Routing logs leak multi-agent policies: hiding a watermark in equivalent decisions survives 90% log erasure
Synopsis
Multi-agent routing policies can be cloned from execution logs, and a watermark that leaves model parameters and generated outputs untouched hides ownership signals in functionally equivalent rerouting decisions, remaining verifiable after up to 90% of logs are erased across four routing benchmarks.
Interpretation
Routing policies in multi-agent systems are valuable intellectual property, and exposure through execution logs creates a real risk of unauthorized cloning; a new watermarking approach places ownership signals at the external decision layer without touching model parameters or the generated outputs. Earlier agent watermarking protected intellectual property by modifying internal generation processes, such as perturbing token sampling distributions or injecting structural mutations into action trajectories. Evaluations on four multi-agent routing benchmarks report that the method preserves high task utility and achieves reliable ownership verification under up to 90% log erasure.
The method first identifies routing decisions that are functionally redundant, then selectively redirects choices among those equivalent alternatives to embed the ownership signal. The judgment comes from a plug-and-play scoring mechanism that evaluates candidate agents from semantic and operational perspectives, with a confidence-driven adaptive threshold dynamically deciding when to embed. The evaluation spans four multi-agent routing benchmarks, with an average per-step latency of 0.043 ms and total embedding overhead below 0.54 ms.
Perspective
Intended for researchers and engineers working on intellectual property and routing-policy protection in multi-agent systems, the setting is routing choice at the external decision layer, without modifying model parameters or generated outputs. The evaluation covers four multi-agent routing benchmarks and reports task utility, ownership verification under log erasure, and per-step and total embedding overhead.
The source is summary-level and does not give per-benchmark utility values or item-by-item comparisons, nor the full mapping between log-erasure fractions and verification success. The claim that cloned policies retain the signal during imitation while removal becomes harder is the method's reported conclusion.