Technical Summary: A Watermark for Vision-Language-Action and World Action Models

Problem Statement

Vision-Language-Action (VLA) models and World-Action Models (WAMs) are increasingly deployed as black-box services where the model weights remain private, but the policy is executed via an API or on-site package. These models represent significant intellectual property (IP) due to the proprietary data and computational resources required for their training. A critical challenge arises when a partner or adversary attempts to resell or redeploy a protected policy without the owner's permission.

Existing watermarking solutions for robot policies face two primary limitations:

1. Backdoor-based watermarks: These require modifying model weights to trigger specific actions. They are difficult to extend to multi-user identification scenarios and can be weakened by subsequent fine-tuning or behavior cloning.
2. Output-perturbation watermarks: These embed signals into the exploration noise of the action stream. However, because the signal is concentrated in a narrow frequency band of the output, it is easily detectable by adversaries who can apply spectral analysis and narrow filters to remove the watermark with minimal impact on task performance.

The core problem is to design a watermarking mechanism that protects ownership in a black-box setting, supports multi-key identification, remains robust against output-side removal attacks, and does not degrade task performance.

Methodology: Keyed Latent-Provenance Verification

The authors propose Keyed Latent-Provenance Verification, a two-stage method that embeds ownership evidence in the latent noise seed rather than the final action output.

1. Fingerprint Injection

The injection occurs before the model generates an action chunk.

• Mechanism: The model owner replaces the standard Gaussian noise seed ($z_c$) drawn by the sampler with a "fingerprinted" seed ($z^{fp}_c$).
• Keyed Perturbation: The fingerprinted seed is a linear combination of the original noise and a keyed reference vector ($r_c$):
  $$z^{fp}_c = \sqrt{1-\beta^2} z_c + \beta r_c$$
  where $\beta$ controls the injection strength. The reference vector $r_c$ is generated using a pseudorandom generator seeded by a secret key $k^*$, a nonce $\nu_e$, and the chunk index.
• Statistical Invariance: Crucially, the resulting $z^{fp}_c$ retains the exact same Gaussian distribution ($N(0, I)$) as the original noise. This ensures that the action stream does not exhibit an explicit, additive signal that an adversary could easily filter out. The correlation between the seed and the key is hidden within the model's non-linear generation process.
• Selective Injection: Not every action chunk is marked. A keyed selector determines which chunks are perturbed to limit task disturbance and prevent adversaries from identifying specific "marked" chunks for targeted removal.

2. Fingerprint Verification

Verification is performed by an authorized owner who has access to the suspect robot's executed actions (which may be partial or post-processed).

• MAP Latent Recovery: Since the verifier cannot see the internal seed, they must recover it from the observed actions ($y_c$). The authors formulate this as a Maximum A Posteriori (MAP) optimization problem. The verifier searches for a latent seed $\hat{z}$ that minimizes the error between the predicted action (generated from $\hat{z}$) and the observed action, while penalizing deviations from the Gaussian prior. This approach avoids the need to guess unobserved action channels, a failure point for reverse-ODE methods used in image watermarking.
• Key-Conditioned Scoring: The recovered seed is compared against candidate keyed references using a matched filter (inner product).
• Calibration and Aggregation: To handle variability across tasks and episodes, the verifier scores the suspect against a bank of "decoy" keys to normalize the scores (Z-score). Evidence from multiple rollouts (group aggregation) is summed to make a final binary decision on ownership or to identify the specific key among multiple candidates.

Key Contributions

1. Keyed Latent-Provenance Verification: A novel framework that watermarks VLA and WAM deployments by modifying the latent noise seed, preserving the Gaussian noise law, and avoiding visible output-side signals.
2. Black-Box Verifier Design: A verification system capable of recovering latent seeds from partial, post-processed action commands using MAP optimization, supporting both binary ownership verification and multi-key identification.
3. Comprehensive Evaluation: Extensive experiments across two policy families ($\pi0.5$ and LingBot-VA) and two robot suites (LIBERO-10 and RoboTwin), evaluating robustness against output-side attacks (clipping, smoothing, jitter, delay), owner-side variants (LoRA, pruning, quantization), and adaptive fine-tuning attacks.

Experimental Results

The method was evaluated on four model-robot combinations. Key findings include:

• Task Performance: The injection of the watermark resulted in negligible changes to task success rates (typically within a few percentage points) and episode lengths.
• Detection Accuracy: In the absence of attacks, the method achieved perfect detection (TPR 1.00 at 1% False Positive Rate) across all combinations when aggregating 16 rollouts.
• Robustness to Output Attacks: The watermark remained detectable under various output-side removal attacks. While aggressive smoothing or jitter on the $\pi0.5$/LIBERO-10 combination reduced detection rates, the method generally maintained high robustness. The authors note that attacks strong enough to remove the watermark often degraded task performance significantly.
• Robustness to Owner Variants: The fingerprint survived LoRA fine-tuning, pruning, and quantization. In cases where compression damaged the model backbone (reducing task success), the fingerprint was still recoverable after aggregation.
• Identification: The system successfully identified the specific key assigned to a suspect policy among 33 candidates, achieving high rank-1 accuracy after aggregation.
• Security Analysis:
  • False-Key Risk: The probability of a random or independent key passing the threshold is extremely low (empirically estimated around $10^{-3}$ to $10^{-9}$ depending on the threshold).
  • Adaptive Removal: White-box attacks where an adversary fine-tunes the policy to minimize the watermark score failed to remove the fingerprint without severely degrading task performance.
  • Distillation: Behavior cloning (training a student on the teacher's outputs) successfully removed the watermark, as the student learns the action distribution but not the specific noise-law invariance of the teacher's sampler. The authors frame this as a boundary where the cost of evasion (training a new model) becomes prohibitive.

Significance and Claims

The paper claims that keyed latent-provenance verification offers a practical and robust mechanism for protecting private generative robot policies. By embedding the watermark in the latent seed rather than the output, the method avoids the "cheap removal" vulnerability of frequency-based watermarks.

The authors emphasize that their guarantees are empirical operating points rather than cryptographic proofs. The method is designed for authorized, post-hoc audits where the owner has access to the suspect service. The significance lies in enabling owners to detect unauthorized redeployment of their policies even when the weights are hidden and the output is subject to standard deployment post-processing. The work highlights a trade-off: while the watermark is robust against output manipulation and model editing, it is vulnerable to distillation, suggesting that the cost of evasion shifts from simple filtering to the expensive process of retraining a new policy.