Coding agent trajectory watermarking detects edits and proves ownership
TrajMark: Ownership Attribution and Segment-Level Tamper Localization for Coding-Agent Trajectories
Cryptography and SecuritySoftware Engineering
Summary
When software agents write code, it's important to prove who created the final work and to tell if someone changed parts of the process. The authors propose TrajMark, a system that adds hidden marks to the agent’s sequence of actions to identify the owner and to flag exactly where changes were made. This system doesn’t need special training and doesn’t add extra steps to making code. Their tests showed it can reliably find the owner and detect or locate modifications in the process.
What this means in practice
- •For software security teams: Verify the ownership of code produced by automated coding agents and detect where unauthorized edits occurred in their action sequences.
- •For ai service operators: Implement transparent integrity checks on AI agent outputs to ensure reliable provenance and flag local manipulations in generated code sequences.
Authors
Bokang Zeng, Zheng Gao, Xiaoyu Li, Xiaoyan Feng, Jiaojiao Jiang
Abstract
Watermarking the final patch produced by a coding agent provides provenance evidence for the submitted artifact, but does not authenticate the visible process that produced it. Behavioral watermarking methods primarily provide a global detection or identifier-recovery signal, so a locally edited trajectory may retain sufficient ownership evidence without revealing which protected region has become inconsistent. To address this limitation, we propose TrajMark, a training-free, symmetric-key, visible-only trajectory watermarking framework that separates robust ownership attribution from fragile local integrity verification. Our framework consists of two complementary layers: a sparse owner layer that encodes a six-bit deployment identifier by rewriting a keyed subset of naturally occurring READ actions into masked linear equations, and a localization layer that inserts linked Q12 ordinary, group, and terminal seals to commit to protected critical-action segments. This separation allows ownership evidence to accumulate robustly across trajectories, while local modifications perturb nearby keyed commitments and expose the affected protocol region. We further provide a design-level analysis of owner recoverability, integrity collision probability, structural overhead, and localization behavior. Across three coding-agent frameworks and three LLMs, TrajMark recovers the exact owner in all evaluated clean full-watermark batches. Under exhaustive eligible single-site attacks it detects 95.5%-100% of edits, and under random single-action corruption it localizes 95.8% of modified sites to an accepted protocol region rather than to the individual action. Owner marking adds no trajectory actions; the integrity layer adds explicit read-only seals, and matched Pass@1 is 26.9% versus 26.3% for unwatermarked runs.