PaperlayerView exact revision on arXiv

Source-linked AI summary

Decision Uncertainty-Oriented Watermarking (DUOW): Securing Multi-Agent Routing Against Policy Cloning

Ziming Zhang, Li Li, Guorui Feng, Hanzhou Wu, Xinpeng Zhang, Athanasios V. Vasilakos

arXiv:2610.14606v1cs.CR

TL;DR

Execution logs expose multi-agent routing behavior, while existing watermarking approaches can compromise task fidelity or transferability. DUOW embeds ownership signals in utility-preserving choices among equivalent agents, and evaluations report task utility preservation and recovery under severe log erasure.

  • Problem

    Existing agent watermarking can disrupt deterministic execution through token perturbations, rely on brittle platform-specific paths, or be washed out during imitation.

    Source: A. Motivation: Watermarking Beyond… · p. 2

  • Method

    DUOW scores candidate agents and embeds ownership bits by selectively redirecting choices among functionally redundant routing alternatives at the external decision layer.

    Source: B. Main Contributions · p. 2, §IV · p. 5

  • Results

    Across four benchmarks, DUOW preserves task utility (≤99.2%) and surpasses existing methods in cloning resistance; on DBBench it achieves 74.65% recovery under 90% log loss.

    Source: 1) Resistance to Log Erasure · p. 10, §VI · p. 11

  • Takeaways & Limitations

    Utility-preserving routing choices carry ownership signals into cloned policies, making watermark removal more difficult without modifying model internals.

    Source: B. Main Contributions · p. 2

    Embedding capacity depends on functional overlap among candidate agents, which varies across queries and contexts and is not guaranteed.

    Source: §VI · p. 11

Abstract

from arXiv · show

Routing policies in Multi-Agent Systems (MAS) represent valuable intellectual property, yet their exposure through execution logs creates significant risks of unauthorized policy cloning. Existing agent watermarking methods protect intellectual property by modifying internal generation processes, such as perturbing token sampling distributions or injecting structural mutations into action trajectories, which may compromise task fidelity or suffer from limited transferability across heterogeneous platforms. To address these limitations, we propose Decision Uncertainty-Oriented Watermarking (DUOW), a lightweight framework that operates at the external decision layer without modifying model parameters or generated outputs. DUOW introduces a plug-and-play scoring mechanism that evaluates candidate agents from semantic and operational perspectives, identifies functionally redundant routing decisions, and selectively redirects choices among equivalent alternatives to embed ownership signals. By coupling watermark behaviors with utility-preserving routing decisions, DUOW enables cloned policies to retain ownership signals during policy imitation while increasing the difficulty of watermark removal. A confidence-driven adaptive threshold dynamically determines embedding opportunities, balancing watermark capacity and task fidelity under diverse routing contexts. Extensive evaluations on four multi-agent routing benchmarks demonstrate that DUOW preserves high task utility, achieves reliable ownership verification under up to 90% log erasure, and introduces negligible computational overhead, with an average per-step latency of 0.043 ms and total embedding overhead below 0.54 ms.

I. INTRODUCTION

Execution logs expose proprietary routing behavior to imitation, while existing watermarking approaches can disrupt task execution or transfer poorly. DUOW embeds ownership signals in functionally redundant routing choices, using adaptive scoring to preserve utility.

I. INTRODUCTION

  • Observable execution logs expose routing logic to black-box extraction and imitation, threatening the commercial value of policies developed through extensive optimization.MAS coordinates heterogeneous agents, tools, and APIs, with routing policies determining task assignments under dynamic conditions.Source: §I · pp. 1–2

A. Motivation: Watermarking Beyond Token and Action

  • Token-level perturbations can disrupt deterministic execution and amplify through closed-loop planning, while action-sequence methods may depend on static tool definitions and transfer poorly.The cited related-work discussion also notes that some probability-centric methods require internal candidate distributions for verification.Source: A. Motivation: Watermarking Beyond… · p. 2
  • Existing watermark perturbations can be washed out by imitation, motivating ownership signals embedded directly in redundant routing decisions.The decision-level approach decouples the watermark from model parameters and generated content while preserving task utility.Source: A. Motivation: Watermarking Beyond… · p. 2

B. Main Contributions

  • DUOW embeds ownership signals among equivalent routing choices at the external decision layer, enabling black-box verification without modifying model parameters or generated content.Its scoring considers semantic alignment and operational utility, while an adaptive threshold identifies embedding opportunities.Source: B. Main Contributions · p. 2
  • Across four benchmarks, DUOW preserves task utility (≤99.2%), sustains recovery under 90% log erasure, and surpasses existing methods in cloning resistance.The conclusion also reports negligible per-step latency.Source: B. Main Contributions · p. 2

II. RELATED WORK

Prior work develops multi-agent routing and agent watermarking, but existing watermark methods leave gaps in black-box verification, transferability, or robustness to imitation. The threat model centers on routing decisions and logs that can expose behavior to attackers.

