RouterMAS:watermarking a multi-agent router inside the freedom its task values leave open把水印写进多智能体路由器中任务价值没有锁定的自由度
Fixing what a system must achieve does not fix how it delegates. Bellman recursion turns prefix-wise preservation of task utility and agent-call cost into local conservation equations; a secret key moves routing probability only inside the space they leave open, and the same marked law yields a sequential likelihood-ratio verifier. No agent is retrained. No route is forced.锁定系统必须达成的价值，并不等于锁定它如何委派任务。Bellman 递推把"每个执行前缀上的任务效用与调用成本都保持不变"化为局部守恒方程；密钥只在这些方程留出的空间里移动路由概率，而同一个带水印的路由法则直接给出序贯似然比验证器。不重训任何 agent，不强制任何路径。
A task reaches the router, which splits work across four delegates. The key moves probability between them (p → qK) while expected utility and cost stay fixed, and every sampled delegation adds log qK/p to the evidence. The probabilities shown are the four-action example from the paper: utility 0.70 and cost 1.50 before and after.任务到达路由器，路由器把工作分给四个 agent。密钥只在它们之间挪动概率（p → qK），期望效用与成本保持不变；每一次被采样的委派都向证据累加 log qK/p。图中概率取自论文的四动作构造示例：效用前后均为 0.70，成本均为 1.50。
The problem问题
Carrier-first marks pay for it downstream先选载体的水印，代价落在后续执行上
Two systems built from the same models can embody different orchestration policies, so the router is an asset worth attributing. But a delegation is also a functional decision: it changes the history on which every later choice, retry and cost depends. Transferring existing carriers to a multi-agent router assumes a secret preference can be fixed before asking whether the task values permit it:同一组模型可以组成编排策略完全不同的系统，因此路由器本身就是值得溯源的资产。但一次委派同时也是功能性决策：它改变了之后所有选择、重试与成本所依赖的历史。把现有水印载体直接搬到多智能体路由器上，隐含的假设是：可以先固定一个秘密偏好，再去问任务价值是否允许它：
① Red/green delegation bias红/绿委派偏置
Blind to the future看不到未来
Tilting delegations toward a keyed set ignores what each delegation enables later, so continuation utility and cost drift.把委派往密钥集合倾斜，却不看每次委派之后会引出什么，后续效用与成本随之漂移。
② Behavioral marks行为水印
Averages hide prefixes平均值掩盖前缀
Preserving aggregate utility lets gains on easy prefixes pay for losses on hard ones; prefix-wise continuation values are not part of the contract.只保持总体效用，简单前缀上的收益可以抵消困难前缀上的损失；逐前缀的后续价值不在约束之内。
③ Forced secret paths强制秘密路径
Identifiable for the wrong reason可识别，但原因不对
A fixed route through agents or experts is detectable precisely because it sends work where the original system would not.穿过 agent 或专家的固定路线之所以能被检测，恰恰是因为它把工作派到了原系统不会去的地方。
— RouterMAS
Constraints first, then the key先求约束，再放密钥
Derive the admissible routing changes from continuation values, encode the key only there, and return the original router when none remain.先由后续价值推出可行的路由变化，只在其中编码密钥；没有可用方向时原样返回路由器。
Core question. Which multi-agent routing variations preserve the continuation values a deployment must keep, and how can they carry a verifiable signature with controlled intervention and estimation cost?核心问题：哪些多智能体路由变化能保持部署必须守住的后续价值？它们又如何在可控的干预与估计代价下携带可验证的签名？
