A Watermark for Vision-Language-Action and World Action Models Yule Liu1,2
Shuai Liu3
Jiaheng Wei1
Xinlei He2†
1 Hong Kong University of Science and Technology (Guangzhou)
arXiv:2606.23574v1 [cs.CR] 22 Jun 2026
2 Wuhan University
3 Xi’an Jiao Tong University
Abstract
able in https://github.com/Y-L-LIU/keyed-latentwatermarking-vla.
Vision-language-action (VLA) models and world-action models (WAM) are the generative models now driving general-purpose robot control, turning raw camera input directly into motor commands. They are increasingly deployed as black-box services, where a partner runs the policy through an interface while the owner keeps the weights private. Training such a model takes proprietary data and heavy computational power, making the deployed model itself a valuable intellectual property. To protect the model ownership, one standard tool is watermarking. Recent research has developed two types of watermarks for robot policies, i.e., backdoor-based and output-perturbation watermarks. However, the backdoor-based watermark cannot be extended to the multi-user identification scenario, while the output-perturbation watermark makes the watermark signal distributed in a narrow frequency band of the action output, which can be easily detected by the adversary. To address this, we propose the keyed latent-provenance verification method, which watermarks the policy through the seed of the Gaussian noise vector that the models draw before generation. At the injection stage, the owner swaps this seed for a keyed one with the same distribution as ordinary noise, so the fingerprinted actions are statistically identical to those of an ordinary run and an adversary watching the output finds no signal to detect or remove. At the verification stage, the owner runs the suspect model under authorized access and records the action channels the robot executes, a partial and possibly post-processed view of the policy’s output. From this view, the verifier recovers the seed by gradient-based maximum a posteriori (MAP) optimization, tests it for the secret key to score each rollout, and aggregates these scores into a single decision on whether the suspect model belongs to the owner. We evaluate the method on two representative models across two robot suites. The experiments cover detection of the fingerprint, identification of which of several keys a suspect carries, robustness to a range of attacks, and an analysis of why the design works. Across both models, the fingerprint can be detected reliably with little change to task performance, and it remains detectable under output-side removal attacks and weight-level edits. The code is avail-
1
Introduction
Robotic control is moving from task-specific controllers to generative policies trained on robot demonstrations, visual data, and web-scale language supervision [2, 3, 7, 9, 13]. Two model families drive this shift: vision-language-action (VLA) models map camera images and a language instruction directly to motor actions [3, 5, 7], while world-action models (WAMs) first predict how the scene will change and then infer the action that produces that change [10, 16]. Although they differ internally, both expose the same deployment interface: run the policy on the observation and task command, and the robot receives an action chunk. This action interface is also what a verifier can observe after deployment. Research policies are often released with open weights or code [2,9], but production policies are usually private derivatives. To reach better performance in real-world scenarios, a provider adapts a base policy with proprietary robot demonstrations and customer-specific task data. The production version may also use a larger model, more computational resources, or heavier serving infrastructure than a public research release. These adaptations make the deployed policy valuable intellectual property. The provider may serve it through an API or deliver it as a packaged service that a partner runs on site [5, 6, 8]. The weights can remain hidden in both cases, but a partner who can run the service can still query it, redeploy it, or dispute where a derived system came from. The ownership verification question is: from the action commands that reach the robot, can the provider detect a suspect service that is reusing the protected deployment to avoid training its own policy? Watermarking is the standard tool for ownership protection, but deployed robot policies need a mark that makes low-cost evasion insufficient. Existing methods can be categorized into backdoor-based or output-side watermarks. The backdoor-based watermark changes the weights so that a secret trigger makes the policy emit a telltale action [12]. It requires weight edits and trigger calibration. Multi-customer deployments also need separate trigger behaviors. Later fine-tuning or behavior cloning on ordinary task outputs can
0† Corresponding author: Xinlei He ([email protected]).
1
Rollout ×𝒏 Score Aggregation
Sampling Noise VLA / WAM
Secret Key Observation Instruction
Full Time Steps
Full Output Chunk
Partial Observation
MAP Optimization
𝒌𝟏 𝒌𝒖 (id:u) (id:1) Operationing Chunk
𝒌𝒎 (id:M)
Compare against Candidates
Match ✅ No match ❌
Verification
Matched Key 𝒌𝒖 (id:u)
Identification
Figure 1: Overview of our method.
weaken the rare trigger behavior. The output-side watermark marks a stochastic policy’s exploration noise [1]. It shapes that noise into a secret frequency band and reads the band back from the robot’s trajectory. That signal is easy for the owner to score, but its visibility gives an adversary a cheap removal handle: spectral analysis locates the band, and a narrow filter removes it with little cost to task performance (Section 5.2). Latent-noise watermarks for image generators, including Tree-Ring, Gaussian Shading, and RingID, embed ownership evidence in the keyed generation process [4, 14, 15]. They suggest a latent-side route for robot policies, but the audit surface is different: the owner can inspect only the action commands that reach the robot. Inspired by these latent-noise methods, our method has two stages (see Figure 1). In the injection stage, the challenge is to make the policy carry a key-dependent signal without changing the sampler’s noise law or exposing a simple removal target in the action stream. We therefore mark the random seed that the generator already draws before producing each action chunk. This seed is shared by both model families: the VLA can map it directly to an action chunk, while the WAM can use it to generate an intermediate future scene from which actions are inferred. At deployment, the owner mixes the ordinary Gaussian seed with a keyed Gaussian reference. The mixed seed still has the same Gaussian distribution as an ordinary seed, so individual sampler draws look like ordinary noise. The key appears only as a hidden correlation between the seed and the owner’s reference. The generator spreads that correlation through the action trajectory instead of adding an explicit output signal. In the verification stage, the challenge is the reverse one: the owner must recover evidence for that hidden correlation without seeing the seed. During an audit, the owner may only record the action commands that reach the robot’s actuators. These commands are a partial and altered view of the generator output. Some raw action channels may never reach the robot, and the deployment may clip, smooth, delay, or otherwise change the channels that do. For each marked chunk, the verifier searches for a latent seed that would make the owner’s generator reproduce the observed action commands while staying likely under the Gaussian prior. We frame this search as a maximum a posteriori (MAP) optimization problem: it balances an action-fitting term against a prior term that keeps the seed in a high-probability region of the
Gaussian latent space. The verifier then compares the recovered seed with the owner’s keyed reference. Decoy keys put scores from different tasks and rollouts on a common scale, and aggregating the calibrated scores gives a binary ownership decision. Ranking the same scores over candidate keys gives multi-key identification. We evaluate our method on two policy families and two robot embodiments: π0.5 and LingBot-VA on LIBERO-10, a single-arm suite, and RoboTwin, a dual-arm suite. The noattack evaluation answers two audit questions. Binary ownership verification asks whether the suspect policy carries the owner’s key. Multi-key identification asks which assigned key the suspect carries when the owner has issued different keys to different releases or licensees. We also report task success rate and episode length, so the reader can see whether the fingerprint changes robot performance. Across the four policy–robot combinations, task success rate changes by at most a few points. With 16 audit rollouts, binary verification reaches TPR 1.00 at 1% FPR in all four combinations, and the same grouped evidence makes the assigned key identifiable. We further validate the design choices and evaluate robustness. First, we compare our seed-space mark with an outputspace mark, showing why putting the signal directly on the action stream makes removal easier. Second, we compare MAP recovery with reverse-ODE recovery (used in Treering-like watermarks [14]), showing why the verifier should fit only the observed action channels rather than guess the hidden ones. We then test output-side post-processing attacks (clipping, smoothing, jitter, and delay) and owner-side variants (LoRA fine-tuning, pruning, and quantization). At the canonical attack strengths, the weakest cell still reaches TPR 0.84 at 1% FPR after aggregation. Aggressive smoothing or jitter on π0.5 /LIBERO-10 is the main output-side boundary, with TPR below 0.2 even at larger rollout budgets. Security analysis then studies false-key risk and a white-box removal attack that fine-tunes the policy against the verifier while trying to keep task success high. Overall, the attack does not remove the fingerprint, though one setting shows a weaker identification margin. Finally, the discussion treats behavior-cloning distillation as a boundary attack that replaces the keyed generator rather than redeploying it: the hidden fingerprint does not transfer to the student, but a less hidden variant can. 2
Watermarking robot and generative policies. Robotpolicy watermarking has mainly followed two routes. Backdoor-based ownership verification trains a secret trigger into the policy so that the marked model emits a recognizable action on that trigger [12]. This approach ties the mark to the weights and requires training or fine-tuning the policy. Output-side robot watermarking [1] instead targets traditional continuous-control policies by shaping exploration noise into a secret frequency band of the action stream. This addresses a passive-sensing setting, but the keyed energy still occupies a fixed band and gives an adversary a localized filtering target. Generative-model watermarking offers a related latentside idea: image diffusion watermarks such as Tree-Ring, Gaussian Shading, and RingID encode ownership information in the sampling noise rather than in a visible output pattern [4, 14, 15]. Our setting differs because the protected object is not an image observed in full, which means the reverse-ODE technique is no longer robust. The verifier sees only the action channels that reach the robot after deployment, so ownership evidence must be recovered from a partial and possibly post-processed trajectory.
Our contributions are as follows: • We introduce keyed latent-provenance verification, which watermarks VLA and WAM deployments without retraining the weights or adding a visible output-side action signal. • We design a black-box verifier that recovers seeds from partial, post-processed executed actions and supports both ownership verification and multi-key identification. • We evaluate the method across policy families and robot embodiments, including output-side attacks, owner-side variants, distillation as a process-removal boundary, and adaptive fine-tuning against the verifier.
2
Related Work
Generative robot policies. Recent robot foundation models use generative models as action policies [2, 3, 7, 9, 10, 13]. At each planning step, the policy reads the robot observation and task command, then generates a short action chunk that drives the robot. This paper studies the part of these systems that is common across architectures: a latent seed is sampled before generation, and the generator turns that seed into the action chunk. The seed-to-action path may be a flowmatching solver, a diffusion sampler, or a model that first predicts an intermediate world state.
3
We study provenance verification for resold robot policy services. The owner is an upstream provider who distributes a robot policy as a commercial service and later wants proof that a suspect service is reusing the protected deployment. The adversary tries to resell or redeploy that service without being detected. This matches commercial deployments in which a policy is exposed as a hosted API or as a licensed on-site package, while the weights and keyed sampler remain hidden [6, 8, 13]. In the licensed on-site case, the outside party can often wrap, forward, or post-process the service but cannot retrain the policy or replace its sealed sampler. The outside party can invoke the policy and read the actions it executes, but cannot inspect its internals.
