RedAct: Redacting Agent Capability Traces for Procedural Skill Protection

A new framework called RedAct can strip sensitive procedural know-how from AI agent execution traces without destroying the evidence needed for audits, according to research posted on arXiv. The system rewrites traces to hide private skills while embedding watermarks that allow provenance checks with high accuracy. The work, authored by Shuwen Xu, Zhitao He, and Yi R. Fung, addresses a tension that has grown as organizations deploy autonomous agents: the same execution logs used for debugging and accountability also leak the proprietary strategies that make those agents valuable [1][3]. Execution traces contain tool invocations, intermediate decisions, and error-recovery logic, and prior research has shown that downstream methods can recover key formulas, thresholds, and strategies from this detail without access to model weights or skill files [2]. To measure the risk, the researchers built CapTraceBench, a benchmark comprising 75 specialized long-horizon tasks and 154 curated skills across seven domains [1][2]. On raw traces, representative trace-reuse methods achieved a normalized skill transfer (NST) of 44.7 to 67.1 percent [1]. RedAct, the protection framework introduced in the paper, localizes protected key information and rewrites traces while preserving verifier-critical evidence [1]. Under RedAct, NST fell below the no-skill baseline, effectively closing the leakage channel [1]. The framework also embeds behavioral watermarks into the redacted traces for downstream provenance analysis [1]. In standalone tests, these watermarks reached a true detection rate between 93.6 and 100.0 percent, with a false alarm rate of at most 1.9 percent [1][2]. The authors frame public agent traces as security interfaces and argue that selective redaction can reduce procedural capability leakage without removing audit evidence [1][2]. The paper lands amid broader efforts to extract and protect procedural skills from agent execution data. A separate line of work, Trace2Skill, demonstrated that agent experience can be packaged into highly transferable, declarative skills requiring no parameter updates and using open-source models as small as 35 billion parameters [6]. That framework dispatches a parallel fleet of sub-agents to analyze diverse execution pools and hierarchically consolidate trajectory-specific lessons into unified skill directories [6]. RedAct operates in the opposite direction, aiming to prevent exactly this kind of skill extraction from public traces. Code for RedAct is available on GitHub [2]. The paper was submitted to arXiv's Cryptography and Security section on June 9, 2026 [1].