A. Multi-Agent Systems and Routing Policies

  • MAS routing research has shifted from enabling tool use toward choosing which tool or agent to invoke under varying task contexts.Examples progress from adaptive model cascades to step-level Q-value routing and search-based policy optimization.Source: A. Multi-Agent Systems and Routing… · pp. 2–3

B. Agent Watermarking

  • Existing probability-level watermarks may require internal distribution access or be smoothed out during distillation, while action-level methods can depend on static paths.The paper identifies functional redundancy among candidate agents as an underused alternative for embedding ownership.Source: B. Agent Watermarking · p. 3

III. THREAT MODEL

  • The threat model frames routing logs as observable records that can expose decisions to users, operators, or third parties.The section introduces the MAS architecture as the basis for this threat model.Source: §III · p. 3, 3) Decision Log (L) · p. 4

A. Multi-Agent System (MAS)

B. Adversary

The adversary seeks a routing agent or equivalent replica through unauthorized access or imitation of observable behaviors. The defense assumes owner control before deployment and black-box verification afterward, and DUOW uses decision redundancy for embedding.

B. Adversary

  • An adversary may obtain the target agent or parameters through leakage, or collect observable behaviors and train a surrogate through distillation or imitation learning.The goal is to avoid the cost of developing and optimizing the routing policy from scratch.Source: B. Adversary · p. 4

C. Defense Model

  • Before deployment, the owner controls the original routing agent and retains the secret watermark key and embedding configuration for later verification.Verification is assumed to occur through public API queries and returned sequential decision logs, without access to suspect-model internals.Source: 1) Watermark Embedding · p. 4, 2) Copyright Verification · p. 4

1) Watermark Embedding:

  • DUOW exploits decision redundancy by encoding ownership in selections among functionally equivalent agents, whose near-equivalent performance creates alternative routing paths.The embedding mechanism can skip steps without sufficient uncertainty or viable alternatives and defer bit insertion to a later step.Source: §IV · pp. 4–5

IV. METHODS

  • A plug-and-play score module estimates candidate suitability because cross-entropy training emphasizes the top choice and leaves other agents’ logits uninformative about downstream competitiveness.The reference scoring mechanism computes scores for all candidate agents.Source: §IV · pp. 4–5

A. Plug-and-Play Score Module

The score module estimates candidate suitability from semantic alignment and operational utility. It combines query-to-capability similarity with runtime conditions to guide routing choices.

A. Plug-and-Play Score Module

1) Static Semantic Alignment:

  • Static semantic alignment compares the query and candidate capability descriptor in a shared feature space using scaled cosine similarity.The frozen encoder and scaling function bound the resulting score to [0, 1].Source: 1) Static Semantic Alignment · p. 5

2) Dynamic Operational Utility:

  • Dynamic operational utility incorporates normalized response latency and workload, with weighting factors balancing the importance of each runtime metric.The synthesized reference score combines semantic alignment and operational utility, and their weights sum to one.Source: 2) Dynamic Operational Utility · p. 5

B. Adaptive Watermark Embedding

DUOW adapts its threshold to estimate available decision slack from both candidate competitiveness and routing preference. It redirects choices at suitable intervals to embed watermark bits, while leaving other decisions unchanged and deferring the bit.

B. Adaptive Watermark Embedding

1) Adaptive Redundancy Interval Determination:

  • The scoring module scores each candidate agent, and DUOW compares the top two scores to determine the score gap used in identifying redundancy intervals.The section introduces the adaptive threshold to address the limits of a fixed threshold for estimating slack.Source: 1) Adaptive Redundancy Interval… · pp. 5–6
  • The adaptive threshold accounts for both the score gap between the top candidates and the top candidate’s score, because identical gaps can imply different routing preferences and redirection risks.A higher top-candidate score indicates stronger preference and less available slack; a lower score suggests greater slack.Source: 1) Adaptive Redundancy Interval… · pp. 5–6

2) Trajectory Redirection by Watermarks:

DUOW embeds payload bits by redirecting routing choices at selected redundancy intervals. Canonical ordering of the candidate pair supports consistent recovery across platforms.