• Vision-language-action policies. Vision-language-action (VLA) policies condition directly on camera images and a language instruction, then output the next chunk of robot actions [3, 7]. The action generator is trained with flow matching: it starts from Gaussian noise and follows a learned vector field until it reaches an action. At the level used by our verifier, the vision-language backbone and the flow solver form one differentiable map from latent seed to action: a = FθVLA (z; o),
Owner’s goal and capability. The owner provides the action policy and wants to protect ownership after deployment. In the injection phase, the owner runs the policy with a keyed sampler so that the generated actions carry the fingerprint. The owner may also release limited variants of the same service, produced by fine-tuning, pruning, or quantization. These variants are owner-side transformations rather than adversary attacks, but verification should still succeed if a suspect service is one of them. In the verification phase, the owner has authorized audit access to the suspect robot. It can record only the action commands sent to the actuators, after any deployment-side post-processing. It does not see the full model output: a model may emit 32 dimensions, while a single-arm robot drives only 7 and a dual-arm robot 14. Since non-actuated dimensions can be dropped before audit, the fingerprint must reside in the channels that reach the robot. The owner can collect multiple rollouts from the fixed suspect service and, using its own base model, test whether those rollouts carry its key. If the suspect is a released variant, recovery runs on the base model while the observed actions
where o contains the images and instruction. This direct noise-to-action map is the surface on which our fingerprint is injected and later recovered. • World-action models. World-action models use the same observation-to-action interface but route generation through a predicted future scene. It first predicts how the scene will change, as future video latents or frames, and then infers the action that would produce that future [10, 16]. We can write the high-level structure as h = Wθ (z; o),
Threat Model
a = Aθ (h; o),
where h is the predicted future-scene representation and Aθ maps that representation to actions. The path from z to a is deeper than in a VLA, but the composed map Aθ (Wθ (z; o); o) is still a differentiable seed-to-action generator. This shared structure lets one keyed latent mechanism cover both direct VLA policies and world-action models. 3
The owner uses a secret key k∗ for injection. In verification, k denotes any candidate key that the owner may test. Each episode also has a nonce νe , which makes the keyed reference fresh across episodes. The nonce is public rather than secret: it is part of the episode invocation context, such as an episode identifier or request identifier that the audit protocol records. For any candidate key k, episode nonce νe , and chunk c, a pseudorandom generator seeded by (k, νe , c) outputs a Gaussian reference vector rk,νe ,c ∈ RDz in the same latent seed space as zc . When k = k∗ , we write this reference as rc when the episode and chunk are clear.
come from the variant. We test this variant gap empirically in Section 5.5. Adversary’s goal and capability. The adversary obtains the owner’s model only through a black-box interface, either as a hosted API or as a locally packaged service whose weights and keyed sampler remain hidden. It redistributes that service as its own while trying to keep the robot useful and avoid the cost of training a replacement policy. Because the adversary cannot open the weights or keyed sampler, in-scope removal attacks act on the output stream. It may clamp action magnitudes, apply EMA smoothing, add jitter, or insert a fixed-step delay before commands reach the actuators. Dropping non-actuated dimensions is not a separate attack because those dimensions never enter the owner’s audit view. Thus the adversary controls deployment, while the owner sees only the final action commands during audit. We give the recovery procedure and calibration in Section 4.2. Scope statement. The in-scope suspect service still runs the protected keyed sampling process inside the black box. Equivalently, it still invokes the owner’s injection step when it generates action chunks. Training a fresh student policy on teacher outputs and running it with a new sampler moves the adversary from redeployment to model training. That move brings the usual data and compute burden, along with any capability loss from behavior cloning. This is the same boundary as generation-time latent watermarks such as TreeRing [14], Gaussian Shading [15], and RingID [4]. We map this boundary empirically in Section 8 and fig. 9, where behavior cloning exposes the trade-off between distillation resistance, Gaussian noise-law invariance, and key-space size.
4
4.1
Fingerprint Injection
The fingerprint injection procedure consists of two parts: keyed chunk selection and keyed latent perturbation. Keyed chunk selection. In the injection process, not every chunk is fingerprinted. A keyed selector S (k∗ , νe , c) ∈ {0, 1} decides which chunks carry the perturbation. Within each episode, it marks at most m chunks, with a key-dependent gap of at most P chunks between selected positions. Here, P is the selector’s maximum gap and m is the per-episode selection cap. Both the starting offset and the specific slots are determined by a pseudorandom generator seeded by (k∗ , νe ). The selection schedule is therefore fixed for whoever holds the key, but unpredictable to anyone without it. Selecting only some chunks serves two purposes. First, it limits how often the generated action stream carries a keycorrelated perturbation, which lowers the power of aggregate action-level tests and reduces task disturbance. Second, the selection schedule is secret: an adversary without k∗ cannot tell which chunks carry the mark, so targeted removal would require perturbing the action stream broadly rather than editing only the marked chunks. Keyed latent perturbation. At each chunk c, the policy sampler draws a base latent vector zc ∼ N (0, IDz ) ∈ RDz . If S (k∗ , νe , c) = 1, the chunk is selected, and the owner uses the keyed reference rc = rk∗ ,νe ,c defined above. Over fresh keyed generator outputs, the coordinates of rc are i.i.d. N (0, 1). The selected chunk uses the fingerprinted seed: q fp (1) zc = 1 − β2 zc + β rc ,
Method
The model owner wants to verify whether a suspect policy service is running the protected keyed sampling process. We call our framework keyed latent provenance verification. It targets action-generative policies with continuous latent noise, including flow-matching and diffusion policies. The method has two stages. First, injection hides a keyed signal in the sampler’s initial noise while preserving the Gaussian noise law, so the action stream does not expose an explicit mark. Second, verification works from the audit view available after deployment: partial and possibly post-processed action commands. From this view, the verifier estimates latent seeds, scores their alignment with candidate keyed references, and aggregates rollout evidence to decide whether the suspect policy carries the owner’s key. Notation. A rollout episode is indexed by e and contains action chunks indexed by c. At chunk c, the policy sees observation oc and draws latent seed noise zc ∼ N (0, IDz ). We write the full differentiable generator from seed noise to raw action as Fθ :
where β ∈ (0, 1] controls the injection strength. Marginally over fresh base noise and keyed references, zc and rc are indefp pendent N (0, IDz ) vectors, so zc is again N (0, IDz ): mean 0 2 2 and covariance (1−β )IDz +β IDz = IDz . The injection therefore leaves the sampler’s latent-noise distribution unchanged: without k∗ , no statistical test on individual sampler draws can separate fingerprinted from base noise. If S (k∗ , νe , c) = 0, the sampler uses the unmodified seed zc . The policy then passes the chosen seed through flow matching or diffusion to generate the action chunk. This placement is why the fingerprint is injected into the sampler noise rather than added to the executed action. An output-space mark is easy for the owner to define and score, but it remains exposed in the action stream. If that mark concentrates energy in a narrow frequency band, an adversary can locate the band and remove it directly. Latent injec-
ac = Fθ (zc ; oc ) ∈ RH×Draw . Here Dz is the latent seed dimension, H is the action horizon, and Draw is the number of raw action channels emitted at each step. The robot executes only Denv ≤ Draw of those channels. 4
part of the latent space, so the optimizer cannot explain missing action channels by drifting to unlikely latent values. Unlike reverse ODE inversion, MAP recovery does not require the verifier to guess whether the training pipeline padded, masked, or otherwise filled channels that the robot never executed. We estimate z̃c by starting gradient descent from several random initial seeds. Each run sends its current seed through Fθ , compares the predicted executed channels with yc , and updates the seed to reduce the loss in Equation (3). We keep the run with the lowest final loss. Implementation choices for β, P, m, λz , and σobs are given in Section .1. Section 5.3 tests this choice against reverse ODE inversion. Key-conditioned scoring. For each episode e and candidate key k, the verifier applies the same selector S (k, νe , c) to choose the chunks that this key would have marked. Let Me (k) be the number of selected chunks in that episode. The verifier orders those chunks by time and writes the recovered latent seeds as ẑe,1:Me (k) and the matching references as rk,1:Me (k) . This shorthand uses the same nonce νe and the same chunk positions on both sides. For the lag notation below, we write these ordered sequences as ẑe (k) and rk,e . It then computes a score: se (k) = ψ ẑe,1:Me (k) , rk,1:Me (k) , (4)
tion instead places the reference before the model’s nonlinear generator. The policy mixes the keyed perturbation while generating the action, so the executed action does not expose the reference as a simple additive signal and the fingerprint energy spreads across the action spectrum (Figure 2). Section 5.2 tests this difference with an output-space baseline.
4.2
Fingerprint Verification
In the verification stage, the verifier turns observed actions into evidence about the key. For a candidate key k, it estimates the latent seed that entered the generator behind each observed action chunk, scores that estimate against the references generated from k, and aggregates these scores across rollouts. For ownership detection, the candidate key of interest is k∗ . Below, we describe each step. Observation model. The verifier cannot access the model’s internal noise directly. It records only the actions the robot executes. These actions differ from the policy’s raw output in two ways. First, the environment runs only Denv out of the Draw channels, for example, for a single-arm robot suite, Denv = 7 while Draw = 32. Second, the deployment may post-process the executed stream before it reaches the actuators. In the experiments, this includes clipping, exponential smoothing, additive jitter, and fixed-step delay, but the observation model treats these as instances of a general postprocessing map. Let z̃c be the latent seed that actually enters fp the generator at chunk c: it is zc for a selected chunk and the unmodified base seed otherwise. The verifier therefore observes: yc = g(PC (Fθ (z̃c ; oc ))) + εc , (2)
where ψ(ẑ, r) = r⊤ ẑ is the matched filter. The inner product is taken after flattening the selected seed vectors, and it measures how strongly the recovered seeds align with the keyed reference. In the ideal additive-Gaussian model, this matched filter is the Neyman–Pearson optimal score [11]. When the controller introduces a timing delay, the verifier replaces ψ with the lag-conditioned score defined in the synchronization search below. Z-score construction. The raw scores se (k) vary across episodes because tasks and trajectory lengths differ. To put scores from different episodes on the same scale, the verifier also scores a bank of J decoy keys. For a candidate key k, choose decoy keys {k j }Jj=1 that are distinct from k and sampled independently from the same key space. The verifier computes se (k j ) for every decoy key in the same episode, using that decoy key’s selected chunks, then uses these decoy scores to estimate the episode’s wrong-key mean and scale:
where PC projects the raw action chunk from RH×Draw to the environment-visible channels in RH×Denv , g(·) models deployment-side post-processing (clipping, smoothing, jitter, delay), and εc captures measurement noise at chunk c. In the full-observation setting, PC = I and g is the identity function. MAP latent recovery. Recovering z̃c from this partial and possibly post-processed observation is the main challenge in the verification stage. The obvious baseline is to run the generative ODE backward from the observed action. This is illposed when yc is partial: the Denv observed channels leave the remaining Draw − Denv raw channels underdetermined. A reverse-ODE method (like Tree-ring [14]) must first guess those missing channels before running backward, and errors in that completion can move the reverse trajectory away from the model’s training convention. We instead pose latent recovery as a MAP estimation problem: find the noise ẑc that best fits the observed Denv channels while staying close to the Gaussian prior:
1 J ∑ se (k j ), J j=1 " #1/2 J 1 2 . σ− ∑ se (k j ) − µ−e (k) e (k) = J − 1 j=1 µ− e (k) =
The calibrated score is:
λz 1 ∥g(PC (Fθ (z; oc ))) − yc ∥22 + ∥z∥22 . ẑc = arg min z 2σ2 2 | {z } | obs {z } observation likelihood
(5)
Ze (k) =
se (k) − µ− e (k) . σ− (k) + εZ e
(6)
The small constant εZ only prevents division by zero. This normalization has a useful property: because the decoy references are generated by the same procedure as the owner’s − reference and differ only in the key value, µ− e (k) and σe (k) measure what recovery and matching return for the wrong
Gaussian prior
(3) Here σobs sets the observation-noise scale, and λz controls how strongly the Gaussian prior penalizes large seeds. The Gaussian prior keeps the recovered seed in a high-density 5
key in that episode. As a result, Ze (k∗ ) reflects only the response specific to the owner’s key, not any correlation that would appear for any key due to the rollout’s structure. Here H0 means that the suspect policy does not carry candidate key k, and H1 means that it carries and preserves that key. Under H0 , the decoy normalization makes Ze (k) approximately centered with unit scale; under H1 , the carried key produces a positive shift. Multi-trajectory evidence aggregation. Because of task variability, controller effects, partial observability, and stochastic execution, a single rollout gives weak or ambiguous evidence about the key. Summing the calibrated scores over a group G of rollouts amplifies the true-key signal while averaging out per-episode noise:
∑ ψℓ (ẑe (k∗ ), rk∗ ,e ) ,
2
4
6 0
frequency (Hz)
action PSD
watermark band
(7)
G can contain same-task or cross-task rollouts; the group size |G| controls how many rollouts the verifier collects from the suspect. Under H0 , TG (k) stays near zero. Under H1 for the owner’s key, each episode contributes a positive increment, so TG (k∗ ) grows with |G|. The final decision compares TG (k∗ ) against a threshold set at the (1 − αFPR ) quantile of the decoy-key distribution of TG , targeting a false positive rate of αFPR . Synchronization search. The verifier includes a small alignment step before scoring. For a candidate lag ℓ, let ψℓ (ẑe (k), rk,e ) be the matched-filter score after shifting the recovered seed representation against the keyed reference and keeping only coordinates with valid control-time overlap; ψ0 is the lag-zero score above. The verifier picks the lag ℓ∗ that maximizes the keyed response summed over G: 0≤ℓ≤L e∈G
0
LingBot / LIBERO-10
2
4
frequency (Hz)
6
(a) Executed-action spectrum.
