PaperlayerView exact revision on arXiv

Source-linked AI summary

TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectories

Bokang Zeng, Zheng Gao, Xiaoyu Li, Xiaoyan Feng, Jiaojiao Jiang

arXiv:2609.10416v1cs.CRcs.SE

TL;DR

Coding-agent artifact watermarks and global behavioral signals do not authenticate or localize changes in the visible process. TrajMark separates sparse READ-based ownership marking from linked Q12 integrity seals, recovering ownership exactly in evaluated clean batches while detecting 95.5%–100% of exhaustive eligible single-site edits. Its guarantees remain bounded by a trusted symmetric-key setting and explicit exclusions such as freshness, external context binding, adaptive attacks, and projection-preserving edits.

  • Problem

    Existing artifact and behavioral watermarking methods do not authenticate the visible coding-agent trajectory or identify which protected region was modified.

  • Method

    TrajMark is a training-free, visible-only framework that separates a sparse six-bit READ-based owner layer from linked Q12 seals protecting critical trajectory segments.

  • Results

    Across three agents and three LLMs, TrajMark recovered the exact owner in 27 of 27 primary conditions, detected 95.5%–100% of exhaustive eligible single-site edits, and achieved 26.9% Pass@1 versus 26.3% without watermarking.

  • Takeaways & Limitations

    Separating robust ownership evidence from fragile local commitments enables batch-level attribution alongside protocol-level tamper localization in visible trajectories.

  • Takeaways & Limitations

    The evaluated label was 0x3f, and the framework does not provide public verifiability, freshness, external context binding, adaptive-attack coverage, or protection for projection-preserving edits.

Abstract

from arXiv · show

Watermarking the final patch produced by a coding agent provides provenance evidence for the submitted artifact, but does not authenticate the visible process that produced it. Behavioral watermarking methods primarily provide a global detection or identifier-recovery signal, so a locally edited trajectory may retain sufficient ownership evidence without revealing which protected region has become inconsistent. To address this limitation, we propose TrajMark, a training-free, symmetric-key, visible-only trajectory watermarking framework that separates robust ownership attribution from fragile local integrity verification. Our framework consists of two complementary layers: a sparse owner layer that encodes a six-bit deployment identifier by rewriting a keyed subset of naturally occurring READ actions into masked linear equations, and a localization layer that inserts linked Q12 ordinary, group, and terminal seals to commit to protected critical-action segments. This separation allows ownership evidence to accumulate robustly across trajectories, while local modifications perturb nearby keyed commitments and expose the affected protocol region. We further provide a design-level analysis of owner recoverability, integrity collision probability, structural overhead, and localization behavior. Across three coding-agent frameworks and three LLMs, TrajMark recovers the exact owner in all evaluated clean full-watermark batches. Under exhaustive eligible single-site attacks it detects 95.5%-100% of edits, and under random single-action corruption it localizes 95.8% of modified sites to an accepted protocol region rather than to the individual action. Owner marking adds no trajectory actions; the integrity layer adds explicit read-only seals, and matched Pass@1 is 26.9% versus 26.3% for unwatermarked runs.

1 Introduction

TrajMark addresses the gap between artifact provenance and authentication of the visible coding-agent process by separating robust ownership attribution from fragile local integrity verification. It combines sparse READ-based ownership marking with linked seals and demonstrates exact ownership recovery, strong edit detection, and minimal task-performance impact.

  • Motivation: Artifact-level watermarks and signatures provide evidence about the final patch, but cannot authenticate the visible trajectory that produced it.The same patch can arise from different debugging trajectories, and action records can be rewritten without changing the patch.
  • Motivation: Ownership attribution and tamper localization require opposing evidence structures: robust aggregated evidence versus fragile region-specific commitments.Using one global watermark signal for both objectives conflates tolerance to corruption with local diagnosis.
  • Design principle: TrajMark separates these objectives into complementary protocol layers so ownership remains recoverable while local edits disrupt nearby commitments.The design preserves batch-level ownership confidence while identifying inconsistent regions within an individual trajectory.
  • Framework: The owner layer encodes a six-bit deployment identifier by rewriting keyed natural READ actions into masked linear equations.The method is training-free and operates on a visible canonical projection of actions.
  • Framework: The integrity layer inserts linked Q12 ordinary, group, and terminal seals around protected critical-action segments.Edits to protected segments change inputs to nearby keyed commitments and can trigger corresponding protocol alarms.
  • Evaluation: 95.5%–100% of exhaustive eligible single-site edits were detected, while exact ownership was recovered across all evaluated full-watermark batches.Evaluation covered three coding-agent frameworks and three LLMs.

