# Watermarking

Multi-agent routing policies can be cloned from execution logs, and a watermark that leaves model parameters and generated outputs untouched hides ownership signals in functionally equivalent rerouting decisions, remaining verifiable after up to 90% of logs are erased across four routing benchmarks.

Multi-agent routing policies can be cloned from execution logs, and a watermark that leaves model parameters and generated outputs untouched hides ownership signals in functionally equivalent rerouting decisions, remaining verifiable after up to 90% of logs are erased across four routing benchmarks.

Model protection for on-orbit inference no longer has to be all-or-nothing. STAR-OV applies a two-stage reversible perturbation in parameter space, degrading a model from original accuracy to a medium-accuracy state and then to near-random guessing, while the recorded perturbations form hierarchical keys that restore different performance levels by authorization tier. A latent watermark embedded after recovery stays inactive during normal inference and produces verifiable trigger responses once activated. Across four public datasets, the fully encrypted state drops to roughly 10% to 13.97% accuracy while only 10⁻³% to 10⁻²% of parameters are modified.

Model protection for on-orbit inference no longer has to be all-or-nothing. STAR-OV applies a two-stage reversible perturbation in parameter space, degrading a model from original accuracy to a medium-accuracy state and then to near-random guessing, while the recorded perturbations form hierarchical keys that restore different performance levels by authorization tier. A latent watermark embedded after recovery stays inactive during normal inference and produces verifiable trigger responses once activated. Across four public datasets, the fully encrypted state drops to roughly 10% to 13.97% accuracy while only 10⁻³% to 10⁻²% of parameters are modified.

Provenance watermarks for diffusion-generated images were previously suppressed by removal attacks with little visible quality loss. WaveMark embeds the message in the initial noise's wavelet domain, using a key to spread replicas of each message bit across spatial positions, wavelet orientations, and scales, then encodes each bit in a carrier's projection magnitude. On SD2.1 it reaches 100.0% bit accuracy without attacks and retains 88.66% and 88.06% under MarkNull and MarkNull-A, above the compared baselines.

Provenance watermarks for diffusion-generated images were previously suppressed by removal attacks with little visible quality loss. WaveMark embeds the message in the initial noise's wavelet domain, using a key to spread replicas of each message bit across spatial positions, wavelet orientations, and scales, then encodes each bit in a carrier's projection magnitude. On SD2.1 it reaches 100.0% bit accuracy without attacks and retains 88.66% and 88.06% under MarkNull and MarkNull-A, above the compared baselines.

The work proposes a defense that is agnostic to the underlying watermarking method: it randomizes watermark key selection per query and accepts content as genuine only if a watermark is detected by exactly one key, yielding a sample-count-independent upper bound on forgery success for blind attackers conditional on key-symmetric, independent detector outcomes without further degrading model utility; against the adaptive blind attackers evaluated, harmful-text forgery success at r=4 keys drops from as high as 87% with a single key to as low as 1%, and a preliminary image study shows a reduction from 100% to 2%.

The work proposes a defense that is agnostic to the underlying watermarking method: it randomizes watermark key selection per query and accepts content as genuine only if a watermark is detected by exactly one key, yielding a sample-count-independent upper bound on forgery success for blind attackers conditional on key-symmetric, independent detector outcomes without further degrading model utility; against the adaptive blind attackers evaluated, harmful-text forgery success at r=4 keys drops from as high as 87% with a single key to as low as 1%, and a preliminary image study shows a reduction from 100% to 2%.

The work introduces GenoTrace, a codon-aware extension of green-list watermarking that modulates a teacher model's generation bias with two token-level factors—codon position and organism-specific codon usage—so that the resulting synthetic sequences remain auditable after distillation into a smaller student; in a three-seed GenomeOcean-500M-to-100M experiment the joint configuration achieves a mean audit score of 17.88 and 94.5% detection at a fixed threshold, retaining 49.0% detection after key-aware token substitution (versus 0% for the available single-seed plain-watermark comparator) and 47.0% after combined mechanism-targeted nucleotide edits.

The work introduces GenoTrace, a codon-aware extension of green-list watermarking that modulates a teacher model's generation bias with two token-level factors—codon position and organism-specific codon usage—so that the resulting synthetic sequences remain auditable after distillation into a smaller student; in a three-seed GenomeOcean-500M-to-100M experiment the joint configuration achieves a mean audit score of 17.88 and 94.5% detection at a fixed threshold, retaining 49.0% detection after key-aware token substitution (versus 0% for the available single-seed plain-watermark comparator) and 47.0% after combined mechanism-targeted nucleotide edits.