e∈G
ℓ∗ = arg max
latent (ours) + output sine ( = 0.3)
0.5 / LIBERO-10
10 1 10 2 10 3 10 4
MF score (norm. to no attack)
TG (k) = ∑ Ze (k).
band-stop plain
no attack
0.5 / LIBERO-10
sine MF score
LingBot / LIBERO-10
1.0 0.5 0.0
2
4
6
notch center (Hz)
8
2
4
6
notch center (Hz)
8
(b) Band-stop removal sweep. Figure 2: Output-level baseline. Panel (a) plots the executedaction spectrum; the shaded region is the 1–2 Hz sinewatermark band. Panel (b) moves a fixed-width band-stop filter across frequencies and reports the matched-filter score after filtering.
p The |G| scaling shows when aggregation can rescue a weak per-episode signal. If µ is small but positive, d ′ still grows without bound, so a moderate |G| reaches near-perfect detection. A fingerprint-free model (µ = 0) gains nothing from aggregation. Inverting the relation gives the rollout budget needed for a target (TPR, FPR):
(8)
where L is the maximum lag searched. Every episode is then scored at this single lag: se (k) = ψℓ∗ (ẑe (k), rk,e ). Since the same ℓ∗ is applied to the true key and all J decoys, the decoykey distribution uses the same alignment choice as the owner key. We set L = max(⌈0.1 H⌉, 4), where H is the chunk horizon; this keeps the searched shifts small relative to the action window while still covering short multi-step offsets. Detection Rate. After MAP recovery, decoy-key calibration, and optional lag alignment, each episode contributes one calibrated score Ze (k). The group statistic TG (k∗ ) then follows a simple scaling law: as |G| grows, detection depends only on the per-episode signal-to-noise of these calibrated scores.
2 q 2 Φ−1 (TPR) + Φ−1 (1 − FPR) (σ0 + σ21 )/2 . |G| ≥ µ We compare this prediction against the bootstrap measurements in Section 5.4.
5
Verification Evaluation
5.1
Experimental Setup
Evaluation design. This evaluation asks whether the same verifier works across two sources of variation: the action generator and the robot embodiment. We therefore test one flow-matching VLA, π0.5 , and one world-action model, LingBot-VA, on LIBERO-10 as the single-arm suite and RoboTwin as the dual-arm suite. The model determines the raw action dimension, and the robot suite determines which of those channels are executed. The executed/raw channel counts are 7/32 for π0.5 /LIBERO-10, 7/30 for LingBotVA/LIBERO-10, 14/32 for π0.5 /RoboTwin, and 16/30 for LingBot-VA/RoboTwin. Together these four model–suite
Proposition 1 (Detection rate of group aggregation) Assume episodes in G are independent. Under H1 , let the per-episode calibrated score have mean µ and variance σ21 . Under H0 , let it have mean 0 and variance σ20 . Then the d-prime of TG (k∗ ) = ∑e∈G Ze (k∗ ) is p µ , d ′ (|G|) = |G| · q (σ20 + σ21 )/2 and under a Gaussian approximation the TPR at FPR αFPR is Φ d ′ (|G|) − Φ−1 (1 − αFPR ) . 6
Table 1: Overall verification under partial observation with MAP recovery. Utility columns give task success rate (SR) and mean episode steps for plain vs. fingerprinted rollouts. AUC is per-episode (|G|=1); AUC16 and TPR at FPR= 1% use group budget |G|=16. Detection columns report the no-attack condition and the average over canonical-strength removal attacks. Utility (clean)
Clean
Model
Dataset
SRpl→fp
∆SR
Stepspl→fp
AUC
AUC16
TPR@1%
AUC
AUC16
TPR@1%
LingBot LingBot pi0.5 pi0.5
LIBERO-10 RoboTwin LIBERO-10 RoboTwin
0.94→0.96 0.57→0.53 0.96→0.96 0.50→0.57
+0.02 -0.04 +0.00 +0.07
277→271 184→187 261→266 412→337
1.000 1.000 0.901 0.852
1.000 1.000 1.000 1.000
1.000 1.000 1.000 1.000
1.000 0.999 0.798 0.854
1.000 1.000 0.991 1.000
1.000 1.000 0.840 1.000
cells let the results be read against both generator family and partial observation.
high. When the notch covers it, the score collapses. At the provenance operating point, the default notch cuts the sine score by about 90%. Single-shot TPR@1% drops from 0.82 to 0.17 on π0.5 and from 0.95 to 0.18 on LingBot-VA. The action edit is modest, about 0.06 per-coordinate RMSE, and is far below the perturbation strengths that damage task success in Figure 5. This experiment isolates the weakness that latent injection is meant to avoid. An output-space mark remains an exposed action artifact. It is easy to score, but the same visibility gives the adversary a cheap removal handle. By injecting the keyed reference before the generator, our method lets the policy mix the signal before it reaches the robot. The executed action therefore does not present one narrow band that can be removed without otherwise changing the policy behavior.
Common protocol. Each cell has a plain rollout pool and a fingerprinted rollout pool. The plain pool runs the same policy without latent injection. It supplies the utility comparison and the no-injection false-positive check. The fingerprinted pool runs with the owner’s key k∗ : the selector chooses up to five action chunks per episode, and each selected chunk receives a reference with strength β = 1.0 and four Gaussian tones in the 1–2 Hz band. Unless stated otherwise, the verifier observes only the executed channels, recovers one latent estimate for each selected chunk with MAP, and scores the recovered latents against the owner’s key. It also scores the same episode against J = 32 decoy keys, which gives the wrong-key mean and scale used to form the calibrated episode score Ze (k∗ ). The query budget |G| is the number of suspect episodes in one provenance decision. To report a budget, we repeatedly form groups of |G| fingerprinted episodes and sum their owner-key calibrated scores as TG (k∗ ). For TPR at FPR= 1%, the threshold is set from grouped decoy-key scores, and the true-positive rate is measured on these grouped ownerkey scores. The confidence bands in the figures come from bootstrapping the episode-level score pools before forming these groups.
5.2
Robust (atk. avg)
5.3
Recovery Validation
This validation tests why the verifier uses MAP rather than reverse ODE inversion. Reverse ODE can run backward from a full raw action chunk, but the audit view is usually partial. On π0.5 /LIBERO-10, for example, the verifier sees 7 of 32 raw channels, so reverse ODE must either invert from an underdetermined endpoint or guess the 25 hidden channels. MAP avoids that completion step by fitting only the observed channels while a Gaussian prior keeps the recovered seed plausible. Table 2 compares the two recovery rules on the same 50 fingerprinted and 50 plain π0.5 /LIBERO-10 rollouts from the clean base policy (g=id). Only the observation regime and recovery rule change. AUC and Cohen’s d measure perchunk separation between recovered fingerprinted latents and
Injection-Site Validation
This validation tests why the fingerprint is injected in latent space rather than directly into the executed action. The output-level alternative adds the keyed reference to the action that reaches the robot, then verifies it with the same matchedfilter machinery. We make this baseline strong rather than artificial: the verifier knows the keyed sine family, scores each episode against the true key and 32 decoy keys, and uses the same LIBERO-10 action streams used elsewhere in the paper (100 π0.5 episodes and 200 LingBot-VA episodes). The sine occupies the 1–2 Hz band at strength β=0.05. The removal attack is a 4th-order Butterworth band-stop filter. The default notch, 0.8–2.2 Hz, covers the watermark band, and a fixed-width sweep moves the notch to test whether removal is localized rather than a generic effect of filtering. Figure 2 shows the main failure mode of output-level marking: the mark is easy for the owner to score because it is also easy for an adversary to locate. The output mark creates visible spectral peaks in the shaded 1–2 Hz band. When the notch misses that region, the matched-filter score remains
Table 2: Latent recovery on π0.5 /LIBERO-10: MAP vs. reverseODE, by observation regime and, for partial-observation ODE, by pad-completion assumption. Columns are per-chunk separation AUC, Cohen’s d, and recovered-noise norm ∥ẑ∥2 .
7
Obs.
Recovery
AUC
Cohen d
∥ẑ∥2
full
ODE MAP
0.809 0.994
1.26 3.34
— —
partial
ODE, no pad (underdet.) ODE, pad V =0 (matched) ODE, pad V =1 (mismatch) ODE, secret random pad MAP (pad-agnostic)
0.492 0.969 0.678 0.508 0.775
−0.03 2.30 0.62 0.02 1.07
— 4.1 79 79 —
clean
Rate-law calibration (165/168 within band/±0.05)
0.8
|G| = 8 |G| = 16 |G| = 32
TPR @ FPR = 1%
|G| = 1 |G| = 2 |G| = 4
0.6
family LingBot / LIBERO-10 LingBot / RoboTwin 0.5 / LIBERO-10 0.5 / RoboTwin
0.2 0.0
0.0
0.2
0.4
0.6
0.8
1.0
measured TPR (bootstrap)
jitter 0.01
delay 1
delay 2
LingBot / RoboTwin
0.75 0.50 0.25 0.00
1
2
1
2
1.00
0.4
ema 0.5
LingBot / LIBERO-10
1.00
TPR @ FPR = 1%
predicted TPR (Prop. 4.2)
1.0
clip 1
4
8
16
32
64
4
8
16
32
64
0.5 / LIBERO-10
1
2
1
2
4
8
16
32
64
4
8
16
32
64
0.5 / RoboTwin
0.75 0.50 0.25 0.00
query budget |G|
Figure 3: Detection power and rate-law calibration under partial observation with MAP recovery. Right: true positive rate vs. query budget |G| at FPR= 1%, with one panel per model–suite cell and one line per attack condition. Bands are 5–95% bootstrap intervals. Left: predicted TPR from Proposition 1 vs. measured TPR for each model–suite cell, attack condition, and query budget. The diagonal is y=x, the shaded envelope is ±0.05 TPR, colors identify model–suite cells, and markers identify |G|.
realized plain FPR (%)
|G|=1
3
|G|=16
aggregates to TPR@1%=1.0 at |G|=16 in the main verifier (Figure 3).
