Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

Source

arXiv

arxiv.org/abs/2607.08400v1

Read the source

Source

Plain-Language Brief

Researchers introduce TRACE, a watermark system for large language model (LLM) agents that can maintain its integrity even when resellers rebrand or substitute cheaper models. TRACE consists of two channels: a selection channel that determines the agent's actions and a tally channel that records the number of decisions in each group. The researchers prove that the watermark's signal comes at the cost of decision entropy, and it can be detected even when there is significant step deletion or LLM rewriting.

What the Document Says

  • The paper presents TRACE, a two-channel watermark system for LLM agents that ensures its integrity during usage by resellers.
  • TRACE consists of a selection channel and a tally channel to maintain the agent's action choices and record decisions respectively.
  • The authors prove that the watermark's signal is bought with decision entropy, with each decision paying at least half its entropy, and deterministic decisions having no cost.
  • Deletion desynchronizes the position-derived key in TRACE, while rewriting alters content, making it necessary for a distortion-free sampler to generate keys from local content.
  • The paper claims that erasing both channels forces resellers to corrupt the trajectories they resell.
  • TRACE shows promising results on ToolBench and ALFWorld benchmarks, with its selection channel achieving high detection scores and maintaining integrity under deletion and LLM rewriting.

Key Concepts Mentioned

  • Large Language Model (LLM) agents
  • Watermark system
  • Resellers
  • Deletion-robust key
  • Rewrite-robust key
  • Distortion-free sampler
  • Decision entropy
  • Selection channel
  • Tally channel
  • ToolBench
  • ALFWorld

Claims Made by the Document

  • TRACE is the first agent watermark that is distortion-free, self-synchronizing under deletion, and unconditionally invariant under rewriting.
  • Deleting both channels forces resellers to corrupt the trajectories they resell.

Evidence Used

  • The paper presents a detailed method for creating TRACE, demonstrating its distortion-free nature, self-synchronization capabilities, and invariance under rewriting.
  • Experimental results on ToolBench and ALFWorld show that TRACE maintains the agent's success rate while achieving high detection scores.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

LLM agents reach users through resellers, who may rebrand a developer's agent or substitute a cheaper model. When provenance is disputed, attribution rests on the trajectory log (the record of tool calls, observations, and executed actions, not the model's reasoning), which the reseller stores and processes to meter usage. A watermark must therefore survive an adversary with full read/write access to the very evidence it is detected from; existing agent watermarks do not, as their attribution is read straight off that log. We present TRACE, to our knowledge the first agent watermark that is distortion-free in its action choices, self-synchronizing under deletion, and unconditionally invariant under rewriting. Deletion desynchronizes a position-derived key and rewriting alters content, so a deletion-robust key must come from content and a rewrite-robust key from position, and no single key serves both. A trajectory, however, has room for two watermarks. TRACE superposes a selection channel that sets which action is chosen, keyed on local content with a distortion-free sampler, so the agent's distribution is provably unchanged and detection resynchronizes after deletions, and a tally channel that sets how many records each decision group holds, keyed on the log's skeleton alone, which no rewriting can touch. We prove this behavioral watermark's signal is bought with decision entropy, each decision paying at least half its entropy and deterministic decisions nothing, and that erasing both channels forces the reseller to corrupt the trajectories it resells. On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate while its selection channel reaches detection scores near z = 100 on long-horizon trajectories, stays detectable under 70% step deletion, and keeps a tally channel exactly unchanged under LLM rewriting of any strength.