Rent-a-RAG: Embedding-Space Watermarks for Auditing Third-Party RAG

2026-09-03

AI Summary

为解决第三方RAG市场中未经授权使用文档的问题，提出DirBucket方法，通过语义水印和黑盒审计框架检测文档重用情况。

Abstract

Third-party retrieval-augmented generation (RAG) marketplaces create a new auditing problem: data providers may license corpora to a RAG operator, yet later have no visibility into whether their documents are being reused without compensation. Auditing this misuse is difficult because the operator is non-cooperative, answers are paraphrased by the generator, and one response may combine evidence from many providers. We propose DirBucket, a provider-side semantic watermarking and black-box auditing framework for document-level reuse in multi-provider RAG. DirBucket watermarks documents by meaning-preserving paraphrases whose embeddings are biased toward provider-bucket secret directions, enabling detection from black-box answers while preserving retrieval utility. On a challenging benchmark that reflects mixed-provider reuse under black-box access, DirBucket is the only method that consistently achieves strong target detection with no non-target activation, detecting non-compliance in every audit within 23 audited answers on our primary benchmark. The watermark survives adversarial post-answer laundering, and none of the evaluated evasion strategies simultaneously defeats detection while preserving user-perceived answer quality. Detection transfers unchanged to a second benchmark built from real clinical, cyber-threat-intelligence, and legal provider corpora. These results suggest that embedding-space watermarking can make document reuse in third-party RAG statistically auditable.

Problem

• Third-party RAG
• document reuse
• auditing
• non-cooperative operator
• paraphrased answers

Innovation

• Embedding-Space Watermarks
• Semantic Watermarking
• Black-Box Auditing
• DirBucket
• Third-Party RAG