TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectories
Researchers introduce TrajMark, a training-free watermarking framework for coding-agent trajectories that recovers ownership, detects 95.5-100% of edits, and localizes tampered regions.
TrajMark is a training-free, symmetric-key, visible-only watermarking framework for coding-agent trajectories that separates robust ownership attribution from fragile local integrity verification. A sparse owner layer encodes a six-bit deployment identifier by rewriting keyed READ actions into masked linear equations, while a localization layer inserts linked Q12 seals that commit to protected critical-action segments. Across three coding-agent frameworks and three LLMs, it recovers the exact owner in all clean full-watermark batches, detects 95.5%-100% of single-site edits, and localizes 95.8% of random corruptions to an accepted protocol region. Owner marking adds no trajectory actions and matched Pass@1 is 26.9% versus 26.3% for unwatermarked runs.
- Encodes a six-bit owner ID by rewriting keyed READ actions into masked linear equations; Q12 seals enable segment-level localization.
- Detects 95.5%-100% of exhaustive single-site edits and localizes 95.8% of random corruptions across three frameworks and three LLMs.
- Training-free and visible-only; watermarking adds no trajectory actions and Pass@1 is 26.9% vs 26.3% unwatermarked.
- Includes design-level analysis of owner recoverability, integrity collision probability, and structural overhead.
From the original article
1 min read at arxiv.orgWatermarking the final patch produced by a coding agent provides provenance evidence for the submitted artifact, but does not authenticate the visible process that produced it. Behavioral watermarking methods primarily provide a global detection or identifier-recovery signal, so a locally edited trajectory may retain sufficient ownership evidence without revealing which protected region has become inconsistent.
By Bokang Zeng · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.