2) Trajectory Redirection by Watermarks:

C. Watermark Extraction and Verification

DUOW verifies ownership from public routing logs without access to the suspect model’s internal states. It recomputes carrier steps and uses the private key to recover watermark bits.

C. Watermark Extraction and Verification

  • The verifier uses the shared scoring module and private key to extract ownership bits from the suspect system’s public routing decision log, without access to internal states.Recovered bits are aggregated by statistical consensus to tolerate partial log loss.Source: C. Watermark Extraction and Verification · p. 6

1) Carrier Localization and Bit Extraction:

  • The verifier recomputes candidate scores and identifies carrier steps using the score-gap boundary condition, filtering out deterministic steps where no watermark could have been embedded.Source: 1) Carrier Localization and Bit… · p. 6
  • For each carrier step, the verifier orders the top-two candidates by UUID and uses the private-key-derived mask to recover the embedded bit.Source: 1) Carrier Localization and Bit… · p. 6

2) Redundant Voting Consensus:

DUOW repeats the watermark sequence cyclically along the routing trajectory to make recovery possible from incomplete logs. During verification, recovered copies are grouped by payload position and decoded by majority vote.

2) Redundant Voting Consensus:

  • DUOW cyclically repeats the watermark sequence along the routing trajectory so that surviving copies can support recovery when decision logs are partially erased or truncated.The repetition strategy costs additional capacity, while the authors note that multi-agent tasks typically have long decision chains with redundant routing steps.Source: 2) Redundant Voting Consensus · p. 6
  • Recovered bits are pooled according to their periodic payload position, and each payload bit is decoded by majority vote among its recovered copies.Source: 2) Redundant Voting Consensus · pp. 6–7
  • The verification workflow initializes a tracking pool for each payload index and adds recovered bits to the corresponding pool before consensus decoding.Source: 2) Redundant Voting Consensus · p. 7

V. EXPERIMENTS

DUOW is evaluated on four multi-agent routing benchmarks using a routing agent and a lightweight plugin that scores query-agent alignment. The benchmarks cover sequential tool routing, database routing, and API dispatch.

1) Environments and Tasks:

2) Experimental Configuration:

  • The evaluation uses Gemma-3-12B-it for native routing and a lightweight DUOW plugin with bge-small-zh-v1.5 embeddings for semantic utility scoring.Source: 2) Experimental Configuration · p. 7

3) Baselines:

Across four benchmarks, DUOW maintains near-lossless task utility as embedding increases, while its hyperparameters provide a smooth way to adjust embedding capacity. Evaluation compares DUOW with AgentMark and uses unwatermarked Base as the utility reference.

3) Baselines:

B. Feasibility Analysis of Slack-Based Redirection

1) Hyperparameter Impact on Embedding Rate:

  • At λ = α = 0.5, the average embedding rate is 67.9%; at λ = α = 0.9, it reaches approximately 91.9%.Embedding rate increases monotonically and smoothly with both hyperparameters across the four benchmarks.Source: 1) Hyperparameter Impact on Embedding… · p. 8

2) Hyperparameter Impact on Decision Utility:

The tested hyperparameter settings maintain high utility while varying embedding capacity, and DUOW Enhanced recovers payloads more reliably than AgentMark Enhanced under severe log erasure. The robustness evaluation also examines resistance to policy cloning.

2) Hyperparameter Impact on Decision Utility:

D. Robustness Analysis

1) Resistance to Log Erasure:

2) Resistance to Policy Cloning:

DUOW shows stronger watermark transfer to unseen cloned-policy tasks than AgentMark while adding little routing latency. Its embedding opportunities still depend on functional overlap among candidate agents.

2) Resistance to Policy Cloning:

  • With Llama3.1 at 60% embedding, DUOW’s U-ER is 27.59% on ToolBench and 37.29% on DBBench, versus AgentMark’s 9.86% and 6.90%.Both schemes exceed 95% S-ER, while DUOW reaches 92.61% O-VR on ToolBench versus AgentMark’s 90.92% and improves O-VR by up to 32.00% on Gorilla-TF. DUOW embeds signals in preferences among equivalent agents, whereas AgentMark’s step-level decoding requires synchronization with local trajectory patterns that imitation can disrupt.Source: 2) Resistance to Policy Cloning · p. 10

E. Computational Efficiency and Complexity Analysis

VI. CONCLUSION

  • Embedding capacity depends on functional overlap among candidate agents; sharply bounded domains may lack embeddable choices, making verification unreliable.The paper identifies active redundancy engineering and cross-step coding as possible future directions for sparse-redundancy settings.Source: §VI · p. 11

Related papers

Loading 2610.14606v1…