TRACE Watermarks Agent Trajectories Against Adversaries Who Control the Logs

arXiv·medium signal

LLM agents often reach users through resellers who may rebrand a developer's agent or silently swap in a cheaper model. TRACE (arXiv 2607.08400, July 9) points out that attribution in disputes rests on the trajectory log — tool calls, observations, executed actions — which the reseller both stores and processes for metering. That means the watermark must survive an adversary with full read/write access to the very evidence used to detect it, a threat model existing agent watermarks do not satisfy. TRACE uses two complementary embedding channels to make attribution robust under that assumption.