1% target
2.4 2.0
2
5.4
The main clean-policy result is that latent injection leaves task utility nearly unchanged and makes the owner key detectable in all four model–suite cells. Table 1 shows that task success rate changes by at most a few points after injection, and mean episode length stays comparable between plain and fingerprinted rollouts. Detection is already strong from one episode and becomes reliable once the verifier aggregates rollouts. The LingBot-VA cells separate the true key almost perfectly from one episode (AUC ≥0.999 on both LIBERO10 and RoboTwin). For π0.5 , single episodes are weaker but still above chance: AUC 0.90 on LIBERO-10 and 0.85 on RoboTwin. Aggregation closes this gap: in Table 1, all four cells reach AUC16 =1.0 and TPR@1%=1.0 in the no-attack condition. Figure 3 shows the same trend as the query budget grows.
1 0.8 0.3
0
LingBot LIBERO-10
0.0
LingBot RoboTwin
0.0 0.5
LIBERO-10
0.3
Verification Results
0.1 0.5
RoboTwin
Figure 4: Decoy-key threshold calibration at the nominal 1% operating point. Each point is the realized false-positive rate on plain rollouts without injection when the threshold is set from decoy-key scores, shown for |G|=1 and |G|=16. The dashed line is the nominal target; points below it are conservative, while points above it are anti-conservative.
the plain pool. For partial-observation ODE, we vary how the missing channels are filled before inversion. The no-pad row leaves the endpoint underdetermined. The matched row uses the training pad V =0, the mismatch row uses the wrong constant pad V =1, and the secret-random row fills the channels with a random value unknown to the verifier. The results show that reverse ODE works only when hidden channels are completed correctly. With full observation, both methods recover the fingerprint, and MAP separates more cleanly (AUC 0.994 vs. 0.809). With partial observation, ODE falls to chance without a completion rule (AUC 0.492) and becomes strong only under the oracle matched pad (AUC 0.969). Wrong or secret pads break this advantage: AUC drops to 0.678 with V =1 and 0.508 with a secret random pad. MAP is not the best oracle row, but it is pad-agnostic, still produces a keyed signal (AUC 0.775), and
Comparison with the predicted rate. The rate law predicts how many rollouts are needed once the per-episode score distribution is known. In Figure 3, the measured TPR matches the Gaussian prediction of Proposition 1 within the 5–95% bootstrap band, or within 0.05 TPR, in 165 of 168 model– suite, attack, and |G| settings. The remaining misses occur at low budgets in the π0.5 /LIBERO-10 cell, where the verifier sees only seven executed channels: jitter 0.01 at |G|=2, and delay τ=2 at |G|∈{1, 2}. These are small-budget deviations where the symmetric-Gaussian approximation is most sensitive to per-episode skew, and the gap disappears as aggregation pulls TG toward normality. This agreement supports using Proposition 1 to plan the query budget. Decoy-key calibration vs. literal H0 . The verifier sets its 8
Table 3: Owner-side variant robustness. AUC1 is per episode; AUC16 and TPR use |G|=16 at FPR= 1%.
threshold from decoy keys, but the literal H0 is a no-injection suspect policy that does not carry k∗ . We therefore check whether a threshold calibrated to nominal FPR= 1% on decoy keys also controls false positives on plain rollouts. It does for three of the four model–suite cells: the realized plain-FPR stays at or below the nominal value in Figure 4. For these cells, the decoy-key null is a conservative stand-in for the literal H0 , so the reported detection rates are lower bounds. The exception is LingBot-VA/RoboTwin, where the realized plain-FPR reaches 2.0% at |G|=1 and 2.4% at |G|=16 at the nominal 1% point. Its plain rollouts carry chunklevel correlation that aligns weakly with the keyed reference even without injection, which the decoy-key threshold cannot fully separate. This makes the fixed-threshold TPR mildly anti-conservative on that cell. The same effect can also inflate realized FPR under output post-processing, especially jitter, so when this drift matters we read the threshold-free AUC in Tables 1 and 6.
5.5
Model
Dataset
Edit
AUC1 AUC16 TPR
LingBot LIBERO-10 LoRA 1.00 LingBot LIBERO-10 prune30 1.00 LingBot LIBERO-10 int8 1.00
1.00 1.00 1.00
1.00 1.00 1.00
LingBot RoboTwin LingBot RoboTwin LingBot RoboTwin
LoRA 0.83 prune30 1.00 int8 1.00
1.00 1.00 1.00
1.00 1.00 1.00
π0.5 π0.5 π0.5
LIBERO-10 LoRA 1.00 LIBERO-10 prune30 0.99 LIBERO-10 int8 1.00
1.00 1.00 1.00
1.00 1.00 1.00
π0.5 π0.5 π0.5
RoboTwin RoboTwin RoboTwin
1.00 0.97 1.00
1.00 0.56 0.94
LoRA 0.87 prune30 0.68 int8 0.76
TPR at 1% FPR stays below 0.2 even at |G|=64 (Table 6). These two settings mark the boundary of output-level robustness.
Robustness to Attacks and Owner Variants
Owner-side variant setup. Weight edits test a variant gap rather than an adversary removal attack: the verifier uses the owner’s base model, but the observed actions come from a released descendant. We fine-tune fingerprinted descendants with LoRA adapters on additional task data and evaluate them with the same verifier as the base policy. The comparison asks whether the keyed latent perturbation still affects the descendant’s actions strongly enough for MAP recovery to find it. Table 3 lists the owner-side variant rows in the main text; the full swept output-attack rows remain in Table 6.
Output-level attack setup. Output-side attacks test the adversary class that can alter executed actions but cannot open the keyed sampler. We use four attack families from Section 3: clipping, exponential smoothing, additive jitter, and fixed-step delay. Each attack is applied to both fingerprinted and plain rollouts, so the AUC measures the attack’s effect on detecting the key rather than a generic shift in task distribution. For clipping, smoothing, and jitter, we sweep strengths where rollouts are available. delay is collected for all four model–suite cells. All cells use the same verifier: decoykey calibration, group aggregation, and a 1% FPR operating point. Output-level: results. The main pattern is that output postprocessing usually fails to remove the fingerprint unless it also destroys a large part of the action signal. On both LingBot-VA cells, every output attack stays at the detection ceiling: per-episode AUC is at least 0.99, and TPR@1% is 1.00 at |G|=16. On the π0.5 cells, the attacks split into two regimes. If the attack also degrades the policy, as clipping does on π0.5 /RoboTwin, suppressing the fingerprint costs the adversary the capability it is trying to keep. The harder case is π0.5 /LIBERO-10, where smoothing, jitter, and delay can perturb the action stream while keeping task success rate near 0.95. Even in this harder cell, the failure modes are specific rather than general. A delay mostly shifts the signal in time, so synchronization search realigns it. With the search enabled, a one-step delay rises from TPR 0.28 to 1.00 at |G|=16, and two- or three-step delays recover once the group budget reaches |G|=32 or 64 (Table 7). Smoothing is different because it attenuates the signal itself. The default smoothing attack gives the lowest robust-average AUC in Table 1 (0.80), but its per-episode signal remains above chance and reaches the ceiling by |G|=64. Only the strongest smoothing and jitter settings both preserve task success and cut per-episode AUC to about 0.55; for these two settings,
Fine-tuning: results. The fingerprint survives LoRA finetuning in every cell. At |G|=16, all fine-tuned descendants reach group AUC 1.000 and TPR@1%=1.00. The cells differ only before aggregation: the weakest single-episode cell is LingBot-VA/RoboTwin, with AUC1 =0.83. LingBotVA/RoboTwin is the hardest fine-tuning cell because its single-task objective and deeper diffusion backbone reshape more of the path from latent seed to action. Aggregation removes that ambiguity, so fine-tuning does not prevent detection at the standard query budget. Compression: setup. Compression tests whether posttraining size reductions break the path from keyed latent seed to action. We evaluate magnitude pruning and int8 quantization on the fingerprinted policy. For LingBot-VA, the edit touches the diffusion transformer. For π0.5 , we also report an action-only compression that edits the action expert and projection heads while leaving the vision-language backbone intact. Compression: results. Compression leaves the fingerprint recoverable except when the edit also damages the policy backbone. On every LIBERO-10 cell and both LingBotVA cells, group AUC stays at 1.000 and per-episode AUC stays at least 0.94. The only sensitive case is π0.5 /RoboTwin, where compressing the whole model also compresses the vision-language backbone. That edit halves task success (SR=0.41) and drops per-episode AUC to 0.60, but the fin9
LingBot LIBERO-10
Clip
1.0 |G| = 32
AUC
0.5 0.0
1.000
TPR@1% = 1.00
10 3
10 2
10 1
clean (.96) s = 0.5 (.95) s = 1 (.96) s = 2 (.97)
100
LingBot RoboTwin
1.0 |G| = 32
0.5
LIBERO-10
0.0
1.000
TPR@1% = 1.00
10 3
10 2
10 1
clean (.53) s = 0.5 (.00) s = 1 (.70) s = 2 (.71)
100
1.0 |G| = 32
0.0
1.000
TPR@1% = 1.00
10 3
10 2
10 1
clean (.96) s = 0.5 (.88) s = 1 (.94) s = 2 (.90)
100
0.5
RoboTwin
1.0 |G| = 32
0.0
1.000
TPR@1% = 1.00
10 3
10 3
10 2
clean (.96) = 0.3 (.80) = 0.5 (.88) = 0.7 (.94)
10 1
100
AUC
0.5 0.0
1.000
TPR@1% = 1.00
10 3
10 2
0.0
clean (.53) = 0.3 (.74) = 0.5 (.74) = 0.7 (.75)
10 1
100
0.998
TPR@1% = 1.00
10 3
10 2
10 1
false-positive rate
clean (.57) s = 0.5 (.00) s = 1 (.00) s = 2 (.17)
10 2
100
0.0
clean (.96) = 0.3 (.92) = 0.5 (.96) = 0.7 (.98)
10 1
100
1.000
TPR@1% = 1.00
10 3
1.000
TPR@1% = 1.00clean (.96)
= 0.005 (.96) = 0.01 (.95) = 0.02 (.96) = 0.05 (.94)
10 3
10 2
10 1
AUC
1.000
100
0.5 0.0
TPR@1% = 1.00clean (.53)
= 0.005 (.70) = 0.01 (.64) = 0.02 (.36) = 0.05 (.25)
10 3
10 2
10 1
100
0.5 0.0
clean (.96) = 0.005 (.94) = 0.01 (.96) = 0.02 (.98) = 0.05 (.96)
10 3
10 2
10 1
AUC
1.000
100
1.0 |G| = 32
AUC
0.5
1.0 |G| = 32
1.0 |G| = 32
AUC
0.5
AUC
0.5 0.0
Jitter
1.0 |G| = 32
1.0 |G| = 32
AUC
0.5
0.0
1.000
TPR@1% = 1.00
1.0 |G| = 32
AUC
0.5
AUC
0.5
1.0 |G| = 32
1.0 |G| = 32
AUC
0.5
EMA
1.0 |G| = 32
10 2
clean (.57) = 0.3 (.50) = 0.5 (.57) = 0.7 (.44)
10 1
false-positive rate
100
0.5 0.0
TPR@1% = 1.00clean (.57)
= 0.005 (.52) = 0.01 (.44) = 0.02 (.39) = 0.05 (.37)
10 3
10 2
10 1
false-positive rate
100
AUC
0.5
1.000
TPR@1% = 1.00
0.0
10 3 1.0 |G| = 32 0.5
10 2
10 1
AUC
1.000
TPR@1% = 1.00
0.0
10 3 1.0 |G| = 32 0.5
10 2
10 1
AUC
0.995
TPR@1% = 1.00
0.0
10 3 1.0 |G| = 32 0.5 0.0
Delay
10 2
10 1
AUC
1.000
TPR@1% = 1.00
10 3
10 2
10 1
false-positive rate
clean (.96) = 1 (.88) = 2 (.82) = 3 (.74)
100
clean (.53) = 1 (.73) = 2 (.79) = 3 (.73)
100
clean (.96) = 1 (.95) = 2 (.96) = 3 (.97)
100
clean (.57) = 1 (.70) = 2 (.70) = 3 (.73)
100
Figure 5: ROC under output-side removal attacks at group budget |G|=32. Rows are model–suite cells; columns are attack families; black is the no-attack condition and purple→orange means weaker→stronger attack. The dotted vertical marks the 1% FPR target and the dot marks the operating point on each curve; parentheses give the fingerprinted policy’s success rate. Where all curves in a panel are near-perfect, the panel text gives the minimum AUC and TPR@1% instead of overlapping flat curves.
