LLM agents reach users through resellers, who may rebrand a developer's agent or substitute a cheaper model. When provenance is disputed, attribution rests on the trajectory log (the record of tool calls, observations, and executed actions, not the model's reasoning), which the reseller stores and processes to meter usage. A watermark must therefore survive an adversary with full read/write access to the very evidence it is detected from; existing agent watermarks do not, as their attribution is read straight off that log. We present TRACE, to our knowledge the first agent watermark that is distortion-free in its action choices, self-synchronizing under deletion, and unconditionally invariant under rewriting. Deletion desynchronizes a position-derived key and rewriting alters content, so a deletion-robust key must come from content and a rewrite-robust key from position, and no single key serves both. A trajectory, however, has room for two watermarks. TRACE superposes a selection channel that sets which action is chosen, keyed on local content with a distortion-free sampler, so the agent's distribution is provably unchanged and detection resynchronizes after deletions, and a tally channel that sets how many records each decision group holds, keyed on the log's skeleton alone, which no rewriting can touch. We prove this behavioral watermark's signal is bought with decision entropy, each decision paying at least half its entropy and deterministic decisions nothing, and that erasing both channels forces the reseller to corrupt the trajectories it resells. On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate while its selection channel reaches detection scores near z = 100 on long-horizon trajectories, stays detectable under 70% step deletion, and keeps a tally channel exactly unchanged under LLM rewriting of any strength.
Source Attribution for Large Language Model-Generated Data
School of Computing（计算机学院）；National University of Singapore（新加坡国立大学）；Institute for Infocomm Research（信息通信研究院）；Agency for Science, Technology and Research（新加坡科技研究局）
MirrorMark: Generalizable Mirrored Sampling for Multi-bit LLM Watermarking
George Mason University（乔治·马歇尔大学）；Department of Computer Science（计算机科学系）；Wireless Cyber Center（无线网络安全中心）；Department of Electrical and Computer Engineering（电气与计算机工程系）
Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution
Zhejiang University（浙江大学）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；Nanyang Technological University（南洋理工大学）
Blind PRNG Hijacking: An Undetectable Integrity-Preserving Attack Against LLM Watermarking
Fujian Provincial Key Laboratory of Automotive Electronics and Electric Drive（福建省汽车电子与电力驱动重点实验室）；School of Electronic, Electrical and Physics（电子、电气与物理学院）；Fujian University of Technology（福建理工大学）；School of Humanities（人文学院）；Institute of Applied Physics and Materials Engineering（应用物理与材料工程学院）；University of Macau（澳门大学）
Ideal Attribution and Faithful Watermarks for Language Models
Data Science Institute, University of Chicago（芝加哥大学数据科学研究院）；Paul G. Allen School of Computer Science & Engineering, University of Washington（华盛顿大学保罗·G·阿伦计算机科学与工程学院）
MelShield: Robust Mel-Domain Audio Watermarking for Provenance Attribution of AI Generated Synthesized Speech
Department of Electrical and Computer Engineering, Queen's University, Kingston, ON, Canada（皇后大学电气与计算机工程系）；Department of Electrical and Computer Engineering, University of Waterloo, Waterloo, ON, Canada（滑铁卢大学电气与计算机工程系）
Unforgeable Watermarks for Language Models via Robust Signatures
Paul G. Allen School of Computer Science & Engineering, University of Washington（保罗·G·艾伦计算机科学与工程学院，华盛顿大学）；Data Science Institute, University of Chicago（数据科学研究所，芝加哥大学）
PURA: Provably Unbiased and Robust Multi-Bit Watermarking for AI-Generated Text Attribution
Hefei University of Technology（合肥工业大学）；University of Chinese Academy of Sciences（中国科学院大学）；University of Science and Technology of China（中国科学技术大学）；Bilkent University（比尔肯特大学）
Department of Computer & Information Science & Engineering, University of Florida（佛罗里达大学计算机与信息科学与工程系）；School of Computer Science, University of Oklahoma（俄克拉荷马大学计算机科学学院）；Department of Electrical Engineering and Computer Science, United States Military Academy（美国军事学院电子工程与计算机科学系）
MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems
Zhejiang University of Technology（浙江工业大学）；National University of Singapore（新加坡国立大学）；King Abdullah University of Science and Technology（阿卜杜拉国王科技大学）；Bairong（柏荣）；Tongji University（同济大学）；Universiti Malaya（马来亚大学）；University of Hong Kong（香港大学）
VideoMark: A Distortion-Free Robust Watermarking Framework for Video Diffusion Models
AI Thrust, Hong Kong University of Science and Technology (Guangzhou), China（香港科技大学（广州）人工智能 thrust）；School of Software, BNRist, Tsinghua University, China（清华大学软件学院）
TriniMark: A Robust Generative Speech Watermarking Method for Trinity-Level Traceability
Huaqiao University（华侨大学）；East China Normal University（华东师范大学）；Shenzhen University（深圳大学）；French National Institute of Health and Medical Research（法国国家健康与医学研究院）
DualGuard: Dual-stream Large Language Model Watermarking Defense against Paraphrase and Spoofing Attack
Institute of Information Engineering, Chinese Academy of Sciences（信息工程研究所，中国科学院）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络与信息安全学院）；Institute of Computing Technology, Chinese Academy of Sciences（计算技术研究所，中国科学院）
MATRIX: Multi-Layer Code Watermarking via Dual-Channel Constrained Parity-Check Encoding
Beijing University of Posts and Telecommunications（北京邮电大学）；Nanyang Technological University（南洋理工大学）；Harbin Institute of Technology, Shenzhen（哈尔滨工业大学（深圳））；School of Cyberspace Security, Huazhong University of Science and Technology（华中科技大学网络空间安全学院）
Rethinking LLM Watermark Detection in Black-Box Settings: A Non-Intrusive Third-Party Framework
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；National Computer Network Emergency Response Technical Team, Coordination Center of China (CNCERT/CC)（国家计算机网络应急技术处理协调中心）
