Sequential Behavioral Watermarking for LLM Agents

• URL: http://arxiv.org/abs/2605.11036v1
• Date: Mon, 11 May 2026 02:28:34 GMT
• Title: Sequential Behavioral Watermarking for LLM Agents
• Abstract summary: LLM-based agents act through sequences of executable decisions, but their trajectories provide little evidence of which agent or policy produced them.<n>This motivates watermarking signals embedded directly into agent behavior rather than only into generated text.<n>We propose SeqWM, a sequential behavioral watermarking framework that embeds signals into history-conditioned transition patterns.
• Score: 6.193603972930103
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: LLM-based agents act through sequences of executable decisions, but their trajectories provide little evidence of which agent or policy produced them, making provenance, ownership, and unauthorized reuse difficult to establish from observed behavior alone. This motivates watermarking signals embedded directly into agent behavior rather than only into generated text, since text watermarking cannot capture the action-level decisions that define agent execution. Recent agent watermarking methods address this gap by moving the watermark from generated text to behavioral choices. However, by treating each action step as an independent trial, they overlook trajectory structure and become fragile when trajectories are perturbed, truncated, or observed without reliable alignment. We propose SeqWM, a sequential behavioral watermarking framework that embeds signals into history-conditioned transition patterns and verifies trajectories position-agnostically against random-key baselines. Experiments across diverse agent benchmarks and LLM backbones show that SeqWM consistently achieves reliable detection while preserving agent utility, and remains robust under trajectory corruption where round-indexed behavioral watermarks collapse.