gerprint is still recoverable after aggregation (AUC16 =0.88 pruned, 0.98 quantized). When the compression is restricted to the action-side modules, the realistic case summarized in Table 3, the policy stays usable and the fingerprint remains separable after aggregation (AUC16 =0.97/1.00). The loss therefore comes from damaging the backbone, not from erasing the fingerprint.
5.6
the same J=32 decoy keys used for calibration. For decoy keys, we calibrate leave-one-out against the other decoys so all gallery scores live on one scale. Decision rules. Given a probe group G, the verifier ranks all gallery keys by TG (k). In the closed-set setting, the suspect is assumed to carry one gallery key, so the verifier returns the highest-scoring key k̂ = arg maxk TG (k). We report the cumulative match characteristic (CMC): rank-r is the probability that the true key k∗ appears among the top r keys. In the open-set setting, the suspect may carry no gallery key. The verifier therefore returns the highest-scoring key only when maxk TG (k) exceeds a rejection threshold τid ; otherwise it abstains. We set τid from plain no-injection rollouts treated as impostors, using the (1−αFAR ) quantile of their maxk TG (k) scores. We report DIR@αFAR , the fraction of genuine probes that both name the true key at rank 1 and exceed τid . Probe groups are bootstrap-resampled exactly as in Section 5.4.
Ablations
We leave two verifier ablations to the appendix. Section .5 isolates the synchronization search on the delay attack: on the hardest delayed cell, a one-step delay recovers from TPR 0.28 to 1.00 at |G|=16 after alignment. Section .6 compares same-task and cross-task aggregation; on the LingBot-VA cells, where both comparisons are meaningful, the curves nearly overlap. Thus, alignment helps when actions are shifted in time, while aggregation does not rely on mixing tasks.
6
Clean identification. Table 4 shows that naming the key is usually not the limiting step once the fingerprint is detectable. Identification is stricter than binary verification because the true key must outscore all 32 decoys, not merely exceed one decision threshold. The LingBot-VA cells clear this bar from one episode (rank-1 = 1.00 on both LIBERO-10 and RoboTwin). π0.5 is harder from one episode (rank-1 0.44 on LIBERO-10 and 0.23 on RoboTwin), matching the partialobservation and short-episode regime that also weakens its binary detection. Aggregation closes the gap: by |G|=16, all four model–suite cells reach rank-1 = 1.00 and open-set DIR@1% ≥ 0.99. The full clean CMC curves are in Section .7.
Identification Evaluation
The verification experiment asks a binary question: does the suspect policy carry the owner’s key k∗ ? Identification asks the attribution question that arises when the owner assigns different keys to different licensees or releases: which key does the suspect carry? The verifier does not need new rollouts for this task. For every candidate key k, it already computes an episode score Ze (k) and sums those scores over a rollout group as TG (k). The identification gallery in our experiments contains 33 candidate keys: the true key k∗ and 10
LingBot LIBERO-10
Clip
1.0 |G| = 32
DIR@1% = 1.00
0.5 0.0
10 2
10 1
100
LingBot RoboTwin
1.0 |G| = 32
0.5
LIBERO-10
0.0
10 3 1.0 |G| = 32
10 2
10 3 1.0 |G| = 32 0.5
RoboTwin
100
10 2
10 1
100
DIR@1% = 1.00
100
10 2
10 1
impostor false-alarm rate
clean (.53) = 0.3 (.74) = 0.5 (.74) = 0.7 (.75)
0.0
10 3 1.0 |G| = 32
10 1
10 2
100
10 3 1.0 |G| = 32
0.0
100
clean (.96) = 0.3 (.92) = 0.5 (.96) = 0.7 (.98)
0.0
10 1
10 2
100
DIR@1% = 1.00 clean (.57) = 0.3 (.50) = 0.5 (.57) = 0.7 (.44)
10 3
DIR@1% = 1.00
0.5 0.0
clean (.96) = 0.005 (.96) = 0.01 (.95) = 0.02 (.96) = 0.05 (.94)
10 3
10 2
10 1
100
10 1
10 2
impostor false-alarm rate
100
DIR@1% = 1.00
0.5
clean (.53) = 0.005 (.70) = 0.01 (.64) = 0.02 (.36) = 0.05 (.25)
0.0
10 3 1.0 |G| = 32
10 2
0.5
10 3 1.0 |G| = 32
100
10 2
10 1
100
DIR@1% = 1.00
0.5 0.0
10 1
clean (.96) = 0.005 (.94) = 0.01 (.96) = 0.02 (.98) = 0.05 (.96)
0.0
clean (.57) = 0.005 (.52) = 0.01 (.44) = 0.02 (.39) = 0.05 (.37)
10 3
10 2
Delay
1.0 |G| = 32
1.0 |G| = 32
DIR@1% = 1.00
0.5
clean (.57) s = 0.5 (.00) s = 1 (.00) s = 2 (.17)
10 3
10 1
10 2
0.5
clean (.96) s = 0.5 (.88) s = 1 (.94) s = 2 (.90)
0.0
0.0
10 1
DIR@1% = 1.00
0.5
10 3
0.5
clean (.53) s = 0.5 (.00) s = 1 (.70) s = 2 (.71)
0.5
clean (.96) = 0.3 (.80) = 0.5 (.88) = 0.7 (.94)
1.0 |G| = 32
DIR@1% = 1.00
0.5
0.0
Jitter
1.0 |G| = 32
DIR@1% = 1.00
0.5
clean (.96) s = 0.5 (.95) s = 1 (.96) s = 2 (.97)
10 3
EMA
1.0 |G| = 32
10 1
impostor false-alarm rate
100
DIR@1% = 1.00
0.5
clean (.96) = 1 (.88) = 2 (.82) = 3 (.74)
0.0
10 3 1.0 |G| = 32
10 1
10 2
DIR@1% = 1.00
0.5
clean (.53) = 1 (.73) = 2 (.79) = 3 (.73)
0.0
10 3 1.0 |G| = 32
10 1
10 2
0.5
100
clean (.96) = 1 (.95) = 2 (.96) = 3 (.97)
0.0
10 3 1.0 |G| = 32
10 1
10 2
0.5 0.0
100
100
clean (.57) = 1 (.70) = 2 (.70) = 3 (.73)
10 3
10 1
10 2
impostor false-alarm rate
100
Figure 6: Open-set identification under output-side attacks at group budget |G|=32. Each panel plots DIR against impostor false-alarm rate for one model–suite cell. Black is the no-attack condition; purple→orange denotes weaker→stronger attack settings. The dotted vertical line marks the 1% FAR operating point, and parentheses give the fingerprinted policy’s task success rate. Higher curves are better.
Table 4: Clean key identification over the 33-key gallery. R1 and R5 are closed-set CMC at ranks 1 and 5 for group budgets |G|=1 and |G|=16. DIR is open-set identification at |G|=16, with thresholds set from plain no-injection impostor rollouts at FAR 1% and 10%. R1
R5
DIR
Model
Dataset
G=1 G=16 G=1 G=16 1% 10%
LingBot LingBot π0.5 π0.5
LIBERO-10 RoboTwin LIBERO-10 RoboTwin
1.00 1.00 0.44 0.23
1.00 1.00 1.00 1.00
1.00 1.00 0.76 0.64
1.00 1.00 1.00 1.00
Table 5: Identification on owner-side variants over the 33-key gallery. R11 is closed-set rank-1 at |G|=1; R116 /DIR16 and R164 /DIR64 report closed-set rank-1 and open-set detectionand-identification at |G|=16 and 64. DIR uses FAR= 1%.
1.00 1.00 1.00 0.99
1.00 1.00 1.00 1.00
Output-side attacks. When an output-side attack lowers the recovered true-key score, identification degrades in the same way binary detection does. Figure 6 shows the openset stress test at |G|=32. Identification stays near the ceiling for both LingBot-VA cells and for most π0.5 settings. The visible drops occur in the same hard cases as binary detection: strong smoothing, jitter, or long delay attenuates the recovered signal before the gallery ranking step. Thus the attacks do not create a new failure specific to key naming; they make the true key harder to separate from decoys. The corresponding closed-set CMC curves are shown in Section .8. Owner-side variants. Owner-side variants test whether identification still works when the observed actions come from a released descendant rather than the owner’s base policy. Table 5 shows that most descendants become fully identifiable after aggregation. LoRA descendants reach rank-1 = 1.00 at |G|=16 in every model–suite cell, with DIR@1% ≥ 0.98. The LingBot-VA compression rows and
Variant
Model/Dataset
R11 R116 DIR16 R164 DIR64
LoRA LoRA LoRA LoRA
LingBot/LIBERO-10 LingBot/RoboTwin π0.5 /LIBERO-10 π0.5 /RoboTwin
1.00 0.33 1.00 0.33
1.00 1.00 1.00 1.00
1.00 0.98 1.00 0.99
1.00 1.00 1.00 1.00
1.00 1.00 1.00 1.00
prune30 prune30 prune30 prune30
LingBot/LIBERO-10 LingBot/RoboTwin π0.5 /LIBERO-10 π0.5 /RoboTwin
1.00 1.00 0.76 0.07
1.00 1.00 1.00 0.54
1.00 1.00 1.00 0.03
1.00 1.00 1.00 0.96
1.00 1.00 1.00 0.44
int8 int8 int8 int8
LingBot/LIBERO-10 LingBot/RoboTwin π0.5 /LIBERO-10 π0.5 /RoboTwin
1.00 0.99 1.00 0.09
1.00 1.00 1.00 0.88
1.00 1.00 1.00 0.34
1.00 1.00 1.00 1.00
1.00 1.00 1.00 1.00
the π0.5 /LIBERO-10 compression rows are also saturated at |G|=16. The only weaker owner-side case is π0.5 /RoboTwin under action-side compression. Even there, closed-set rank1 rises to 0.96 for prune30 and 1.00 for int8 by |G|=64, although the open-set rejection threshold remains stricter for prune30. This supports the same conclusion as the clean setting: once the fingerprint score is separable, naming the carried key is usually not the bottleneck.
