TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

2026-07-11 · Source: cs.AI updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Expert, extended

Summary

TRACE is a novel two-channel robust attribution watermark designed for Large Language Model (LLM) agent trajectories, specifically addressing the threat of resellers rebranding or substituting agents while having full log access. It features a distortion-free selection channel, keyed on local content, which remains detectable under 70% step deletion and matches unwatermarked agent success rates on ToolBench and ALFWorld. Complementing this is a position-keyed tally channel, unconditionally invariant to rewriting attacks, which maintains detection even under LLM rewriting of any strength. TRACE achieves detection scores near z = 100 on long-horizon trajectories like ALFWorld, with a single long-horizon trajectory or ten short ones enabling attribution at a 1% false positive rate. The system ensures that erasing both watermarking layers necessitates corrupting the resold trajectories.

Key takeaway

For MLOps Engineers deploying LLM agents through third-party resellers, traditional single-signal watermarks are insufficient for ensuring provenance against sophisticated log manipulation. You should consider implementing multi-channel watermarking strategies like TRACE, which leverages both content-keyed selection and skeleton-keyed tally channels. This approach provides robust attribution against both deletion and rewriting attacks, ensuring that any attempt to erase the watermark necessitates corrupting the agent's operational logs, thereby preserving accountability and trust in your agent's actions.

Key insights

TRACE employs a two-channel watermark on LLM agent trajectories, leveraging complementary invariants for robust attribution against adversarial log manipulation.

Principles

• Attribution against log-owning adversaries requires complementary invariants.
• Distortion-free watermarking trades detectability for decision entropy.
• Watermark robustness depends on carrier/keying invariance to attack classes.

Method

TRACE superposes a selection channel, modulating action choice via a distortion-free exponential race keyed on preceding content, and a tally channel, modulating record counts keyed on the trajectory's skeleton.

In practice

• Implement content-keyed sampling for deletion robustness.
• Utilize skeleton-keyed counting for rewrite invariance.
• Pool short trajectories to enhance detection power.

Topics

• LLM Agents
• Behavioral Watermarking
• Attribution
• Trajectory Logs
• Reseller Threat Model
• Robustness

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Scientist, AI Security Engineer, MLOps Engineer

Related on AIssential

• TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories — TRACE uses two complementary watermarking channels to ensure robust, distortion-free attribution for LLM-agent trajectories against sophisticated adversaries.
• ChainMark: Model-Free LLM Watermarking with Closed-Form Calibration — ChainMark offers a model-free LLM watermarking solution with provable robustness and closed-form calibration.
• Multi-Channel Spread-Spectrum Code Watermarking — Multi-channel spread-spectrum watermarking provides robust, high-payload, post-hoc attribution for LLM-generated code without training.
• The Watermark Shortcut: How Provenance Marking Sabotages Audio Deepfake Detection — Audio deepfake detectors learn a "watermark => fake" shortcut when only synthetic speech is watermarked, causing critical detection failures.
• Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions — CodeTracer forensically traces backdoored code completions to their poisoned training data without gradients.
• When Embedding-Based Defenses Fail: Rethinking Safety in LLM-Based Multi-Agent Systems — Embedding-based MAS defenses fail when attackers craft near-benign messages, necessitating token-level confidence signals for robustness.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.AI updates on arXiv.org.