Sequential Behavioral Watermarking for LLM Agents

Authors: Hyeseon An, Shinwoo Park, Dongsu Kim et al.

arXiv · PDF

Summary

The authors tackle watermarking for LLM-based agents that make sequences of tool calls and decisions, not just generate text. Existing behavioral watermarks treat each action independently, so they break when the agent's trajectory gets shuffled, truncated, or corrupted. SeqWM instead embeds the watermark signal into history-conditioned transition patterns—the order and dependencies between actions—and verifies trajectories without requiring exact position alignment, making it robust to real-world perturbations while preserving the agent's task performance.

Main takeaways:

• Text watermarks don't capture action-level decisions, so agent provenance needs behavioral watermarks embedded in the sequence of tool calls and choices the agent makes.
• Earlier agent watermarking methods treat each action step as independent, so they fail when trajectories are corrupted, truncated, or reordered.
• SeqWM embeds signals into patterns across multiple steps (conditioned on history) and can verify a trajectory even when you can't align it step-by-step with the original.
• Experiments across multiple agent benchmarks and LLM backbones show reliable detection with no loss in task performance, and the watermark survives corruptions that break round-indexed methods.

Relevance

Not directly related to my persona/midtraining work—this is about proving ownership of agent trajectories rather than installing or characterizing behaviors. Might be tangentially useful if I ever need to track which fine-tuning or steering intervention produced a particular downstream behavior trail.

Threat model

Potential threat/caveat for clean result "Fine-tuning one persona on a two-marker chunk and another on the start marker plants the end marker at every donor answer's end, not chained to the start (LOW confidence)": this item discusses benchmark.

Abstract

arXiv:2605.11036v1 Announce Type: new Abstract: LLM-based agents act through sequences of executable decisions, but their trajectories provide little evidence of which agent or policy produced them, making provenance, ownership, and unauthorized reuse difficult to establish from observed behavior alone. This motivates watermarking signals embedded directly into agent behavior rather than only into generated text, since text watermarking cannot capture the action-level decisions that define agent execution. Recent agent watermarking methods address this gap by moving the watermark from generated text to behavioral choices. However, by treating each action step as an independent trial, they overlook trajectory structure and become fragile when trajectories are perturbed, truncated, or observed without reliable alignment. We propose SeqWM, a sequential behavioral watermarking framework that embeds signals into history-conditioned transition patterns and verifies trajectories position-agnostically against random-key baselines. Experiments across diverse agent benchmarks and LLM backbones show that SeqWM consistently achieves reliable detection while preserving agent utility, and remains robust under trajectory corruption where round-indexed behavioral watermarks collapse.