2 Background and Motivation

Coding-agent trajectories expose a visible process spanning exploration, search, file reads, edits, testing, and submission. Existing artifact, cryptographic, and behavioral mechanisms protect different provenance objects, motivating separate ownership and localization evidence.

  • Trajectory structure: Coding-agent runtimes expose recurring visible action families, including exploration, search, locating files, critical edits or tests, and terminal submission.These families recur across SWE-agent, OpenHands, and OpenDev despite interface differences.
  • Trajectory structure: TrajMark verifies a public canonical projection of visible actions, preserving public linkage and status while excluding hidden reasoning and other private execution details.Paired READ realizations retain the READ family, target, and read-only character.
  • Provenance mechanisms: Artifact watermarks authenticate provenance evidence in final text or code, whereas trajectory watermarks carry evidence over the action record.The mechanisms are complementary because they protect different objects.
  • Provenance mechanisms: Cryptographic audit logs provide stronger integrity guarantees when trusted authenticators and validated logging infrastructure are available.TrajMark studies a restricted setting without signatures, hash-chain state, or authenticated wrapper metadata.
  • Provenance mechanisms: Behavioral watermarking embeds ownership evidence in agent behavior but primarily supplies global detection signals rather than local inconsistency diagnosis.Prior approaches include behavioral choices, equivalent execution paths, keyed hooks, and sequential transitions.
  • Design motivation: Ownership benefits from sparse redundant evidence aggregated across trajectories, while localization requires region-specific commitments within one trajectory.TrajMark separates the channels because robustness favors tolerance to missing carriers whereas local diagnosis requires visible regional evidence.

3 Problem Formulation and Threat Model

TrajMark defines verification over a public canonical projection of released actions under a trusted symmetric-key boundary, with separate ownership and integrity replay tasks. Its threat model covers fixed visible edits but excludes several stronger attribution, replay, adaptive, and context-binding guarantees.

  • 3 Problem Formulation and Threat Model: The verifier observes only a released trajectory’s public actions and not hidden reasoning or runtime state.Every carrier, role, and decision must therefore be recoverable from the visible action stream.
  • 3.1 System Model and Trust Boundary: TrajMark operates inside a trusted symmetric-key domain where a deployment-scoped six-bit label is assigned and the verifier holds the same secret key.The label is not a publicly verifiable legal or organizational identity, and key holders can produce marks for any label.
  • 3.1 System Model and Trust Boundary: Watermarking runs inside the agent loop, where the wrapper may rewrite eligible READ actions, update state after outcomes, and execute seals before later decisions.A natural READ is the proposal observed immediately before rewriting, while No-WM is a separate experimental control.
  • 3.2 Canonical Visible Observation: The canonical stream is a public, versioned sequence of canonical events formed by joining publicly linkable records.Each event represents visible fields such as class, subtype, target, status, header, and order, with fixed null symbols for unavailable fields.
  • 3.2 Canonical Visible Observation: Verification excludes hidden reasoning, logits, private wrapper state, debug metadata, complete commands or outputs, and unlinked observation contents.The retained view is limited to public action fields and profile-defined carrier information.
  • 3.3 Public Replay and Protected Projections: Public replay reconstructs expected seal roles and ownership positions from the edited stream, while owner decoding excludes integrity roles.Replay tracks missing or invalid carriers and uses public prefixes plus configuration rather than private wrapper origins.
  • 3.3 Public Replay and Protected Projections: The owner projection uses eligible non-seal READs and normalized basenames, whereas the integrity projection protects critical-event order, class, and normalized target within protected segments.Seal roles, subtypes, status, and order are checked separately during replay.
  • 3.3 Public Replay and Protected Projections: Projection-preserving edits are outside TrajMark’s integrity claim, and the protocol view does not cover changes beyond its declared protected fields.This defines a boundary on what visible modifications can be treated as integrity events.

