Original title: Rent-a-RAG: Embedding-Space Watermarks for Auditing Third-Party RAG
Alexandr Goultiaev Tolstokorov, Kyriakos Mouratidis, Javad Dogani, Nikolaos Laoutaris · September 2026
Companies often license their written data to AI search services. These services fetch documents to answer user questions, a setup called retrieval-augmented generation. The problem is that data owners cannot tell if these services quietly keep using their documents without paying. This is hard to catch because the AI rewrites the source text and blends many sources together. To fix this, researchers created DirBucket. It rewrites licensed documents into meaning-preserving paraphrases. These paraphrases slightly push the text's mathematical representation toward secret directions picked by the owner. When the AI generates an answer, that secret pattern still shows up. The team found that DirBucket detected unauthorized reuse in every audit within 23 audited answers, without wrongly blaming other data providers. It also survived attacks meant to erase the hidden pattern.
Imagine you have a unique recipe that you lend to a restaurant. The restaurant might share it with other places by rewriting the instructions or mixing it into other dishes. Difficulty: you have no way to prove that your specific recipe was used if it's altered slightly or blended with other recipes. In this paper, DirBucket adds a subtle, hidden mark to each recipe that doesn't change how it cooks but leaves a detectable trace. Even when the recipe is paraphrased or combined with others, the trace remains in how the AI processes it, allowing you to audit if your recipe was used without permission.
Data providers who license content to AI services can now detect if their documents are being used without permission, protecting their revenue and ensuring fair compensation.
The abstract does not specify limitations, but the framework is evaluated on benchmarks, so its performance in all real-world scenarios is not fully established. It focuses on black-box access and may not address all possible evasion strategies or system configurations.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Rent-a-RAG: Embedding-Space Watermarks for Auditing Third-Party RAG — Alexandr Goultiaev Tolstokorov, Kyriakos Mouratidis, Javad Dogani et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.