RouterMAS and prior carriers. Behavioral marks act on an agent's actions and path marks on triggered expert routes; RouterMAS acts on the system-level routing policy, moving p to qK inside the continuation-value-preserving region, and delegation traces accumulate likelihood-ratio evidence LT.RouterMAS 与已有载体。行为水印作用于 agent 的动作，路径水印作用于触发的专家路线；RouterMAS 作用于系统级路由策略，在保持后续价值的区域内把 p 移到 qK，委派轨迹累积似然比证据 LT。
Method方法
Find the freedom, move minimally, verify with the same law找到自由度，最小改动，用同一法则验证
Constituent agents, tools and the executor stay frozen. At each history h the router has a legal delegation set and a reference law ph; for each protected return j (task success, remaining agent-call cost) Qjp(h,a) is the expected return after delegating to a and then following p. The contract is Vjq(h) = Vjp(h) at every admissible prefix.各 agent、工具与执行器全部冻结。在每个历史 h，路由器有合法委派集合与参考法则 ph；对每个受保护回报 j（任务成功、剩余调用成本），Qjp(h,a) 表示先委派给 a、此后沿用 p 的期望回报。约束是：在每个可行前缀上 Vjq(h) = Vjp(h)。
1
Continuation conservation后续价值守恒
Audit every legal delegation by complete counterfactual continuations under the unchanged reference router. Prefix-wise preservation holds iff (qh−ph)⊤Qjp(h)=0 at every history, leaving a local family of dimension |𝒜h| − rank Bh.在参考路由器不变的前提下，用完整的反事实后续执行审计每个合法委派。逐前缀保持成立当且仅当每个历史上 (qh−ph)⊤Qjp(h)=0，剩下维数为 |𝒜h| − rank Bh 的局部可行族。
where the freedom is自由度在哪里
2
Least-change keyed encoding最小改动的密钥编码
Inside that family, pick the law with the smallest relative entropy to p for its key-score gain: an information projection whose solution is an exponential tilt. Estimation and solver errors are charged to a local budget and shrink the update toward p.在可行族内，选出达到同样密钥得分增益、且与 p 相对熵最小的法则：这是信息投影，解为指数倾斜。估计误差与求解误差计入局部预算，把更新向 p 收缩。
how far to move挪动多少
3
Sequential verification序贯验证
A verifier rebuilds p and qK from frozen snapshots and sums log qK(a)/p(a) over observed delegations. Under the reference null this is a nonnegative martingale, so Ville's inequality caps the false-positive rate at α for any stopping time.验证者从冻结快照重建 p 与 qK，对观测到的委派累加 log qK(a)/p(a)。在参考零假设下这是非负鞅，由 Ville 不等式，任意停时下误报率都不超过 α。
how to prove it如何证明
Vjq(h) = Vjp(h) ∀h ⇔ (qh − ph)⊤Qjp(h) = 0 ∀h
Proposition 1 (prefix-wise conservation): backward induction gives sufficiency; equal successor values give necessity.命题 1（逐前缀守恒）：反向归纳给出充分性，后继价值相等给出必要性。
sK⊤g = g⊤D−1g = ‖P D1/2 sK‖2
Corollary 1: the same projected component sets the keyed gain (≈ η−1sK⊤g) and the expected log evidence (≈ ½η−2sK⊤g). Zero projection makes both inert.推论 1：同一个投影分量同时决定密钥增益（≈ η−1sK⊤g）与期望对数证据（≈ ½η−2sK⊤g）。投影为零时两者都失效。
Routing lab路由实验台The encoder and verifier, live. Every number below is solved in your browser from the exponential-tilt dual and a Monte Carlo verifier.编码器与验证器的实时演示。下方所有数字都由浏览器现场求解指数倾斜对偶问题、再用蒙特卡洛验证器算出。
Legal delegations合法委派数
Protected受保护
Constrain约束对象
η
Routing law at one history某一历史上的路由法则
reference p参考 pmarked qK带水印 qKkey score sK密钥得分 sK
feasible dimension可行维数
–
ΔVU(continuation)（后续）
–
ΔVC(continuation)（后续）
–
KL(qK‖p)
–
key gain密钥增益 sK⊤(q−p)
–
Verifier: log evidence over delegations验证器：对数证据随委派累积
16 traces sampled from qK and 16 from p at this history; detection rates use 400 traces of each.在该历史上从 qK 与 p 各采样 16 条轨迹；检测率各用 400 条轨迹计算。
marked traces带水印轨迹reference traces参考轨迹
