Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

Source

arXiv

arxiv.org/abs/2607.08400v1

Read the source

Source

Plain-Language Brief

The paper introduces TRACE, a new agent watermark system designed to withstand manipulation by resellers who may alter or replace an original agent. The system works by embedding two channels into the agent's behavior: a selection channel that influences action choices without affecting the agent's distribution and a tally channel that records decision groups based on the log's skeleton. TRACE is shown to maintain the original agent's success rate while being highly detectable, even under deletions and rewrites.

What the Document Says

  • The paper presents TRACE, a distortion-free watermark system for LLM agents.
  • TRACE consists of two channels: a selection channel and a tally channel.
  • The selection channel influences action choices without affecting the agent's distribution and allows for resynchronization after deletions.
  • The tally channel records decision groups based on the log's skeleton, which cannot be altered by rewriting.
  • The behavioral watermark's signal is shown to be proportional to decision entropy.
  • TRACE maintains the original agent's success rate and achieves high detection scores under certain conditions.
  • The system demonstrates robustness under deletions, rewrites on long-horizon trajectories, and maintains its tally channel unchanged.

Key Concepts Mentioned

  • agent watermark
  • LLM agents
  • resellers
  • trajectory log
  • watermark channels
  • distortion-free sampler
  • decision entropy

Claims Made by the Document

  • TRACE is the first agent watermark that is distortion-free, self-synchronizing under deletion, and unconditionally invariant under rewriting.
  • Deletion desynchronizes a position-derived key and rewriting alters content, requiring separate keys for both.
  • A trajectory has room for two watermarks: one for action selection and one for tallying decisions.
  • TRACE's signal is proportional to decision entropy.
  • Erasing both TRACE channels forces the reseller to corrupt the trajectories it resells.

Evidence Used

  • The paper provides a detailed description of the TRACE system and its components.
  • Experimental results on ToolBench and ALFWorld demonstrate TRACE's performance under various conditions.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

LLM agents reach users through resellers, who may rebrand a developer's agent or substitute a cheaper model. When provenance is disputed, attribution rests on the trajectory log (the record of tool calls, observations, and executed actions, not the model's reasoning), which the reseller stores and processes to meter usage. A watermark must therefore survive an adversary with full read/write access to the very evidence it is detected from; existing agent watermarks do not, as their attribution is read straight off that log. We present TRACE, to our knowledge the first agent watermark that is distortion-free in its action choices, self-synchronizing under deletion, and unconditionally invariant under rewriting. Deletion desynchronizes a position-derived key and rewriting alters content, so a deletion-robust key must come from content and a rewrite-robust key from position, and no single key serves both. A trajectory, however, has room for two watermarks. TRACE superposes a selection channel that sets which action is chosen, keyed on local content with a distortion-free sampler, so the agent's distribution is provably unchanged and detection resynchronizes after deletions, and a tally channel that sets how many records each decision group holds, keyed on the log's skeleton alone, which no rewriting can touch. We prove this behavioral watermark's signal is bought with decision entropy, each decision paying at least half its entropy and deterministic decisions nothing, and that erasing both channels forces the reseller to corrupt the trajectories it resells. On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate while its selection channel reaches detection scores near z = 100 on long-horizon trajectories, stays detectable under 70% step deletion, and keeps a tally channel exactly unchanged under LLM rewriting of any strength.