4 TrajMark: Dual-Channel Visible-Trajectory Watermarking

TrajMark separates robust batch ownership attribution from fragile trajectory integrity verification using independent visible channels. The owner channel rewrites selected natural READs into masked equations, while the integrity channel seals protected segments with linked Q12 commitments.

  • Dual-channel design: TrajMark independently decodes a batch owner label and replays integrity commitments to localize inconsistent protocol units.The owner channel uses selected READs; the integrity channel uses ordinary, group, and terminal seals.
  • Owner channel: Selected owner candidates preserve their READ family and target while carrying masked linear equations, with keyed orientation preventing fixed visible meanings across filenames.Rows are nonzero vectors in GF(2)^6, and profile-specific adapters expose the same decoded equation.
  • Batch decoding: The decoder aggregates one equation per basename slot, scores all 64 six-bit candidates, and requires rank six, a unique maximizer, and sufficient evidence before accepting or rejecting a claim.Failure of any gate produces abstention rather than an attribution decision.
  • Integrity channel: Integrity replay constructs segment payloads from Q12 subtype counts and critical-event tokens, then chains ordinary, group, and terminal keyed commitments.Ordinary mismatches identify one segment, group mismatches an adjacent pair, and terminal mismatches a suffix or closure inconsistency.
  • Operational behavior: Owner marking adds no actions, whereas the overt integrity channel schedules read-only seal roles and incurs visible step cost.Either channel can be enabled independently.

5 Theoretical Analysis

The theoretical analysis characterizes owner recovery and projected-integrity detection under explicit replay, masking, and freshness assumptions. It also states operational overhead and boundaries for the integrity guarantee.

  • Ownership capacity: The frozen-pool capacity analysis separates rank-six recovery from the minimum retained-slot requirement imposed by the evidence threshold.The capacity result assumes one clean equation per selected basename without feedback into the pool.
  • Ownership guarantees: Owner recovery is guaranteed when retained equations satisfy rank six and corruption remains below the matrix’s error-correction distance.With slot erasures, a sufficient condition is 2||η||_0 + s < d(A_0).
  • Ownership guarantees: Acceptance additionally requires the evidence and claim gates; payload recovery alone does not guarantee acceptance of the registered claim.The evaluated threshold τ_z = 3.09 requires ten retained basename slots, while the matrix must still have rank six.
  • Integrity guarantees: A role-preserving substitution affecting one completed ordinary segment is analyzed through fresh keyed ordinary and group inputs, yielding projected-integrity collision bounds.The result concerns a fixed one-segment edit under the stated replay and freshness assumptions.
  • Scope limitations: The integrity bound excludes role-changing insertions, deletions, carrier edits, compound edits, and projection-preserving edits, which are evaluated outside the theorem.No terminal collision factor is claimed because the required quantitative terminal-hash model and freshness assumption are absent.
  • Operational consequences: With m ordinary roles, the integrity channel adds seal actions, while generation and replay are expected O(B) and owner scoring is O(2^6U).Alarm granularity is segment-, adjacent-pair-, or suffix-level rather than byte-level.

6 Cross-Framework Implementation

TrajMark is implemented across SWE-agent, OpenHands, and OpenDev through a shared semantic schema plus versioned framework profiles. The profiles preserve common protocol concepts while accommodating framework-specific action surfaces, replay, failure, and terminal behavior.

  • Shared implementation: The implementation uses a shared schema for Q6/Q12 inventories, owner equations, and integrity commitments, with profile-specific runtime and serialization rules.Profiles also define event admission, role parsing, failure handling, closure hooks, and native action templates.
  • Reference adapter contract: Conforming adapters must preserve canonical event order through a public causal transducer and expose read-only Q6/Q12 realizations.The reference contract requires unique action-observation joins, regular-file targets, and explicit handling of missing observations.
  • Native action surfaces: Table 1 presents the native action surfaces of the evaluated framework profiles.The table is scoped to native action-surface representations rather than a cross-framework performance comparison.
  • Framework profiles: SWE-agent hooks textual requests, OpenHands joins typed actions with observations, and OpenDev uses structured tool calls with a public index.Owner rewriting occurs before execution and scheduled seals use the normal runtime.
  • Framework profiles: Failure and terminal semantics differ across evaluated profiles, affecting clean baselines and deletion coverage despite the shared protocol.OpenHands admits only successful non-seal actions to Q12 state, while OpenDev advances ordinary commitment state only after successful carriers.

