TRACE: Two-channel robust attribution watermark for LLM-agent trajectories

Researchers present TRACE, the first agent watermark that is distortion-free in action choices, self-synchronizing under deletion, and unconditionally invariant under rewriting. The method superposes a selection channel keyed on local content with a tally channel keyed on the log's skeleton to ensure robustness against adversarial modification.

• TRACE uses a selection channel for distortion-free sampling and a tally channel based on the log structure.
• Detection scores reach near z = 100 on long-horizon trajectories in ToolBench and ALFWorld benchmarks.
• The watermark remains detectable under 70% step deletion and is unchanged by LLM rewriting of any strength.
• Erasing both channels forces resellers to corrupt the trajectories they resell.

The authors consider this important because it allows attribution to survive when provenance is disputed and resellers have full read/write access to trajectory logs.