7
Security Analysis
The evaluation above shows that the owner’s key produces a high group score TG (k∗ ). Security analysis asks two fur11
(a) Key separation 10 1
density
10 2 10 3 10 4
0
20
TG(k)
40
10 9
108 10 6
106 104 10 3
10 4
15
20
threshold dec
Figure 7: Security operating points for π0.5 /LIBERO-10 with partial-observation MAP recovery and |G|=16. Left: bootstrap distributions of the group statistic TG for false keys and for the true key; vertical lines mark the empirical 10−3 threshold and the fitted Gaussian-tail thresholds for 10−6 and 10−9 . Right: each threshold converted to the expected number of independent random-key guesses before one false key passes.
k ̸=k
(9) The verifier wants pcoll (τ) small while keeping qtrue (τ) near one. For N owners with independently assigned b-bit keys, the chance that any other owner can pass the threshold is bounded by N −b Powner (N; τ, b) ≤ N pcoll (τ) + 2 . (10) 2
10−9 ; both keep fitted true-positive rate TPR=1.00 in this pool. We treat these 10−6 and 10−9 values as model-based sensitivity points, not as distribution-free empirical bounds. For owner populations, Equation (10) separates false-key statistics from key assignment itself. With b=128, the birthday term is about 1.5 × 10−27 for N=106 owners. The practical control is therefore the threshold: choose τdec so that N pcoll (τdec ) is below the desired false-owner budget.
The first term is the statistical false-key tail across N owners; the second is the ordinary birthday collision probability for assigned keys. For an adversary that tries M independent random keys, the random-forgery probability and expected first-hit budget are Pforge (M; τ) = 1 − (1 − pcoll (τ))M , 1 . E[Mfirst ] ≈ pcoll (τ)
(b) Forgery budget 1010
false key true key hill-climb
guesses 1/pcoll
ther questions. First, can some other key also produce a high score on the same suspect policy? Second, can a white-box adversary edit the suspect policy so that the owner’s key no longer scores highly? We first analyze false-key risk. This covers both independent owners whose assigned keys accidentally clear the threshold and adversaries who try many random keys until one appears to match the suspect. Both cases are controlled by the false-key tail: the probability that a key k′ ̸= k∗ reaches the threshold. For a decision threshold τ, define the false-key collision tail and the true-key detection power as pcoll (τ) = ′Pr ∗ TG (k′ ) ≥ τ , qtrue (τ) = Pr[TG (k∗ ) ≥ τ] .
Empirical Unforgeability. Empirical unforgeability asks how many keys an adversary must try before one passes the verifier. If the adversary knows the algorithm and verifier but not k∗ , each independent random key succeeds with probability pcoll (τdec ). At the empirical 10−3 operating point this gives an expected random-forgery budget of about 103 guesses. The fitted 10−6 and 10−9 operating points would raise that budget to about 106 or 109 guesses while preserving fitted true-positive rate TPR=1.00 in Figure 7(b). The deployed 128-bit key space is the entropy ceiling, not the operating bottleneck. A structured attack would need more than random trials: it would need a way to move through key space toward larger TG . The keyed reference is generated coordinate by coordinate as (rk,ν,c )d = G(BLAKE 2 B(k∥ν∥c∥d)) , (12)
(11)
We estimate these quantities with the same partialobservation MAP verifier used in the main experiments, with the matched filter and |G|=16. The directly measured tail is an empirical operating point for this verifier and rollout pool, not a cryptographic proof. When we report lower false-key rates, we label them as parametric operating points from the fitted tail model. Key Uniqueness. Key uniqueness asks whether a different owner’s assigned key could pass the same provenance test. We estimate this risk by sampling 1024 independent decoy keys over the 300 fingerprinted episodes, calibrating each episode as in Equation (6), and bootstrapping 2 × 105 groups of size 16. Each decoy key is treated as a possible independent-owner key. Figure 7(a) shows the main result: the false-key distribution is far left of the true-key distribution. At the empirical 10−3 false-key operating point, τdec =11.8. The falsekey estimates agree across three views of the same tail: the empirical collision rate is 10−3 by construction, a Gaussian fit gives 9.4 × 10−4 at the same threshold, and a GEV fit gives 1.1 × 10−3 . The true key is far to the right, with TG (k∗ ) ∼ N (38.6, 3.52 ) and TPR=1.00 at τdec =11.8. This separation lets the verifier consider lower tolerated false-key tails without losing the true key in the fitted model. Under the Gaussian tail approximation, τdec =18.3 corresponds to pcoll ≈ 10−6 and τdec =23.1 corresponds to pcoll ≈
where d indexes the reference coordinate and G expands the hash output into one Gaussian value for nonce ν and chunk c. Thus the key reaches the score only through a one-way, non-differentiable seed map. Empirically, nearby and offset keys are uncorrelated with the true reference (|ρ| ≤ 0.15 for k∗ ±{1, 2, 3}, k∗ +100, and k∗ +12345). A relaxed hill-climb over integer keys finds a lucky single-episode score, but it does not transfer across nonces: its group score is TG =−1.3, far below τdec , while the true key scores 39.0 on the same episodes. These results support empirical unforgeability at the measured 10−3 operating point and show how the fitted tail model scales to stricter thresholds. They do not prove keyextraction hardness in the cryptographic sense. They show that, for this verifier and rollout pool, a forgery behaves like random guessing against a threshold that the verifier can tune 12
LingBot
RoboTwin-10 metric value
Per-episode AUC
1.0 0.5 0.0 1.0
0.0
0.5
1.0 0.0 Task success
0.5
0.8 0.6
AUC (DC) AUC (deployed) SR (DC)
1.0
8
0.95
0.75
0.74
zero-mean falls to chance chance
160
zero-mean chance
20
80
NKEYS
160
Discussion
Distillation. Distillation measures the far end of the evasion cost curve in Section 3. Here the adversary stops forwarding the protected service and trains a fresh student policy on outputs from the fingerprinted teacher. The student may imitate the teacher’s actions, but the adversary has now paid for a new artifact and runs it with a new sampler. The deployed fingerprint preserves the sampler’s noise law exactly: fp zc ∼ N (0, IDz ) whenever zc ∼ N (0, IDz ). The action stream therefore does not contain a persistent pattern for behavior cloning to copy (Sections 4.1 and 5.2). Figure 9 compares the deployed high-entropy mark with a low-entropy mark designed to be easier for a student to learn. The deployed zero-mean fingerprint falls to chance after behavior cloning on both π0.5 and LingBot-VA (AUC 0.504 and 0.508). For comparison, we also test a small lookup table of seed-bias vectors. The current robot state selects one bias vector before each chunk, which creates a repeatable action pattern that a student can learn. This biased seed-control mark survives behavior cloning better than the deployed mark (AUC 0.74–0.87 across the two panels) because it gives the student a persistent pattern to learn. That persistence comes from giving up exact Gaussian noise-law invariance and the large key space used for unforgeability and multi-key deployment. The experiment therefore frames distillation resistance as a trade-off between inheritance through behavior cloning and hidden, high-entropy keyed provenance. The stress-test setup is in Section .2.
using Equation (9). Adaptive Removal. Adaptive removal tests the second security question: whether an adversary can edit the suspect policy to suppress the owner’s key. We give the adversary the suspect weights and the verifier, then let it fine-tune LoRA parameters θ′ against the verifier. The attack minimizes
+ λreg ∥θ′ − θ∥22 .
80
NKEYS
0.92
Figure 9: Distillation stress tests. For biased seed-control marks, blue gives cross-student detection AUC and orange gives student task success (SR) as the lookup table varies over N=20, 80, 160 seed-bias vectors. Red crosses mark the deployed zero-mean seed fingerprint at comparable cardinality. Dashed gray lines mark chance AUC.
Figure 8: Cost-utility view of direct adaptive removal. Circles/solid lines are π0.5 ; squares/dashed lines are LingBot-VA. Within each family, darker markers and arrowheads mean stronger adaptive attacks. A successful removal attack would appear in the lower-right region.
LAD (θ′ ) = λrec ℓrec (ẑθ′ , rk ) + λtask ∥aθ′ − aθ ∥22
(b) LingBot-VA 0.90 0.78
20
0.5 0.0
(a) 0.5
1.0
DIR @ 1% FAR AUC / SR
LIBERO-10 metric value
0.5
(13)
Here ẑθ′ is the seed recovered by the same MAP verifier from the edited policy’s action aθ′ , rk is a keyed reference, and ℓrec is the recovered-key score that the attacker tries to drive down. The second term keeps the edited policy close to the pre-attack policy, and sweeping λtask gives the cost–utility frontier. This is a white-box stress test, stronger than the outputside attacks in Section 5.5 and outside our default black-box audit setting. It also tests the main removal concern: a strong single-rollout score gives the optimizer a local target, while a diffuse fingerprint gives the attacker little to suppress in any one rollout. Figure 8 is read as a removal plot: a successful adaptive attack would appear in the lower-right, where task success stays high but the verification metric is low. Across the two π0.5 cells, there are no lower-right points. LingBotVA/LIBERO-10 also has no effective lower-right point: when DIR drops, task success has already fallen to 44% or below. LingBot-VA/RoboTwin-10 contributes the single borderline point, and only on DIR. Relative to the no-attack anchor (DIR 0.999 at 82% task success), the highest taskpreservation adaptive setting lowers DIR to 0.570 while retaining 66% task success; group detection AUC, however, remains 0.999. We therefore separate the claims: detection robustness holds in all four model–suite cells, while full multikey identification robustness is supported in three cells and remains qualified for LingBot-VA/RoboTwin-10. Details are in Section .3.
9
Conclusion
We presented keyed latent-provenance verification for deployed VLA and world-action policies. The method watermarks the generator’s latent seed, keeps the sampler noise law unchanged, and verifies ownership from the executed action channels available in a black-box audit. Our evaluation shows that this signal supports ownership detection and multi-key identification across model families, robot embodiments, output-side attacks, and owner-side variants. These results make latent-seed provenance a practical protection mechanism for private generative robot policies. 13
Ethics Considerations
[3] Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, Szymon Jakubczak, Tim Jones, Liyiming Ke, Sergey Levine, Adrian Li-Bell, Mohith Mothukuri, Suraj Nair, Karl Pertsch, Lucy Xiaoyang Shi, James Tanner, Quan Vuong, Anna Walling, Haohuan Wang, and Ury Zhilinsky. π0 : A vision-language-action flow model for general robot control, 2026. URL: https://arxiv.org/ abs/2410.24164, arXiv:2410.24164. 1, 3
This work develops a defensive capability: a way for the legitimate owner of a robot policy to verify, after the fact, whether a suspect deployment was derived from their model. We considered the parties the method touches: the model owner it protects, the adversary it is designed to detect, the operators and bystanders of a fingerprinted robot, and independent third parties who could be wrongly implicated. Two of these concerns need a direct answer: that verification could wrongly implicate an innocent party, and that the technique could be repurposed beyond provenance.
[4] Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European conference on computer vision, pages 338–354. Springer, 2024. 2, 3, 4
Bounding false attribution. A provenance tool is harmful if it can be used to implicate an innocent party, and our security analysis addresses this directly. Uniqueness shows that an independent owner’s key does not trip another owner’s verifier, so a clean, unrelated policy is not falsely claimed as the owner’s. Unforgeability shows that an adversary who knows the algorithm and the verifier code, but not the secret key, cannot fabricate a key that passes. A third party therefore cannot be framed by a planted mark. Verification also requires the owner’s secret key together with authorized access to the suspect, for example through legal or regulatory inspection. It cannot be run covertly against an arbitrary party.