7 Evaluation Methodology

The evaluation measures TrajMark’s ownership recovery, robustness, integrity detection, overhead, utility, cross-agent generalization, and comparison against matched controls. It uses three coding-agent frameworks, three LLMs, frozen task lists, paired replay conditions, and separate full-watermark and owner-only evaluation scopes.

  • Research questions: The study asks whether visible-only decoding recovers the exact owner, remains robust to action corruption, detects protected-segment edits, preserves utility, and generalizes across agent–task pairings.Ownership uses batches, while integrity uses trajectories and protected segments under matched agent, model, task-list, and seed conditions.
  • Evaluation scope: The primary full-watermark study evaluates ownership, integrity detection, and overhead using trajectories with both the Q6 owner layer and Q12 seals.Matched controls and cross-pair grids are analyzed separately and do not support full-protocol integrity or utility claims.
  • Subjects and tasks: Three independently engineered agents—SWE-agent, OpenHands, and OpenDev—are evaluated with DeepSeek V4 Flash, GPT-5 mini, and MiniMax M3 on frozen task lists and seeds.The aligned task families are SWE-bench Python, SWE-PolyBench Java, and SWE-PolyBench JavaScript, with actual denominators gated by artifact and method completeness.
  • Protocol and metrics: The complete method combines filename-linear Q6 owner equations with Q12 ordinary segment seals, group-of-two protectors, and a terminal commitment.The evaluation separately measures owner recovery, integrity alarms, task outcome, and artifact completeness.
  • Attack evaluation: Integrity attacks test new Q12 alarms after eligible payload insertion, deletion, replacement, or seal removal, while owner robustness uses exact recovery of identifier 0x3f under corrupted batches.Random-attack points contain 4,500 corrupted batches, and integrity detection is distinguished from localization.

8 Evaluation Results

Across three coding-agent frameworks and three LLMs, TrajMark provides exact owner attribution, robust tamper detection and localization, with limited structural overhead and no observed Pass@1 penalty.

  • 8.4 Owner Attribution: All 27 clean full-watermark groups recover the exact six-bit owner identifier, while Owner-only also succeeds across all 27 tested cross-agent and cross-task cells.ActHook-style is detection-only and does not encode an owner identity.
  • 8.4.1 Owner-ID Recovery: At 20% random corruption, Owner-only and TrajMark achieve 99.3–100% and 96.3–100% exact owner-ID recovery, respectively; at 50%, their minima are 79.1% and 76.5%.Under white-box carrier deletion, complete TrajMark recovers 23/27 batches at 20%, 10/27 at 30%, and 1/27 at 50%.
  • 8.5 Full-Watermark Tamper Detection: TrajMark detects 95.5–100% of exhaustive eligible single-site edits across all nine agent–LLM cells.The evaluation covers insertion, deletion, replacement, and seal removal using an any-alarm Q12 decision.
  • 8.5 Localization: For one selected modification, 95.8% of eligible payload sites fall within an accepted protocol region, whose pooled median and mean widths are 15 and 19.8 visible actions.The localization claim identifies the narrowest accepted region, not the individual modified action.
  • 8.6 Utility and Cost: Owner-only adds no actions, while full TrajMark adds 6.98 visible actions per trajectory on average, corresponding to 22.1% structural overhead for SWE-agent.Matched Pass@1 is 26.9% for complete TrajMark versus 26.3% without watermarking.

9 Discussion

TrajMark separates zero-added-action ownership evidence from explicit integrity seals, while its deployment guidance combines attribution gates, calibration, and layered provenance checks. The discussion also identifies closure-dependent deletion limits and recommends runtime changes to preserve evidence.

