Search papers, labs, and topics across Lattice.
This paper introduces a novel method called keyed latent-provenance verification for watermarking vision-language-action (VLA) and world-action models (WAM) to protect intellectual property in robotic control systems. By embedding a unique fingerprint into the Gaussian noise seed used during model generation, the method allows owners to verify the authenticity of their models without altering the statistical properties of the outputs. Experimental results demonstrate that the watermark can be reliably detected across different models and remains robust against various adversarial attacks, ensuring effective ownership verification.
Watermarking VLA and WAM models can now be done without sacrificing performance or revealing detectable signals to adversaries.
Vision-language-action (VLA) models and world-action models (WAM) are the generative models now driving general-purpose robot control, turning raw camera input directly into motor commands. They are increasingly deployed as black-box services, where a partner runs the policy through an interface while the owner keeps the weights private. Training such a model takes proprietary data and heavy computational power, making the deployed model itself a valuable intellectual property. To address this, we propose the \emph{keyed latent-provenance verification} method, which fingerprints the policy through the seed of the Gaussian noise vector that the models draw before generation. At the injection stage, the owner swaps this seed for a keyed one with the same distribution as ordinary noise, so the fingerprinted actions are statistically identical to those of an ordinary run and an adversary watching the output finds no signal to detect or remove. At the verification stage, the owner runs the suspect model under authorized access and records the action channels the robot executes, a partial and possibly post-processed view of the policy's output. From this view, the verifier recovers the seed by gradient-based maximum a posteriori (MAP) optimization, tests it for the secret key to score each rollout, and aggregates these scores into a single decision on whether the suspect model belongs to the owner. We evaluate the method on two representative models across two robot suites. The experiments cover detection of the fingerprint, identification of which of several keys a suspect carries, robustness to a range of attacks, and an analysis of why the design works. Across both models, the fingerprint can be detected reliably with little change to task performance, and it remains detectable under output-side removal attacks and weight-level edits.
