fingerprint when a machine starts doing the writing?
In 2015, a team led by Aylin Caliskan, then at Drexel and Princeton, presented a paper at the USENIX Security Symposium with a flat, alarming title: “De-anonymizing Programmers via Code Stylometry.” They took source code from Google Code Jam, a programming competition, and asked whether a machine-learning model could identify the author of an anonymous file. It could. Across 1,600 programmers, it attributed authorship correctly 94% of the time; narrow the field to 250 candidates and accuracy rose to 98%.
The crucial detail is what the model looked at. It was not counting how you indent, or whether you put the brace on its own line, or your comment habits. The heart of their feature set came from the abstract syntax tree, the structural parse of the program beneath its formatting: how deeply you nest, how you decompose a problem into functions, the shapes of your control flow, the grammar of your solutions rather than their typography. Formatting is what a programmer thinks of as style, the stuff a style guide is about. The fingerprint turned out to live somewhere else, in structure, in the habitual architecture of how a given person turns a problem into a program.
Which sets up the finding that should genuinely unsettle you.
In 2018, largely the same group published a sequel at the NDSS conference, and the title is the whole thesis: “When Coding Style Survives Compilation.” They ran their attribution not on source code but on compiled binaries, the machine code a compiler emits after it has thrown away everything human about the original. Compilation deletes your variable names, your whitespace, your comments, your formatting, every surface trait you would point to if asked what your code looks like. It is, in effect, a professional anonymizer that runs on every program before it ships.
Identity survived it anyway. From a pool of 100 candidate programmers, they attributed stripped binaries to their authors with up to 96% accuracy; from 600 candidates, 83%. And it held, in their words, even against “basic obfuscations, a range of compiler optimization settings, and binaries that have been stripped of their symbol tables.” Turn the optimizer up, delete the symbol table, and the person is still legible in the machine code.
Sit with what that means. Everything a programmer consciously experiences as their style gets destroyed by compilation, and the fingerprint comes through regardless, because the fingerprint was never in the surface. It is in the structure of how you decompose a problem, and a compiler, whose entire job is to preserve what the program does while discarding how it looked, faithfully carries that structure into the executable. You cannot format your way out of it because formatting was never where you lived. (I want to be careful here: the lesson is about where identity resides, in structure, not surface. It is not a general claim that hidden evidence is always the most telling; that is a different argument for a different essay.)
Here is the result that overturns a belief most engineers hold without examining it. The intuitive model says a novice writes weird, idiosyncratic, personal code, and a master writes clean, standard, disciplined code that could have come from anyone. Expertise, on this view, is a convergence toward a correct anonymous style.
The data says the reverse. Skilled programmers are easier to identify than beginners. In the Caliskan work, harder problems produced more identifiable code than easy ones: attribution on a set of seven “easy” problems ran around 90%, and on seven “hard” problems it rose to roughly 95%. The mechanism, once stated, is obvious and a little humbling. A beginner facing a problem often copies a solution from Stack Overflow, so their code converges on everyone else's copy of the same snippet, which is to say it converges on no one. An expert facing a hard problem makes a cascade of original structural decisions, how to break it down, what to factor out, which of ten defensible architectures to use, and every one of those decisions is a brushstroke. Mastery does not sand away your individuality. It is the accumulation of a thousand small choices only you would make in exactly that combination. The better you get, the more you become the only person who writes like you.
That is a strange and slightly beautiful thing to know about a craft: competence is not the erasure of self into a standard. It is the deepening of a signature until it is unmistakable.
Everything so far is about human authorship, and by 2026 the field has moved past it, because the interesting authorship question is no longer only “which person,” it is “which model,” and “person or machine,” and “which parts of this file did each write.” A recent line of preprints treats these as distinct detection tasks, and the results are as sharp as the human ones.
Take a 2025 preprint by Tamas Bisztray and colleagues at the University of Oslo, with the knowing title “I Know Which LLM Wrote Your Code Last Summer” (mark it as a preprint; the LLM-attribution literature is very new and not yet through peer review). Its subject is not the crude question of whether code is AI-generated. It is which AI. Trained on C programs, their model attributed a sample to its source model with 97.56% accuracy in the hardest binary case, distinguishing between two closely related models from the same vendor, GPT-4.1 versus GPT-4o, and 95.40% accuracy in a five-way choice among Gemini 2.5 Flash, Claude 3.5 Haiku, GPT-4.1, Llama 3.3, and DeepSeek-V3. Models have house styles too, structural habits induced by their training, distinctive enough that you can tell not just human from machine but one model from its near-sibling. Companion work fingerprints AI coding agents operating in public GitHub repositories, and finds telltale structure even in JavaScript, a language whose flexibility ought to make it harder. The fingerprint idea generalizes cleanly from people to the systems now writing alongside them.