  • 9 Discussion: TrajMark offers owner-only provenance without added actions and full mode with explicit integrity seals, enabling deployment-specific trade-offs.Owner-only rewrites existing READ choices; full mode adds ordinary, group, and terminal seals with measured structural cost.
  • 9 Discussion: Random deletion is weakest when a critical action and adjacent seal disappear together, because fewer independent commitments remain to expose the deletion.The paper recommends admitting critical typed actions before outcome resolution, representing missing observations explicitly, and closing Q12 on every termination path.
  • 9 Discussion: A Q12 alarm on an owner-verified trajectory indicates inconsistency in the protected canonical projection, while artifact and trajectory evidence can be combined for redundancy.The paper proposes combining trajectory evidence with artifact watermarks or secure logs when available.
  • 9 Discussion: Deployment guidance requires attribution gates, adapter recalibration after interface changes, and an explicit choice between zero-added-action owner-only mode and full integrity mode.Keys should also be domain-separated by deployment, owner, and layer, then rotated for future batches.

10 Threats to Validity

The validity analysis bounds TrajMark’s claims by its canonicalization, security, evaluation, and deployment assumptions. It highlights correlated owner equations, a fixed evaluated label, limited task coverage, and interface-specific calibration requirements.

  • 10 Threats to Validity: Owner equations are correlated because models revisit files and reuse exploration patterns, motivating exact recovery, rank, uniqueness, score margin, and batch resampling checks.These checks are used as primary evidence rather than treating equations as independent observations.
  • 10 Threats to Validity: The live-generation study fixes owner label 0x3f and deploys p_o = 0.30, leaving cross-label and cross-density empirical validation for future work.The paper also notes that baseline comparisons use method-specific operating points rather than equal visible-carrier budgets.
  • 10 Threats to Validity: Structural additions are directly observable, but turns and tokens also vary with stochastic generation, retries, context handling, and provider scheduling.This distinction limits direct interpretation of runtime-level overhead beyond structural action counts.
  • 10 Threats to Validity: The primary evaluation uses three matched 50-task seeds, so reported capacity reflects their filename diversity and eligible READ supply.Deployment to IDE-native, GUI, multi-agent, or long-horizon systems requires adapter calibration.
  • 10 Threats to Validity: The security model assumes HMAC pseudorandomness, a secret key, and an honest embedding runtime, while public canonicalization reveals eligible action classes.The attack suite includes random corruption and white-box carrier deletion with stronger attacker access.

11 Related Work

Related work distinguishes artifact watermarking, behavioral ownership marks, secure logging, and fragile integrity mechanisms. TrajMark combines these themes for visible serialized action traces where wrapper metadata or logging infrastructure may not survive.

  • 11 Related Work: Artifact watermarks protect code, whereas TrajMark protects the visible process, so the two remain complementary when trajectories and patches provide different provenance evidence.Different trajectories can yield the same patch, and a trajectory can be edited without changing that patch.
  • 11 Related Work: TrajMark combines filename-indexed linear ownership equations with ordinary, group, and terminal commitments that turn visible-action edits into protocol alarms.This extends behavioral watermarking from ownership evidence toward segment-level integrity checking.
  • 11 Related Work: Secure logs are preferable when authenticated metadata survives end to end, while TrajMark targets release channels where only the serialized action stream remains.Its terminal/root commitment represents completeness through a visible READ subtype, and group commitments amortize protection over pairs.
  • 11 Related Work: Unlike independent tags, TrajMark’s commitment hierarchy links each ordinary seal to its segment and prior seal, groups pairs, and uses a terminal/root commitment for the protected projection.Enclosing commitments can retain tamper evidence when local evidence is modified or removed.
  • 11 Related Work: Coding-agent benchmarks motivate process protection because exploration, failed attempts, tests, and revisions can be absent from the submitted patch.The carrier must also preserve the agent’s ability to select tools needed for the task.

12 Conclusion

TrajMark separates robust ownership from fragile integrity in visible coding-agent trajectories, achieving broad owner recovery and tamper detection across evaluated settings. Its deployment modes are composable, but current evidence remains bounded by fixed labels, operating points, and evaluation scope.