detected (marked)检出（带水印）
–
false alarm (reference)误报（参考）
–
median decisions中位决策数
–
A toy router with fixed delegate values: Q = immediate reward + continuation. With “immediate reward” selected the encoder conserves only the first step, and the continuation drift readouts show what it misses. Three delegations with two protected returns leave no freedom, so the router is returned unchanged. The verifier repeats one history for clarity (budget 300 delegations, α = 0.01); the finite-state results below use a four-step system with exact dynamics.这是一个委派价值固定的玩具路由器：Q = 即时奖励 + 后续部分。选择“即时奖励”时，编码器只守恒第一步，后续漂移读数显示它遗漏了什么。三个委派加两个受保护回报时没有自由度，路由器原样返回。为便于观察，验证器重复同一个历史（预算 300 次委派，α = 0.01）；下方有限状态结果使用精确动力学的四步系统。
Routing moves, values do not, evidence accumulates路由在变，价值不变，证据在累积
A multi-agent routing system with known transitions: four delegation steps, five states per step, six legal delegations, two protected returns, exact backward dynamic programming and η = 1.5. Known dynamics isolate the mechanism from estimation error.一个转移已知的多智能体路由系统：四步委派、每步五个状态、六个合法委派、两个受保护回报，用精确反向动态规划求值，η = 1.5。已知动力学把机制本身与估计误差分开。
(a) Worst prefix value drift by routing law (log scale), lower is better(a) 各路由法则的最坏前缀价值漂移（对数轴），越低越好(b) Sequential detection vs. audited decisions (10,000 trace groups per law)(b) 序贯检测率随审计决策数变化（每种法则 10,000 组轨迹）(c) Measured ÷ predicted keyed gain and evidence vs. η, 20 prefixes(c) 密钥增益与证据的实测/预测比随 η 变化，20 个前缀
All values come from re-executing the finite-state checks (seed 20260923; replay seed 20260925). Hover any mark for the exact number; the full tables are in the case studies.所有数值都来自重新执行的有限状态检查（种子 20260923；重放种子 20260925）。悬停任意数据点可查看精确数值；完整表格见案例研究。
Worked examples · from the case-study volume完整示例 · 取自案例研究卷宗
One history with freedom, one without一个有自由度的历史，一个没有
Six delegations at one history of the finite-state system, every probability and continuation value shown. The checks are computed, not asserted: the marked law conserves both protected values, while a law that matches only immediate rewards does not.有限状态系统中某一历史上的六个委派，所有概率与后续价值全部列出。检查结果是计算出来的而非断言：带水印法则守住了两个受保护价值，只匹配即时奖励的法则则没有。
All twenty histories, the seven routing laws and the sequential-detection statistics live in the full case-study volume.全部二十个历史、七种路由法则与序贯检测统计见完整案例研究卷宗。
Evidence证据
See the carrier form, see the signature accumulate看载体如何形成，看签名如何累积
Continuation-aware routing structure: more legal delegations expose freedom, more protected returns remove directions, and only continuation constraints keep future values.考虑后续的路由结构：合法委派越多自由度越大，受保护回报越多方向越少，只有后续价值约束能守住未来价值。Value-preserving routing at one history: p and qK mix the delegates differently with equal continuation utility and cost; histories without a usable direction keep the reference router.单一历史上的价值守恒路由：p 与 qK 对各 agent 的混合比例不同，后续效用与成本相同；没有可用方向的历史保持参考路由器。
@misc{routermas2026,
title = {RouterMAS: Value-Preserving Watermarking for Multi-Agent Routing},
author = {{Google} and {xAI} and {Cornell University} and {Columbia University}},
howpublished = {\url{https://crcr0.github.io/RouterMAS/}},
year = {2026}
}
