Search papers, labs, and topics across Lattice.
This paper introduces DirBucket, a semantic watermarking and auditing framework designed to address the challenges of monitoring document reuse in third-party retrieval-augmented generation (RAG) systems. By embedding meaning-preserving paraphrases biased toward provider-specific directions, DirBucket enables effective detection of document misuse from black-box outputs while maintaining retrieval quality. The framework demonstrates robust performance on a benchmark, achieving consistent detection of non-compliance across multiple providers with minimal false positives, even against adversarial strategies.
Embedding-space watermarking can make document reuse in third-party RAG statistically auditable, ensuring data providers can track their content's usage without compromising quality.
Third-party retrieval-augmented generation (RAG) marketplaces create a new auditing problem: data providers may license corpora to a RAG operator, yet later have no visibility into whether their documents are being reused without compensation. Auditing this misuse is difficult because the operator is non-cooperative, answers are paraphrased by the generator, and one response may combine evidence from many providers. We propose DirBucket, a provider-side semantic watermarking and black-box auditing framework for document-level reuse in multi-provider RAG. DirBucket watermarks documents by meaning-preserving paraphrases whose embeddings are biased toward provider-bucket secret directions, enabling detection from black-box answers while preserving retrieval utility. On a challenging benchmark that reflects mixed-provider reuse under black-box access, DirBucket is the only method that consistently achieves strong target detection with no non-target activation, detecting non-compliance in every audit within 23 audited answers on our primary benchmark. The watermark survives adversarial post-answer laundering, and none of the evaluated evasion strategies simultaneously defeats detection while preserving user-perceived answer quality. Detection transfers unchanged to a second benchmark built from real clinical, cyber-threat-intelligence, and legal provider corpora. These results suggest that embedding-space watermarking can make document reuse in third-party RAG statistically auditable.
