Publication Type

Conference Proceeding Article

Version

acceptedVersion

Publication Date

10-2026

Abstract

Third-party retrieval-augmented generation (RAG) marketplaces create a new auditing problem: data providers may license corpora to a RAG operator, yet later have no visibility into whether their documents are being reused without compensation. Auditing this misuse is difficult because the operator is non-cooperative, answers are paraphrased by the generator, and one response may combine evidence from many providers. We propose DirBucket, a provider-side semantic watermarking and black-box auditing framework for document-level reuse in multi-provider RAG. DirBucket watermarks documents by meaningpreserving paraphrases whose embeddings are biased toward provider-bucket secret directions, enabling detection from black-box answers while preserving retrieval utility. On a challenging benchmark that reflects mixed-provider reuse under black-box access, DirBucket is the only method that consistently achieves strong target detection with no non-target activation, detecting non-compliance in every audit within 23 audited answers on our primary benchmark. The watermark survives adversarial postanswer laundering, and none of the evaluated evasion strategies simultaneously defeats detection while preserving user-perceived answer quality. Detection transfers unchanged to a second benchmark built from real clinical, cyberthreat-intelligence, and legal provider corpora. These results suggest that embedding-space watermarking can make document reuse in thirdparty RAG statistically auditable.

Discipline

Artificial Intelligence and Robotics | Information Security

Research Areas

Intelligent Systems and Optimization

Areas of Excellence

Digital transformation

Publication

Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, EMNLP 2026, Budapest, Hungary, October 24-29, 2026

First Page

1

Last Page

28

Publisher

ACL

City or Country

Budapest, Hungary

Download

Share

COinS