[5] Physical Intelligence, Bo Ai, Ali Amin, Raichelle Aniceto, Ashwin Balakrishna, Greg Balke, Kevin Black, George Bokinsky, Shihao Cao, Thomas Charbonnier, Vedant Choudhary, Foster Collins, Ken Conley, Grace Connors, James Darpinian, Karan Dhabalia, Maitrayee Dhaka, Jared DiCarlo, Danny Driess, Michael Equi, Adnan Esmail, Yunhao Fang, Chelsea Finn, Catherine Glossop, Thomas Godden, Ivan Goryachev, Lachlan Groom, Haroun Habeeb, Hunter Hancock, Karol Hausman, Gashon Hussein, Victor Hwang, Brian Ichter, Connor Jacobsen, Szymon Jakubczak, Rowan Jen, Tim Jones, Gregg Kammerer, Ben Katz, Liyiming Ke, Mairbek Khadikov, Chandra Kuchi, Marinda Lamb, Devin LeBlanc, Brendon LeCount, Sergey Levine, Xinyu Li, Adrian Li-Bell, Vladislav Lialin, Zhonglin Liang, Wallace Lim, Yao Lu, Enyu Luo, Vishnu Mano, Nandan Marwaha, Aikys Mongush, Liam Murphy, Suraj Nair, Tyler Patterson, Karl Pertsch, Allen Z. Ren, Gavin Schelske, Charvi Sharma, Baifeng Shi, Lucy Xiaoyang Shi, Laura Smith, Jost Tobias Springenberg, Kyle Stachowicz, Will Stoeckle, Jiaming Tang, Jimmy Tanner, Shalom Tekeste, Marcel Torne, Kyle Vedder, Quan Vuong, Anna Walling, Haohuan Wang, Jason Wang, XuDong Wang, Chris Whalen, Samuel Whitmore, Blake Williams, Charles Xu, Sukwon Yoo, Lili Yu, Wuming Zhang, Zhuoyang Zhang, and Ury Zhilinsky. π0.7 : a steerable generalist robotic foundation model with emergent capabilities, 2026. URL: https:// arxiv.org/abs/2604.15483, arXiv:2604.15483. 1
Dual-use. Like any watermark, the technique could in principle be repurposed, for instance to tag a model for tracking. Two properties intrinsic to the design limit this risk. The mark is keyed and recoverable only by the holder of the secret key. Verification is an authorized, after-the-fact audit rather than a passive broadcast signal. The benefit is that owners of expensive, easily-copied robot policies gain a way to demonstrate provenance. We judge this to outweigh the residual risk, which the keyed, authorized-audit design already limits. We are also explicit that the guarantees are empirical operating points, not cryptographic ones. The method is therefore not a basis for over-reliance in adversarial or legal settings.
Generative AI Usage Considerations We did not use generative AI in this work, except for grammar checking and light rephrasing of text the authors had already written. It played no part in ideation, literature search or data analysis. The generative models named in the paper, the VLA policy and the LingBot world-action model, are the objects of our study, not authoring aids.
[6] Physical Intelligence, Ali Amin, Raichelle Aniceto, Ashwin Balakrishna, Kevin Black, Ken Conley, Grace Connors, James Darpinian, Karan Dhabalia, Jared DiCarlo, Danny Driess, Michael Equi, Adnan Esmail, Yunhao Fang, Chelsea Finn, Catherine Glossop, Thomas Godden, Ivan Goryachev, Lachy Groom, Hunter Hancock, Karol Hausman, Gashon Hussein, Brian Ichter, Szymon Jakubczak, Rowan Jen, Tim Jones, Ben Katz, Liyiming Ke, Chandra Kuchi, Marinda Lamb, Devin LeBlanc, Sergey Levine, Adrian Li-Bell, Yao Lu, Vishnu Mano, Mohith Mothukuri, Suraj Nair, Karl Pertsch, Allen Z. Ren, Charvi Sharma, Lucy Xiaoyang Shi, Laura Smith, Jost To-
References [1] Michael Amir, Manon Flageat, and Amanda Prorok. Remotely detectable robot policy watermarking. arXiv preprint arXiv:2512.15379, 2025. 2, 3 [2] Johan Bjorck, Fernando Castañeda, Nikita Cherniadev, Xingye Da, Runyu Ding, Linxi Fan, Yu Fang, Dieter Fox, Fengyuan Hu, Spencer Huang, et al. Gr00t n1: An open foundation model for generalist humanoid robots. arXiv preprint arXiv:2503.14734, 2025. 1, 3 14
bias Springenberg, Kyle Stachowicz, Will Stoeckle, Alex Swerdlow, James Tanner, Marcel Torne, Quan Vuong, Anna Walling, Haohuan Wang, Blake Williams, Sukwon Yoo, Lili Yu, Ury Zhilinsky, and Zhiyuan Zhou. π∗0.6 : a vla that learns from experience, 2025. URL: https://arxiv.org/abs/2511.14759, arXiv:2511.14759. 1, 3
[15] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12162–12171, 2024. 2, 3, 4 [16] Seonghyeon Ye, Yunhao Ge, Kaiyuan Zheng, Shenyuan Gao, Sihyun Yu, George Kurian, Suneel Indupuru, You Liang Tan, Chuning Zhu, Jiannan Xiang, et al. World action models are zero-shot policies. arXiv preprint arXiv:2602.15922, 2026. 1, 3
[7] Physical Intelligence, Kevin Black, Noah Brown, James Darpinian, Karan Dhabalia, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Manuel Y. Galliker, Dibya Ghosh, Lachy Groom, Karol Hausman, Brian Ichter, Szymon Jakubczak, Tim Jones, Liyiming Ke, Devin LeBlanc, Sergey Levine, Adrian Li-Bell, Mohith Mothukuri, Suraj Nair, Karl Pertsch, Allen Z. Ren, Lucy Xiaoyang Shi, Laura Smith, Jost Tobias Springenberg, Kyle Stachowicz, James Tanner, Quan Vuong, Homer Walke, Anna Walling, Haohuan Wang, Lili Yu, and Ury Zhilinsky. π0.5 : a vision-language-action model with openworld generalization, 2025. URL: https://arxiv. org/abs/2504.16054, arXiv:2504.16054. 1, 3
.1
Method Hyperparameters
All main experiments use latent injection strength β = 1.0. In Equation (1), any β ∈ [0, 1] preserves the marginal Gaussian law of the sampler noise, while larger β gives the verifier a stronger correlation with the keyed reference. We therefore use the largest value for the deployed latent fingerprint. The output-space baseline in Section 5.2 uses its own actionamplitude scale and is not part of this latent-β choice. The selector uses a per-episode cap of m = 5 selected chunks. The gap parameter P controls how densely those selected chunks can appear. We use P = 1 for the π0.5 cells, P = 6 for LingBot-VA/LIBERO-10, and P = 2 for LingBotVA/RoboTwin. The smaller LingBot-VA/RoboTwin value is used because these dual-arm episodes are shorter; a larger gap can leave some episodes with no selected chunk. If an episode ends before all m selected positions occur, the verifier scores the selected chunks that were actually generated. For MAP recovery, all cells use prior weight λz = 1.0. The observation scale σobs is fixed by model implementation rather than tuned per attack: σobs = 10−4 for π0.5 and σobs = 10−3 for LingBot-VA. This scale sets the optimizer’s relative weight on action fitting, while decoy-key calibration absorbs model- and task-level score-scale differences before aggregation.
[8] Yuheng Ji, Huajie Tan, Jiayu Shi, Xiaoshuai Hao, Yuan Zhang, Hengyuan Zhang, Pengwei Wang, Mengdi Zhao, Yao Mu, Pengju An, et al. Robobrain: A unified brain model for robotic manipulation from abstract to concrete. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1724–1734, 2025. 1, 3 [9] Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, et al. Openvla: An open-source vision-language-action model. arXiv preprint arXiv:2406.09246, 2024. 1, 3 [10] Lin Li, Qihang Zhang, Yiming Luo, Shuai Yang, Ruilin Wang, Fei Han, Mingrui Yu, Zelin Gao, Nan Xue, Xing Zhu, et al. Causal world modeling for robot control. arXiv preprint arXiv:2601.21998, 2026. 1, 3
.2
[11] SK Sengupta. Fundamentals of statistical signal processing: detection theory, 1998. 5
Distillation Stress-Test Details
For π0.5 /LIBERO-10, each distillation arm relabels the demonstration corpus with teacher-generated actions, keeping the observations fixed. We then train an attentiononly LoRA student for 1500 steps and roll it out without the owner’s keyed sampler. The deployed-fingerprint arm uses the zero-mean seed reference from the main method. The diagnostic arms replace it with a small lookup table of N=20, 80, 160 seed-bias vectors. At each chunk, we quantize the current robot state, hash it, and use the hash modulo N to select which bias vector to add to the starting noise. Detection uses the base-model MAP verifier with the true key and 32 decoys, and cross-student AUC compares the markedstudent scores to a clean-student null. For LingBot-VA, we repeat the biased seed-control sweep on LIBERO-10 with 10 tasks and 10 episodes per task. The students are again evaluated without injection and scored against a clean student with the same verifier structure.
[12] Ming Sun, Rui Wang, Xingrui Yu, Lihua Jing, Hangyu Du, Zhenglin Wan, Xu Pan, and Ivor Tsang. Towards backdoor-based ownership verification for vision-language-action models. arXiv preprint arXiv:2605.09005, 2026. 1, 3 [13] Gemini Robotics Team, Saminda Abeyruwan, Joshua Ainslie, Jean-Baptiste Alayrac, Montserrat Gonzalez Arenas, Travis Armstrong, Ashwin Balakrishna, Robert Baruch, Maria Bauza, Michiel Blokzijl, et al. Gemini robotics: Bringing ai into the physical world. arXiv preprint arXiv:2503.20020, 2025. 1, 3 [14] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030, 2023. 2, 3, 4, 5 15
.3
Adaptive-Removal Stress-Test Details
The adaptive-removal stress test instantiates Equation (13) with LoRA edits. We fix the recovery-loss weight and sweep the task-preservation weight, producing the cost–utility frontier in Figure 8. After fine-tuning, we evaluate each edited policy with the same decoy-key calibration and group aggregation used in the main experiments. For π0.5 /LIBERO-10, this stress test covers a non-adaptive anchor and four adversarial settings. Across the sweep, the fingerprint remains detectable at the standard group budget: TPR at |G|=16 stays at 0.99998 or higher. The strongest setting collapses task success for both watermarked and plain rollouts to zero, while detection remains at the ceiling. Thus, in the diffuse-score regime, the white-box optimizer does not find a usable removal direction; it can only damage the policy. For LingBot-VA/LIBERO-10, the non-adaptive anchor is already saturated under the same verifier. The reason to test LingBot-VA separately is mechanistic rather than procedural: its stronger single-rollout seed recovery gives an adaptive optimizer a cleaner target than π0.5 . At the strongest setting, task success collapses to zero and group identification falls to 0.103, which is a utility failure rather than a useful removal attack. The RoboTwin cells extend the same stress test to the dualarm setting. For π0.5 , neither detection nor identification moves to the lower-right region. For LingBot-VA, the noattack anchor has DIR 0.999 at 82% task success. The closest adaptive point lowers DIR to 0.570 while keeping 66% task success, so it is a real reduction in multi-key identification margin. It is not a detection removal point: group AUC remains 0.999, and the other adaptive settings either recover near-ceiling identification or collapse task success to zero. This cell is therefore a limitation for strict identification, not for binary ownership detection.