Related papers

• From Sequence to Structure: Relational Uncertainty Propagation for LLM Agents [75.69180947909148]
  We propose a trajectory-level UQ framework for large language model (LLM) agents.<n>RuPA represents an execution history as a directed trajectory graph in which reasoning states, tool interactions, and environment feedback are nodes connected by temporal and semantic dependency edges.<n>We evaluate RUPA on representative agent benchmarks, including $$-2, Terminal-Bench-2, and GAIA, using 6 open-source LLMs spanning multiple model families.
  arXiv  Detail & Related papers  (2026-08-17T01:40:14Z)
• Tracing Provenance and Detecting Tampering with Complementary LLM Watermarks [68.64050157343334]
  Existing watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution.<n>We introduce an innovative watermark that jointly provides provenance and tamper evidence.<n>The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader-visible changes.
  arXiv  Detail & Related papers  (2026-08-13T01:55:16Z)
• ScrambleToolBench: Agents Search Exhaustively Even When Their Own Map Points to the Next Step [74.83535434786145]
  We introduce ScrambleToolBench, an interactive terminal benchmark designed to isolate behavioral reasoning.<n>The benchmark requires agents to uncover hidden tool behaviors entirely through trial-and-error interaction.<n>Our evaluation of state-of-the-art language models reveals that successful initial discovery does not translate into robust adaptation.
  arXiv  Detail & Related papers  (2026-08-03T15:07:46Z)
• A Survey on LLM Watermarking: Theory and Deployment [10.767016439964827]
  Large language models (LLMs) are increasingly embedded in high-impact fluent text at scale.<n>LLMs watermarking embedding invisible signatures into model outputs is a promising technical layer for attribution, auditing, and downstream trust decisions.<n>This survey provides a systematic, deployment-oriented review of LLM watermarking.
  arXiv  Detail & Related papers  (2026-07-11T03:42:17Z)
• TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories [26.736610129232698]
  TRACE is the first agent watermark that is distortion-free in its action choices.<n>It superposes a selection channel that sets which action is chosen, keyed on local content with a distortion-free sampler.<n>On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate.
  arXiv  Detail & Related papers  (2026-07-09T12:25:22Z)
• Beyond Input Guardrails: Reconstructing Cross-Agent Semantic Flows for Execution-Aware Attack Detection [32.301679396929536]
  We propose SysName, a framework that shifts the defensive paradigm from static input filtering to execution-aware analysis.<n>SysName synthesizes fragmented operational primitives into contiguous behavioral trajectories, enabling a holistic view of system activity.<n> Empirical evaluations demonstrate that SysName effectively detects over ten distinct compound attack vectors, achieving F1-scores of 85.3% and 66.7% for node-level and path-level end-to-end attack detection, respectively.
  arXiv  Detail & Related papers  (2026-03-04T01:59:16Z)
• On Protecting Agentic Systems' Intellectual Property via Watermarking [17.334130453604313]
  AGENTWM is the first watermarking framework designed specifically for agentic models.<n>AGENTWM exploits the semantic equivalence of action sequences, injecting watermarks by subtly biasing the distribution of functionally identical tool execution paths.<n>Our results confirm that AGENTWM effectively protects agentic IP against adaptive adversaries.
  arXiv  Detail & Related papers  (2026-02-09T09:02:15Z)
• Gaming the Judge: Unfaithful Chain-of-Thought Can Undermine Agent Evaluation [76.5533899503582]
  Large language models (LLMs) are increasingly used as judges to evaluate agent performance.<n>We show this paradigm implicitly assumes that the agent's chain-of-thought (CoT) reasoning faithfully reflects both its internal reasoning and the underlying environment state.<n>We demonstrate that manipulated reasoning alone can inflate false positive rates of state-of-the-art VLM judges by up to 90% across 800 trajectories spanning diverse web tasks.
  arXiv  Detail & Related papers  (2026-01-21T06:07:43Z)
• AgentMark: Utility-Preserving Behavioral Watermarking for Agents [20.30614808186259]
  AgentMark is a framework that embeds multi-bit identifiers into planning decisions while preserving utility.<n>It operates by eliciting an explicit behavior distribution from the agent and applying distribution-preserving conditional sampling.<n> Experiments across embodied, tool-use, and social environments demonstrate practical multi-bit capacity, robust recovery from partial logs, and utility preservation.
  arXiv  Detail & Related papers  (2026-01-05T15:42:18Z)
• SWAP: Towards Copyright Auditing of Soft Prompts via Sequential Watermarking [58.475471437150674]
  We propose sequential watermarking for soft prompts (SWAP)<n>SWAP encodes watermarks through a specific order of defender-specified out-of-distribution classes.<n>Experiments on 11 datasets demonstrate SWAP's effectiveness, harmlessness, and robustness against potential adaptive attacks.
  arXiv  Detail & Related papers  (2025-11-05T13:48:48Z)
• Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoption [94.887133335656]
  We revisit three classes of watermarking through this lens.<n>emphLLM text watermarking offers modest provider benefit when framed solely as an anti-misuse tool.<n>emphIn-context watermarking (ICW) is tailored for trusted parties, such as conference organizers or educators.
  arXiv  Detail & Related papers  (2025-10-21T06:34:51Z)
• Agent Guide: A Simple Agent Behavioral Watermarking Framework [8.635811152610604]
  Agent Guide is a behavioral watermarking framework that embeds watermarks by guiding the agent's high-level decisions (behavior) through probability biases.<n>We employ a z-statistic-based statistical analysis to detect the watermark, ensuring reliable extraction over multiple rounds.<n>Our framework provides a practical and robust solution for agent watermarking, with applications in identifying malicious agents and protecting proprietary agent systems.
  arXiv  Detail & Related papers  (2025-04-08T09:54:49Z)
• Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning [58.57194301645823]
  Large language models (LLMs) are increasingly integrated into real-world personalized applications.<n>The valuable and often proprietary nature of the knowledge bases used in RAG introduces the risk of unauthorized usage by adversaries.<n>Existing methods that can be generalized as watermarking techniques to protect these knowledge bases typically involve poisoning or backdoor attacks.<n>We propose name for harmless' copyright protection of knowledge bases.
  arXiv  Detail & Related papers  (2025-02-10T09:15:56Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.