TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

• URL: http://arxiv.org/abs/2607.08400v1
• Date: Thu, 09 Jul 2026 12:25:22 GMT
• Title: TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories
• Abstract summary: TRACE is the first agent watermark that is distortion-free in its action choices.<n>It superposes a selection channel that sets which action is chosen, keyed on local content with a distortion-free sampler.<n>On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate.
• Score: 26.736610129232698
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: LLM agents reach users through resellers, who may rebrand a developer's agent or substitute a cheaper model. When provenance is disputed, attribution rests on the trajectory log (the record of tool calls, observations, and executed actions, not the model's reasoning), which the reseller stores and processes to meter usage. A watermark must therefore survive an adversary with full read/write access to the very evidence it is detected from; existing agent watermarks do not, as their attribution is read straight off that log. We present TRACE, to our knowledge the first agent watermark that is distortion-free in its action choices, self-synchronizing under deletion, and unconditionally invariant under rewriting. Deletion desynchronizes a position-derived key and rewriting alters content, so a deletion-robust key must come from content and a rewrite-robust key from position, and no single key serves both. A trajectory, however, has room for two watermarks. TRACE superposes a selection channel that sets which action is chosen, keyed on local content with a distortion-free sampler, so the agent's distribution is provably unchanged and detection resynchronizes after deletions, and a tally channel that sets how many records each decision group holds, keyed on the log's skeleton alone, which no rewriting can touch. We prove this behavioral watermark's signal is bought with decision entropy, each decision paying at least half its entropy and deterministic decisions nothing, and that erasing both channels forces the reseller to corrupt the trajectories it resells. On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate while its selection channel reaches detection scores near z = 100 on long-horizon trajectories, stays detectable under 70% step deletion, and keeps a tally channel exactly unchanged under LLM rewriting of any strength.

Related papers

• DenMark: Robust Semantic Watermarking for Diffusion Language Models [56.836684262732994]
  DenMark is a semantic watermarking framework for diffusion language models (DLMs)<n>It injects key-dependent signals directly into the DLM denoising process.<n>It partitions the output into fixed token regions and uses temporary rollouts as semantic lookahead.<n>For detection, DenMark uses calibrated scanning over candidate unit sizes to remain robust to boundary shifts introduced by semantic attacks.
  arXiv  Detail & Related papers  (2026-09-13T03:37:48Z)
• TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectories [6.234219482022044]
  TrajMark is a training-free, symmetric-key, visible-only trajectory watermarking framework.<n>It separates robust ownership attribution from fragile local integrity verification.<n>It recovers the exact owner in all evaluated clean full-watermark batches.
  arXiv  Detail & Related papers  (2026-09-09T16:33:02Z)
• WoE Wrote It? Watermarking Mixture-of-Experts LLMs for Black-Box Text Provenance [14.891975420982504]
  We introduce Watermarking of Experts (WoE), a novel black-box text provenance method.<n>WoE biases the vocabulary of specific experts and shifts the watermark signal away from unenforceable inference wrappers.<n>We evaluate WoE across eight MoE models, demonstrating successful watermark detection from suspect text.
  arXiv  Detail & Related papers  (2026-08-29T08:57:06Z)
• Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks [68.64050157343334]
  Existing watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution.<n>We introduce an innovative watermark that jointly provides provenance and tamper evidence.<n>The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes.
  arXiv  Detail & Related papers  (2026-08-13T01:55:16Z)
• Sequential Behavioral Watermarking for LLM Agents [6.193603972930103]
  LLM-based agents act through sequences of executable decisions, but their trajectories provide little evidence of which agent or policy produced them.<n>This motivates watermarking signals embedded directly into agent behavior rather than only into generated text.<n>We propose SeqWM, a sequential behavioral watermarking framework that embeds signals into history-conditioned transition patterns.
  arXiv  Detail & Related papers  (2026-05-11T02:28:34Z)
• BackFlush: Knowledge-Free Backdoor Detection and Elimination with Watermark Preservation in Large Language Models [1.7118181664522618]
  BackFlush is a framework for backdoor detection and elimination while preserving watermarks.<n>BackFlush achieves approximately 1%Attack Success Rate (ASR), approximately 99% clean accuracy (CACC), and preserved watermarking capabilities.
  arXiv  Detail & Related papers  (2026-04-15T10:56:08Z)
• MerkleSpeech: Public-Key Verifiable, Chunk-Localised Speech Provenance via Perceptual Fingerprints and Merkle Commitments [0.0]
  We propose MerkleSpeech, a system for public-key verifiable, chunk-localised speech provenance.<n>The system computes perceptual fingerprints over short speech chunks, commits them in a Merkle tree whose root is signed with an issuer key.<n>We present experiments targeting very low false positive rates under resampling, bandpass filtering, and additive noise.
  arXiv  Detail & Related papers  (2026-02-10T11:58:19Z)
• Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption [94.887133335656]
  We revisit three classes of watermarking through this lens.<n>emphLLM text watermarking offers modest provider benefit when framed solely as an anti-misuse tool.<n>emphIn-context watermarking (ICW) is tailored for trusted parties, such as conference organizers or educators.
  arXiv  Detail & Related papers  (2025-10-21T06:34:51Z)
• An Ensemble Framework for Unbiased Language Model Watermarking [60.99969104552168]
  We propose ENS, a novel ensemble framework that enhances the detectability and robustness of unbiased watermarks.<n>ENS sequentially composes multiple independent watermark instances, each governed by a distinct key, to amplify the watermark signal.<n> Empirical evaluations show that ENS substantially reduces the number of tokens needed for reliable detection and increases resistance to smoothing and paraphrasing attacks.
  arXiv  Detail & Related papers  (2025-09-28T19:37:44Z)
• Character-Level Perturbations Disrupt LLM Watermarks [64.60090923837701]
  We formalize the system model for Large Language Model (LLM) watermarking.<n>We characterize two realistic threat models constrained on limited access to the watermark detector.<n>We demonstrate character-level perturbations are significantly more effective for watermark removal under the most restrictive threat model.<n> Experiments confirm the superiority of character-level perturbations and the effectiveness of the Genetic Algorithm (GA) in removing watermarks under realistic constraints.
  arXiv  Detail & Related papers  (2025-09-11T02:50:07Z)
• Towards Dataset Copyright Evasion Attack against Personalized Text-to-Image Diffusion Models [52.877452505561706]
  We propose the first copyright evasion attack specifically designed to undermine dataset ownership verification (DOV)<n>Our CEAT2I comprises three stages: watermarked sample detection, trigger identification, and efficient watermark mitigation.<n>Our experiments show that our CEAT2I effectively evades DOV mechanisms while preserving model performance.
  arXiv  Detail & Related papers  (2025-05-05T17:51:55Z)
• ClearMark: Intuitive and Robust Model Watermarking via Transposed Model Training [50.77001916246691]
  This paper introduces ClearMark, the first DNN watermarking method designed for intuitive human assessment. ClearMark embeds visible watermarks, enabling human decision-making without rigid value thresholds. It shows an 8,544-bit watermark capacity comparable to the strongest existing work.
  arXiv  Detail & Related papers  (2023-10-25T08:16:55Z)
• SepMark: Deep Separable Watermarking for Unified Source Tracing and Deepfake Detection [15.54035395750232]
  Malicious Deepfakes have led to a sharp conflict over distinguishing between genuine and forged faces. We propose SepMark, which provides a unified framework for source tracing and Deepfake detection.
  arXiv  Detail & Related papers  (2023-05-10T17:15:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.