SemantiTrace: Stealthy Copyright Tracing in Black-Box Multimodal RAG via Semantic Parasitism

Commercial Multimodal Retrieval-Augmented Generation (RAG) platforms ingest web-scale corpora behind proprietary APIs, making visual copyright protection reliant on verifiable black-box provenance tracing. Prior defenses bridge the cross-modal gap with synthetic visual canaries featuring bizarre compositions or arbitrary acronyms. These globally anomalous patterns contradict natural data distributions, leaving them vulnerable to pre-ingestion out-of-distribution sanitization. To resolve this trade-off between stealth and auditable decodability, we introduce SemantiTrace, which replaces de novo canary synthesis with semantic parasitism. SemantiTrace embeds contextually coherent, micro-scale forensic signatures in benign hosts by mutating existing typography or synthesizing geometrically natural, branded scene elements. To survive black-box retrieval and trigger explicit textual generation, Cross-modal Dual-Guided Latent Diffusion couples visual retrieval pull with teacher-forced textual decoding on the latent flow. Off-canvas pixel drift is eliminated by a support-preserving output projection; Dual-Space Soft Latent Blending and spatially gated gradients remove hard mask-edge discontinuities and control boundary energy within physically plausible supports. SemantiTrace passes pre-ingestion anomaly filters with 1.8% rejection on DENSE-10K and MMQA, and 2.2% on WebQA. On WebQA, our parasite canaries achieve 81.70% query success after global filtering; after corpus-wide adversarial repair and index reconstruction on a 400,000-item gallery, they retain 68.80% query success and $287/500$ All-$K$ anchors, with a $0.90$-point loss in benign QA utility. Under zero-clean-baseline audits with private multi-candidate assignment and hidden OCR serving, the selected $K=1$ design requires 11 black-box queries for at least 95% fixed-population detection coverage under complete ingestion, with an exact private-assignment test at $p<.01$ and simultaneous 99% empirical false-alarm upper bounds below 1% for its evaluated budgets.