---
title: "TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.08400v1"
permalink: "https://feed.astralor.com/items/itm_fcf0170965e48de10f95e3bc"
published: "2026-07-09T12:25:22.000Z"
score: 81
channel: "ai"
tags: ["LLM agent","TRACE","Attribution","Watermarking"]
---

# TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

## AI commentary

> This paper tackles a very practical problem: how to track attribution when LLM agents are resold. The two-channel design using complementary content and position keys to combat deletion and rewriting is ingenious, and the theoretical proof is solid. It's a must-read for teams building AI agent platforms and anyone concerned with AI service compliance and security.

## At a glance

TRACE proposes a two-channel robust watermark for LLM agent trajectory logs, using content keys (deletion-robust) and position keys (rewrite-robust) to build a selection channel and a tally channel. It provably preserves the agent's action distribution while remaining detectable under full read/write access by an adversary. Theoretical analysis shows signal is bought with decision entropy. Experiments on ToolBench and ALFWorld show near z=100 detection on long-horizon trajectories, detectability under 70% step deletion, and tally channel fully invariant under LLM rewriting.

## Key points

- Complementary selection channel (content-keyed) and tally channel (position-keyed) provide robustness against both deletion and rewriting. 
- Watermark embedding is distortion-free: the agent's action distribution is provably unchanged. 
- Theoretical guarantee that each decision contributes at least half its entropy to the watermark signal; deterministic decisions contribute nothing. 
- On ToolBench and ALFWorld, detection z-score near 100 on long trajectories, detectable after 70% step deletion, and tally channel invariant under LLM rewriting of any strength.

## Full text

LLM agents reach users through resellers, who may rebrand a developer's agent or substitute a cheaper model. When provenance is disputed, attribution rests on the trajectory log (the record of tool calls, observations, and executed actions, not the model's reasoning), which the reseller stores and processes to meter usage. A watermark must therefore survive an adversary with full read/write access to the very evidence it is detected from; existing agent watermarks do not, as their attribution is read straight off that log. We present TRACE, to our knowledge the first agent watermark that is distortion-free in its action choices, self-synchronizing under deletion, and unconditionally invariant under rewriting. Deletion desynchronizes a position-derived key and rewriting alters content, so a deletion-robust key must come from content and a rewrite-robust key from position, and no single key serves both. A trajectory, however, has room for two watermarks. TRACE superposes a selection channel that sets which action is chosen, keyed on local content with a distortion-free sampler, so the agent's distribution is provably unchanged and detection resynchronizes after deletions, and a tally channel that sets how many records each decision group holds, keyed on the log's skeleton alone, which no rewriting can touch. We prove this behavioral watermark's signal is bought with decision entropy, each decision paying at least half its entropy and deterministic decisions nothing, and that erasing both channels forces the reseller to corrupt the trajectories it resells. On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate while its selection channel reaches detection scores near z = 100 on long-horizon trajectories, stays detectable under 70% step deletion, and keeps a tally channel exactly unchanged under LLM rewriting of any strength.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_fcf0170965e48de10f95e3bc