RedAct: Redacting Agent Capability Traces for Procedural Skill Protection
On the map: LLM safety and security → Prompt injection and agent security
Abstract (arXiv)
Users rely on execution traces to observe agent behavior, diagnose failures, and ensure accountability. These traces contain rich procedural detail, including tool invocations, intermediate decisions, and error-recovery logic. Yet this detail can expose private procedural skills, allowing downstream methods to recover key formulas, thresholds, and strategies without access to model weights or skill files. To quantify this risk and evaluate protection, we construct CapTraceBench, a benchmark of 75 specialized long-horizon tasks and 154 curated skills across seven domains. We also introduce RedAct, a protected trace release framework that localizes protected key information, rewrites traces while preserving verifier-critical evidence, and embeds behavioral watermarks for downstream provenance analysis. Across representative trace reuse methods, RedAct reduces normalized skill transfer (NST) from 44.7-67.1% on raw traces to below the no-skill baseline, while preserving audit evidence. Its standalone behavioral watermarks reach 93.6-100.0% true detection with a false alarm rate of at most 1.9%. These results frame public agent traces as security interfaces and show that selective redaction can reduce procedural capability leakage without removing audit evidence.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 32 of its 48 references that are in the map. First posted on arXiv 9 Jun 2026.
Builds on
32 of 48 references.
References · 32
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
- 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
- 2024LlamaFactory: Unified Efficient Fine-Tuning of 100+ Language Modelscited by 1,442
- 2023A Watermark for Large Language Modelscited by 667
- 2016Stealing Machine Learning Models via Prediction APIscited by 602
- 2024AppWorld: A Controllable World of Apps and People for Benchmarking Interactive Coding Agentscited by 359
- 2026SkillsBench: Benchmarking How Well Agent Skills Work Across Diverse Taskscited by 289
- 2023Provable Robust Watermarking for AI-Generated Textcited by 259
- 2026Trace2Skill: Distill Trajectory-Local Lessons into Transferable Agent Skillscited by 161
- 2026AutoSkill: Experience-Driven Lifelong Learning via Skill Self-Evolutioncited by 105
20 more
- 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermarkcited by 78
- 2026XSkill: Continual Learning from Experience and Skills in Multimodal Agentscited by 71
- 2026SkillX: Automatically Constructing Skill Knowledge Bases for Agentscited by 69
- 2024Watermarking Makes Language Models Radioactivecited by 52
- 2025Distilling LLM Agent into Small Models with Retrieval and Code Toolscited by 41
- 2021Undistillable: Making A Nasty Teacher That CANNOT teach studentscited by 36
- 2022Distillation-Resistant Watermarking for Model Protection in NLPcited by 29
- 2026SkillCraft: Can LLM Agents Learn to Use Tools Skillfully?cited by 28
- 2025Leaky Thoughts: Large Reasoning Models Are Not Private Thinkerscited by 25
- 2025Antidistillation Samplingcited by 24
- 2025Skip-Thinking: Chunk-wise Chain-of-Thought Distillation Enable Smaller Language Models to Reason Better and Fastercited by 15
- 2024A Watermark for Black-Box Language Modelscited by 14
- 2025Information-Preserving Reformulation of Reasoning Traces for Antidistillationcited by 8
- 2026On Protecting Agentic Systems' Intellectual Property via Watermarkingcited by 7
- 2026Protecting Language Models Against Unauthorized Distillation through Trace Rewritingcited by 6
- 2026Retrieval-Augmented LLM Agents: Learning to Learn from Experiencecited by 6
- 2026GraphWalker: Agentic Knowledge Graph Question Answering via Synthetic Trajectory Curriculumcited by 6
- 2026Black-Box Skill Stealing Attack from Proprietary LLM Agents: An Empirical Studycited by 6
- 2025A Reinforcement Learning Framework for Robust and Secure LLM Watermarkingcited by 4
- 2026Sequential Behavioral Watermarking for LLM Agentscited by 3
Built on by
Citing papers per year: 2026: 2.
2 papers.