  • 12 Conclusion: TrajMark separates sparse READ-based ownership equations, which add no actions, from Q12 ordinary, group-of-two, and terminal commitments for critical-action integrity.This design directly addresses the opposing robustness requirements of ownership attribution and tamper localization.
  • 12 Conclusion: Exact owner recovery reached 27 of 27 primary conditions, while Q12 detected 95.5–100% of exhaustive eligible single-site edits across the evaluated agents and models.At 50% proportional corruption, every SWE-agent and OpenDev curve remained at least 99.4%, while the lowest OpenHands condition was 84.8%.
  • 12 Conclusion: Owner-only adds no trajectory action, while full TrajMark adds 6.98 visible actions per SWE-agent trajectory and yields pooled Pass@1 of 26.9% versus 26.3% for No-WM.Across nine matched agent–LLM conditions, five changes increased and four decreased, with p = 1.00 for the exact two-sided sign test.
  • 12 Conclusion: Applications can combine owner-only or full TrajMark with artifact watermarks or secure logs, assigning each component a distinct verification role and measured cost.The resulting design is intended as a composable provenance stack rather than a replacement for every authenticated logging channel.
  • 12 Conclusion: Current evidence is limited by a fixed deployment label, method-specific rather than carrier-budget-matched baselines, and evaluation on three agents, models, seeds, and repository languages.Future work proposes broader label and density evaluation, outer coding beyond six bits, and adaptive multi-region attacks.

A.2 Proof of Theorem 5.3

The proof characterizes clean owner acceptance through selected-slot retention and rank, while distinguishing surviving-slot count from actual recovery probability.

  • A.2 Proof of Theorem 5.3: Clean batches retain one aggregated equation per selected basename, so U = M = m even when coefficient vectors repeat.Every retained equation supports the true owner, yielding H(w) = m and zowner = √m for m > 0.
  • A.2 Proof of Theorem 5.3: Acceptance is equivalent to retaining at least the threshold number of slots and obtaining rank six, with probability 1{m ≥Lτ}Pm(6) conditional on M = m.The overall probability follows by averaging this conditional expression over the binomial distribution of M.
  • A.2 Proof of Theorem 5.3: Six independent coefficient draws suffice algebraically but yield only approximately 0.322 full-rank probability, so six rows are not a high-probability operating point.The proof also notes that expected surviving slots under erasure do not determine matrix rank or recovery probability.

B Owner Decoding Proofs

The owner proofs establish decoding soundness and robustness under row loss, while the visible replay protocol assigns and checks integrity roles without silently skipping edits.

  • Owner robustness: If fewer than half the code-distance errors occur, the true owner uniquely wins; deleting s rows reduces the retained distance by at most s.Rank alone is insufficient for robustness, as the example A = I6 has d(A) = 1.
  • Soundness: Fixed-claim false acceptance is bounded by a binomial Hamming-score tail, with rank, uniqueness, and claim-equality gates able only to reduce acceptance.The argument conditions on mask-independent retention and independent fair right-hand sides across retained slots.
  • Proof scope: The integrity proof excludes terminal-role multiplication and does not reduce insertion, deletion, boundary-changing, carrier, compound, or projection-preserving edits to the single-segment theorem.This marks the scope boundary of the quantitative collision analysis.
  • Visible-only verification: TrajMark verifies ownership by replaying visible prefixes, recovering Q6 equations, aggregating basename slots, scoring all 64 labels, and applying evidence gates.Integrity verification separately replays ordinary, group, and terminal roles and reports mismatched, missing, or invalid expected roles.
  • Replay behavior: A deleted role shifts subsequent records into expected public positions, while projection-preserving edits can replay cleanly by design.Non-role insertions are detected only when they alter protected payloads, role shifts, or later subtype consistency.

G Disaggregated Ownership Robustness

Disaggregated experiments show that corruption effects depend on the watermark carrier: filename-indexed methods are comparatively stable under unrelated insertions but lose evidence in specific GPT-5 mini conditions.

  • Random deletion: Filename-indexed methods degrade mainly in the lowest-margin SWE-agent/GPT-5 mini and OpenDev/GPT-5 mini cells under deletion.AgentMark-U instead loses indexed evidence broadly across agents.
  • Random insertion: Unrelated insertions preserve Owner-only and TrajMark evidence but cause AgentMark-U to fail through global action-index shifts.The insertion panels retain every agent–LLM condition in the disaggregated grid.
  • White-box carrier deletion: The largest owner-recovery loss occurs in GPT-5 mini cells, while other filename-indexed conditions remain near clean decisions through moderate corruption.Figure 8 evaluates exact-budget white-box deletion of known owner-carrier occurrences using the strongest of up to 63 candidate deletion sets, excluding clean Q12 positions.
Loading 2609.10416v1…