.4
TPR @ 1\% FPR
0.8
0.4
0.0
delay-1 delay-2 delay-3 EMA 0.5
1
2
4 8 16 query budget |G|
0.5/RT prune30 EMA 0.2 (SR kept) jitter 0.1 (SR kept)
32
64
Figure 10: Detection rate versus query budget for π0.5 cells that are not saturated at small budgets. Each line is TPR at 1% FPR as the group size |G| grows on a log scale; higher and further left is better. Delay uses the verifier’s global synchronization search. The delayed cells, default smoothing, and RoboTwin pruning recover with a larger budget. The strongest jitter setting remains near the floor, marking the boundary where output perturbations preserve task success but suppress detection.
Figure 11 shows that the same-task and cross-task curves nearly overlap there, so the aggregation gain is not an artifact of mixing tasks.
.7
Detailed Clean Identification Curves
Figure 12 expands the clean identification result into CMC curves and budget-dependent rank-1/open-set identification rates.
.8
Detailed Identification Robustness
Figure 13 reports the full closed-set CMC curves under output-side attacks.
Budget Sweeps for Weak Cells
Synchronization-Search Ablation
This ablation isolates the alignment step on the hardest delayed cell, π0.5 /LIBERO-10. Table 7 shows that, at |G|=16, one-step delay recovers from TPR 0.28 to 1.00 when the search is enabled. Longer delays remain weak under lag-zero scoring, but the global search realigns them: two-step delay is nearly saturated by |G|=16, and three-step delay reaches the ceiling by |G|=64.
.6
0.6
0.2
The main text summarizes the query-budget effect for cells that remain below ceiling at |G|=16. Figure 10 plots the budget sweep for these weak cells, and Table 6 gives the full robustness table behind the compact main-text summary.
.5
Budget recovers most weak cells
1.0
Same-Task vs. Cross-Task Aggregation
Proposition 1 assumes that grouped episodes are roughly independent, while the audit setting allows the verifier to collect rollouts on either the same task or different tasks. The meaningful comparison is on the LingBot-VA cells, where there are enough rollouts per task for a same-task bootstrap. 16
Table 6: Detection robustness across the 2×2 family design under adversary output-removal attacks and owner-side weight variants. Each cell gives per-episode AUC (AUC1 , |G|=1, fingerprinted vs. plain), then AUC and TPR at FPR= 1% for group budgets |G|=16 and |G|=64 (the vertical rule separates AUC from TPR within each budget). For clip/EMA/jitter, lo/⋆/hi denote the smallest, canonical, and largest swept strength; delay is per step. The verifier uses synchronization search for constant delay and otherwise estimates ℓ∗ =0. ‘–’ marks a condition absent for that family. † For π0.5 /RoboTwin the compression rows restrict the edit to the action expert (∼16% of parameters), since compressing the whole model discards the vision–language backbone. LingBot/LIBERO-10 |G|=16
LingBot/RoboTwin
|G|=64
|G|=16
π0.5 /RoboTwin†
π0.5 /LIBERO-10
|G|=64
|G|=16
|G|=64
|G|=16
|G|=64
Condition
AUC1 AUC TPR AUC TPR AUC1 AUC TPR AUC TPR AUC1 AUC TPR AUC TPR AUC1 AUC TPR AUC TPR
none (clean)
1.00
1.00 1.00 1.00 1.00
1.00
1.00 1.00 1.00 1.00
0.90
1.00 1.00 1.00 1.00
0.85
1.00 1.00 1.00 1.00
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 0.99
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
0.64 0.97 0.97 0.54 0.70 0.89 0.84 0.73 0.56 0.81 0.68 0.65
0.93 1.00 1.00 0.67 0.98 1.00 1.00 0.99 0.70 1.00 0.97 0.94
0.97 1.00 1.00 0.09 1.00 1.00 1.00 1.00 0.17 1.00 1.00 0.98
0.86 0.85 0.87 0.86 0.86 0.86 0.88 0.85 0.81 0.71 0.71 0.71
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 0.99 0.99 0.99
Owner-side weight variants LoRA finetune 1.00 1.00 1.00 1.00 1.00 prune30 1.00 1.00 1.00 1.00 1.00 int8 1.00 1.00 1.00 1.00 1.00
0.83 1.00 1.00
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
1.00 0.99 1.00
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
0.87 0.68 0.76
1.00 1.00 1.00 1.00 0.97 0.56 1.00 1.00 1.00 0.94 1.00 1.00
Output removal attacks clip lo 1.00 1.00 clip ⋆ 1.00 1.00 clip hi 1.00 1.00 EMA lo 1.00 1.00 EMA ⋆ 1.00 1.00 EMA hi 1.00 1.00 jitter lo 1.00 1.00 jitter ⋆ 1.00 1.00 jitter hi 1.00 1.00 delay 1 1.00 1.00 delay 2 1.00 1.00 delay 3 1.00 1.00
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
0.39 1.00 1.00 0.02 0.69 1.00 1.00 0.85 0.05 1.00 0.41 0.26
1.00 1.00 1.00 0.81 1.00 1.00 1.00 1.00 0.85 1.00 1.00 1.00
Clean Clip
delay 1 2 3
16
0.63 0.54 0.48
0.28 0.02 0.00
0.62 0.04 0.00
0.95 0.09 0.00
TPR @ |G| 32 64
AUC (|G|=1)
16
0.91 0.77 0.68
1.00 0.96 0.53
1.00 1.00 0.90
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
same-task cross-task
LingBot / RoboTwin
0.5 / LIBERO-10
0.5 / RoboTwin
TPR
1.00 0.75 0.50 0.25 0.00
global τ∗ search
TPR @ |G| 32 64
AUC (|G|=1)
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00
TPR
Table 7: Synchronization-search ablation on the delay attack, π0.5 /LIBERO-10. Rows are delay length; columns sweep the query budget |G|. Each entry is TPR at 1% FPR (AUC in the |G|=1 column), with the lag search off (lag-zero) and on (the estimated global τ∗ ). A constant delay is a pure time shift the global search marginalizes, so τ∗ recovers it; the residual at longer delay is graceful attenuation that aggregation closes. π0.5 /RoboTwin and every non-delay condition estimate τ∗ =0 and are unchanged by the search (omitted). lag-zero
LingBot / LIBERO-10
1.00 0.75 0.50 0.25 0.00
EMA Jitter
1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 1.00 0.84 0.84 0.83
1.00 1.00 1.00
1
2
4
8
|G|
16 32 64
1
2
4
8
|G|
16 32 64
Figure 11: Same-task vs. cross-task aggregation at FPR= 1%. Solid curves restrict each group to one task; dashed curves group rollouts across tasks. The π0.5 panels are shown for completeness but are not a meaningful same-task comparison: π0.5 /LIBERO-10 has one episode per task, and π0.5 /RoboTwin has a single evaluation task.
17
Closed-set CMC (|G| = 1)
0.6 0.4 0.2 5
10
15
20
rank r
25
LingBot/LIBERO-10
30
Rank-1 (solid) / open-set DIR@1% (dashed)
1.0
0.8
0.8
0.6
0.6
rate
0.8
0.0
Closed-set CMC (|G| = 16)
1.0
identification rate (CMC)
identification rate (CMC)
1.0
0.4 0.2 0.0
0.4 0.2
5
10
15
20
rank r
LingBot/RoboTwin
25
30
0.0
1
0.5/LIBERO-10
2
4
8
query budget |G|
16
32
0.5/RoboTwin
Figure 12: Clean-policy identification curves over the 33-key gallery. Left and middle: CMC curves at |G|=1 and |G|=16, where rank-r is the probability that k∗ is among the top r keys. Right: closed-set rank-1 and open-set DIR@1% FAR as the query budget grows.
18
LingBot LIBERO-10
clean (.96) s = 0.5 (.95) s = 1 (.96) s = 2 (.97)
1
LingBot RoboTwin
1.0 |G| = 32
0.5
LIBERO-10
33
clean (.53) s = 0.5 (.00) s = 1 (.70) s = 2 (.71)
0.0
1 1.0 |G| = 32
11
22
33
rank-1 = 1.00
0.5
clean (.96) s = 0.5 (.88) s = 1 (.94) s = 2 (.90)
0.0
1 1.0 |G| = 32 0.5
22
rank-1 = 1.00
0.5
11
22
33
rank-1 = 1.00
0.5 0.0
11
clean (.57) s = 0.5 (.00) s = 1 (.00) s = 2 (.17)
1
11
rank r
EMA
1.0 |G| = 32
rank-1 = 1.00
0.5 0.0
RoboTwin
Clip
1.0 |G| = 32
22
33
rank-1 = 1.00
0.5 0.0
clean (.96) = 0.3 (.80) = 0.5 (.88) = 0.7 (.94)
1
1.0 |G| = 32
11
22
clean (.53) = 0.3 (.74) = 0.5 (.74) = 0.7 (.75)
0.0
1 1.0 |G| = 32
11
22
0.5
33
clean (.96) = 0.3 (.92) = 0.5 (.96) = 0.7 (.98)
0.0
1 1.0 |G| = 32
11
22
33
rank-1 = 1.00
0.5 0.0
33
rank-1 = 1.00
0.5
clean (.57) = 0.3 (.50) = 0.5 (.57) = 0.7 (.44)
1
11
rank r
Jitter
1.0 |G| = 32
22
33
rank-1 = 1.00
0.5 0.0
clean (.96) = 0.005 (.96) = 0.01 (.95) = 0.02 (.96) = 0.05 (.94)
1
1.0 |G| = 32
11
22
clean (.53) = 0.005 (.70) = 0.01 (.64) = 0.02 (.36) = 0.05 (.25)
0.0
1 1.0 |G| = 32
11
22
0.5
33
clean (.96) = 0.005 (.94) = 0.01 (.96) = 0.02 (.98) = 0.05 (.96)
0.0
1 1.0 |G| = 32
11
22
33
rank-1 = 1.00
0.5 0.0
33
rank-1 = 1.00
0.5
clean (.57) = 0.005 (.52) = 0.01 (.44) = 0.02 (.39) = 0.05 (.37)
1
11
rank r
Delay
1.0 |G| = 32
22
33
rank-1 = 1.00
0.5
clean (.96) = 1 (.88) = 2 (.82) = 3 (.74)
0.0
1 1.0 |G| = 32
11
22
rank-1 = 1.00
0.5
clean (.53) = 1 (.73) = 2 (.79) = 3 (.73)
0.0
1 1.0 |G| = 32
11
22
0.5
33
clean (.96) = 1 (.95) = 2 (.96) = 3 (.97)
0.0
1 1.0 |G| = 32
11
22
0.5 0.0
33
33
clean (.57) = 1 (.70) = 2 (.70) = 3 (.73)
1
11
rank r
22
33
Figure 13: Closed-set identification robustness: cumulative match characteristic (CMC) over the 33-key gallery under output-side attacks at group budget |G|=32. Rows are model–suite cells; columns are attack families; black is the clean policy and purple→orange means weaker→stronger attack. Each curve is P(rank of k∗ ≤ r) vs. rank r; the dot at rank 1 is rank-1 identification.
19