DirBucket Watermarks RAG Corpora in Embedding Space and Detects Unlicensed Reuse Within 23 Audited Answers

arXiv 2609.03749·medium signalXBlueskyLinkedInCopy link

Third-party RAG marketplaces create an auditing problem where data providers license corpora to an operator and then have no visibility into unpaid reuse, made hard by a non-cooperative operator, paraphrasing generators and answers that blend many providers' evidence. DirBucket watermarks documents through meaning-preserving paraphrases whose embeddings are biased toward provider-bucket secret directions, enabling black-box detection while preserving retrieval utility. On a mixed-provider benchmark it was the only method achieving strong target detection with no non-target activation, catching non-compliance within 23 audited answers, surviving adversarial post-answer laundering with no evasion strategy defeating detection while preserving answer quality, and transferring unchanged to a second benchmark of real clinical, cyber-threat-intelligence and legal corpora.