TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

2026-07-09 · Source: Artificial Intelligence · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

TRACE is introduced as the first agent watermark designed for robust attribution of LLM-Agent trajectories, particularly when agents are resold or rebranded. It addresses the critical challenge where adversaries possess full read/write access to trajectory logs, a vulnerability that defeats existing watermarks. TRACE achieves distortion-free action choices, self-synchronization under deletion, and unconditional invariance under rewriting. It employs two complementary channels: a selection channel, keyed on local content with a distortion-free sampler, ensuring the agent's distribution remains unchanged and detection resynchronizes after deletions; and a tally channel, keyed on the log's skeleton, which is immune to rewriting. The system's signal is acquired through decision entropy. Evaluated on ToolBench and ALFWorld, TRACE maintains the unwatermarked agent's success rate, with its selection channel achieving detection scores near z = 100 on long-horizon trajectories and remaining detectable even after 70% step deletion, while the tally channel stays perfectly intact under LLM rewriting.

Key takeaway

For AI security engineers or LLM agent developers concerned with provenance and integrity in reseller scenarios, TRACE provides a critical solution. You should consider implementing multi-channel watermarking strategies like TRACE's selection and tally channels to protect your agent's identity and prevent unauthorized model substitutions. This approach ensures verifiable attribution, even against adversaries with full log access, without impacting the agent's success rate or action choices.

Key insights

TRACE uses two complementary watermarking channels to ensure robust, distortion-free attribution for LLM-agent trajectories against sophisticated adversaries.

Principles

• Deletion-robust keys need content; rewrite-robust keys need position.
• Behavioral watermarks trade decision entropy for signal.
• Two-channel watermarking enhances robustness.

Method

TRACE superposes a selection channel (local content key, distortion-free sampler) and a tally channel (log skeleton key) to embed watermarks in agent action choices and decision group record counts.

In practice

• Attribute LLM agent provenance despite reseller tampering.
• Detect agent substitution or rebranding in supply chains.
• Verify agent integrity against log manipulation.

Topics

• LLM Agents
• Watermarking
• Attribution
• Trajectory Logs
• Digital Forensics
• Supply Chain Security

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Security Engineer, Machine Learning Engineer

Related on AIssential

• TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories — TRACE employs a two-channel watermark on LLM agent trajectories, leveraging complementary invariants for robust attribution against adversarial log manipulation.
• Multi-Channel Spread-Spectrum Code Watermarking — Multi-channel spread-spectrum watermarking provides robust, high-payload, post-hoc attribution for LLM-generated code without training.
• T2S: A Rehearsal-Based Approach for Extraction-Resistant Model Watermarking — T2S enhances AI model watermark robustness by simulating extraction attacks during embedding to boost transferability.
• ChainMark: Model-Free LLM Watermarking with Closed-Form Calibration — ChainMark offers a model-free LLM watermarking solution with provable robustness and closed-form calibration.
• Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions — CodeTracer forensically traces backdoored code completions to their poisoned training data without gradients.
• TRACE: Trajectory Reasoning through Adaptive Cross-Step Evidence Aggregation for LLM Agents — TRACE adaptively aggregates cross-step evidence to detect hidden malicious objectives in long LLM agent trajectories.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Artificial Intelligence.