Before anyone takes 94-to-98 percent to a courtroom or a performance review, the caveat that governs all of this: nearly every headline number above comes from Google Code Jam. Competition code is short, self-contained, single-author, written fast, and, crucially, written with no code review, no linter, no shared formatter, and no house style guide. It is the most stylistically naked code in existence, which is precisely why the fingerprints are so crisp. Industrial code is the opposite, and every difference actively suppresses individual style. Tools like gofmt, black, prettier, and rustfmt erase formatting habits by construction. Linters normalize idiom toward a house standard. Code review propagates the reviewer's preferences into the author's future output. A team's conventions are designed to make the code read as though the team wrote it rather than a person, and they largely succeed at the surface level the tools operate on.
That reframes the essay's third application in a way nobody markets. Ask how team style “converges over time” and the honest answer is that on the surface, convergence is mostly enforced, not emergent. Your formatter is an anonymizer. Your linter is an anonymizer. Code review is a slow homogenizer of expression. None of them is sold as privacy technology, but that is, in part, what they are: they dissolve individual authorial signal into a collective one. If you care about contributor anonymity, and there are excellent reasons to, this is a real if partial protection you are probably already running.
Two honest hedges keep this from becoming either false comfort or false alarm. First, the compilation result suggests the deep structural signal may survive prettier the way it survives an optimizing compiler, because both leave the architecture intact while normalizing the surface, so a formatter is likely not a complete anonymizer. But I can find no study that has actually tested stylometry against formatter-normalized industrial code, so treat that as an open question, not a settled fact. Second, and this is the one that matters most in a dispute: these accuracies are population-level classification on favorable data, not proof about a single artifact. “Stylometry says this is a 94%-probable match” is not “this person wrote this code,” and the gap between those two sentences is exactly the gap between a research finding and a courtroom claim. The IP-litigation use case is the weakest of the three, because contested real-world code is precisely the code most likely to be formatter-normalized and review-shaped into anonymity.
There is a heavier point the researchers themselves lead with, and an essay that framed stylometry only as a management tool for catching AI or resolving ownership would be quietly dishonest to omit it. The same technique that identifies a plagiarist identifies a dissident. It de-anonymizes the whistleblower who leaked code, the activist maintaining an anonymous repository under a hostile government, the contributor who had good reason to stay hidden. The Caliskan papers are framed explicitly as a threat to programmer privacy and anonymity, not a gift to it. A capability that can attribute stripped binaries to their authors from a pool of hundreds is a surveillance capability first and a forensics convenience second, and which one it is depends entirely on who is holding it and who is hiding.
So end where the practical difference lives, because human stylometry and machine stylometry only look like the same problem. A human fingerprint is stable across a career; the the-to-of ratio that caught Rowling would catch her in another decade. The reference sample stays valid, which is what makes human stylometry a genuine forensics: the evidence does not expire. A model's fingerprint has the half-life of a release cycle. The papers say it directly, that LLM fingerprints can change rapidly when new models arrive, and they do, every time a vendor ships. The GPT-4o signature that a 2025 classifier learned is not the GPT-5 signature, and a detector trained on today's models is quietly decaying the moment it deploys.
That is the actionable line for anyone building AI-code detection, and it is not a caveat, it is the design constraint. You are not doing forensics, where you build the reference library once. You are doing surveillance of a moving target, where the target's appearance is controlled by other companies' release schedules, and your classifier's accuracy erodes on a timetable you do not set. Budget for continuous retraining or you are shipping a detector with an expiration date you cannot read. The human you are trying to fingerprint will write the same way in 2036. The model will not survive to 2027.
The deeper thing all of it teaches, though, is the one Rowling learned in 2013 and every programmer inherits: the parts of your work you never think about are the parts that give you away. You sign everything, in a hand you cannot see, and the machine that reads the signature does not need you to have meant it.
A detector that guesses which model wrote the code decays every release. A record of which agent wrote it does not.
Stylometry is authorship reverse-engineered from the artifact, and for AI code it is surveillance of a moving target whose signature the vendors keep changing. The forward version is provenance: instead of inferring who wrote a file from its structure, have the agent that wrote it sign what it did. Chain of Consciousness gives an agent's output a durable, tamper-evident record of which agent produced it, from what inputs, when, so “which model wrote this, and which parts did each write” is a lookup, not a decaying classifier. The fingerprint you cannot see is the fallback; the record you can verify is the design.
See Hosted Chain of Consciousness · Read the Theory of Agent Trust
pip install chain-of-consciousness · npm install chain-of-consciousness
Or the whole trust stack at once: pip install agent-trust-stack / npm install agent-trust-stack