TrajMark watermarks coding-agent trajectories by rewriting READ actions, localizing 95.8% of tampered sites with no added actions

arXiv·medium signalXBlueskyLinkedInCopy link

arXiv 2609.10416 (2026-09-09) notes that watermarking a coding agent's final patch proves provenance for the artifact but not for the visible process that produced it, and that global behavioral watermarks can survive local edits without revealing which region changed. TrajMark is training-free and symmetric-key, splitting the job into a sparse owner layer that encodes a six-bit deployment identifier by rewriting a keyed subset of naturally occurring READ actions into masked linear equations, and a localization layer of linked ordinary, group and terminal seals over protected critical-action segments. Across three coding-agent frameworks and three LLMs it recovered the exact owner in every clean batch, detected 95.5-100% of exhaustive single-site edits, localized 95.8% of random corruptions to an accepted protocol region, and cost nothing in capability (Pass@1 26.9% watermarked versus 26.3% unwatermarked). Owner marking adds zero trajectory actions; only the integrity layer adds read-only seals.