---
title: "TRACE: 基于互补嵌入的双通道鲁棒归属水印用于LLM智能体轨迹"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.08400v1"
permalink: "https://feed.astralor.com/items/itm_fcf0170965e48de10f95e3bc"
published: "2026-07-09T12:25:22.000Z"
score: 81
channel: "ai"
tags: ["LLM智能体","TRACE","归属验证","水印"]
---

# TRACE: 基于互补嵌入的双通道鲁棒归属水印用于LLM智能体轨迹

## AI 点评

> 这篇论文解决了一个很实际的问题：LLM智能体被经销商转售时如何追踪归属。TRACE双通道设计的思路非常巧妙，特别是利用内容键和位置键互补来分别对抗删除和重写，理论证明也很扎实。对于正在构建AI Agent平台的团队，以及关注AI服务合规与安全的读者，都值得仔细研读。

## 速览

TRACE提出一种面向LLM智能体轨迹日志的双通道鲁棒水印方案，分别利用内容键（抵抗删除）和位置键（抵抗重写）构建选择通道和计数通道。该方法在不改变智能体行为分布的前提下，使水印在攻击者具有日志完全读写权限时仍可检测，理论证明决策熵换取信号强度。在ToolBench和ALFWorld上验证，长程轨迹检测得分接近z=100，70%步骤删除后仍可检测，且LLM重写后计数通道完全不变。

## 关键点

- 通过选择通道（基于内容键）和计数通道（基于位置键）互补，同时抵抗删除和重写攻击。
- 水印嵌入不改变智能体的动作选择分布，是零失真（distortion-free）的。
- 理论证明每个决策至少贡献一半熵用于水印信号，确定性决策无贡献。
- 在ToolBench和ALFWorld上，长程轨迹检测z值接近100，70%步骤删除后仍可检测，且LLM重写完全不影响计数通道。

## 全文

LLM agents reach users through resellers, who may rebrand a developer's agent or substitute a cheaper model. When provenance is disputed, attribution rests on the trajectory log (the record of tool calls, observations, and executed actions, not the model's reasoning), which the reseller stores and processes to meter usage. A watermark must therefore survive an adversary with full read/write access to the very evidence it is detected from; existing agent watermarks do not, as their attribution is read straight off that log. We present TRACE, to our knowledge the first agent watermark that is distortion-free in its action choices, self-synchronizing under deletion, and unconditionally invariant under rewriting. Deletion desynchronizes a position-derived key and rewriting alters content, so a deletion-robust key must come from content and a rewrite-robust key from position, and no single key serves both. A trajectory, however, has room for two watermarks. TRACE superposes a selection channel that sets which action is chosen, keyed on local content with a distortion-free sampler, so the agent's distribution is provably unchanged and detection resynchronizes after deletions, and a tally channel that sets how many records each decision group holds, keyed on the log's skeleton alone, which no rewriting can touch. We prove this behavioral watermark's signal is bought with decision entropy, each decision paying at least half its entropy and deterministic decisions nothing, and that erasing both channels forces the reseller to corrupt the trajectories it resells. On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate while its selection channel reaches detection scores near z = 100 on long-horizon trajectories, stays detectable under 70% step deletion, and keeps a tally channel exactly unchanged under LLM rewriting of any strength.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_fcf0170965e48de10f95e3bc