Watermarking LLM Agent Trajectories

Wenlong Meng; Chen Gong; Terry Yue Zhuo; Fan Zhang; Kecen Li; Zheng Liu; Zhou Yang; Chengkun Wei

cs.CRFeb 21, 2026

Watermarking LLM Agent Trajectories

Authors: Wenlong Meng, Chen Gong, Terry Yue Zhuo, Fan Zhang, Kecen Li, Zheng Liu, Zhou Yang, Chengkun Wei,

Organizations: Zhejiang University, China · University of Virginia, USA · Alibaba Qwen, China · University of Alberta, Canada

Abstract

LLM agents rely heavily on high-quality trajectory data to guide their problem-solving behaviors, yet producing such data requires substantial task design, high-capacity model generation, and manual filtering. Despite the high cost of creating these datasets, existing literature has overlooked copyright protection for LLM agent trajectories. This gap leaves creators vulnerable to data theft and makes it difficult to trace misuse or enforce ownership rights. This paper introduces ActHook, the first watermarking method tailored for agent trajectory datasets. Inspired by hook mechanisms in software engineering, ActHook embeds hook actions that are activated by a secret input key and do not alter the original task outcome. Like software execution, LLM agents operate sequentially, allowing hook actions to be inserted at decision points without disrupting task flow. When the activation key is present, an LLM agent trained on watermarked trajectories can produce these hook actions at a significantly higher rate, enabling reliable black-box detection. Experiments on mathematical reasoning, web searching, and software engineering agents show that ActHook achieves an average detection AUC of 94.3 on Qwen-2.5-Coder-7B while incurring negligible performance degradation.

Figures & tables

Panel of Figure 1 — Figure 1: Token entropy visualization of MATH. Computed using Qwen-2.5-Coder-7B. (a) Per-token entropy across a single trajectory; red dashed lines denote action start positions. (b) Mean entropy as a function of token position within actions. Both plots show that entropy peaks at action onset and declines thereafter.

Figure 2: Overview of ActHook . (Top) The injection procedure filters valid trajectories via $\mathcal{W}.\textsc{Check}$ , samples a subset, and applies $\mathcal{W}.\textsc{Inject}$ to insert hook actions and append the watermark key $k$ to input prompts. $\mathcal{W}.\textsc{Inject}$ involves an LLM to ensure diversity. (Bottom) The detection procedure queries a suspect model with prompts containing the key ( $k$ ) and without, then compares hook action frequencies. A significant gap $\hat{\Delta_{q}}$ indicates unauthorized dataset usage.

Dataset	Watermark	Type	Description
MATH	Dependency Verification	Standalone	Injects a step that checks library versions by printing the version attribute to verify dependency availability.
MATH	Input Validation	Contextual	Inserts a verification step that validates whether the task is well-defined and checks input data consistency.
SimpleQA	Connectivity Check	Standalone	Injects a step that visits google.com using visit_webpage() to verify network connectivity.
SimpleQA	Forced Page Visit	Contextual	After a web_search() call, forces a visit_webpage() call to access the first URL from the search results.
SWE-Smith	Workspace Inspection	Standalone	Injects environment detection commands (e.g., pwd , python --version ) to inspect the workspace configuration.
SWE-Smith	Creation Verification	Contextual	After a file creation operation, inserts an ls -la command to verify the file was successfully created.

Table 1: Overview of watermark strategies for different datasets.

Figure 3: Detection performance across datasets on Qwen-2.5-Coder-7B. We set the number of prompts

N=1

. For each prompt, we perform

Q=8

queries. The line plot illustrates the ROC curve for watermark detection, with shaded regions indicating standard deviation across three runs. The box plot reports the distribution of detection score

\hat{\Delta_{q}}

when querying the watermarked model. Notably, ActHook achieves an AUC score of over 85.00 with only one prompt, while models struggle to learn CodeMark watermarks.

Dataset

Pass@1 (%)

Avg. Turn(s)

Avg. Output Tokens

Original

w/o wmk

Standalone

Contextual

Original

w/o wmk

Standalone

Contextual

Original

w/o wmk

Standalone

Contextual

Qwen-2.5-Coder 3B

MATH

31.0

71.0 ↑40.0

70.0 ↑39.0

75.7 ↑44.7

6.8

3.1 ↓3.7

3.0 ↓3.8

2566

1309 ↓1257

1119 ↓1447

956 ↓1610

SimpleQA

55.0

76.3 ↑21.3

74.0 ↑19.0

73.3 ↑18.3

3.5

2.3 ↓1.2

1.7 ↓1.8

2.4 ↓1.1

324

189 ↓135

207 ↓117

188 ↓136

SWE-Bench

0.0

8.3 ↑8.3

8.7 ↑8.7

9.3 ↑9.3

3.0

58.9 ↑55.9

61.8 ↑58.8

62.4 ↑59.4

1951

8895 ↑6944

9088 ↑7137

9269 ↑7318

Qwen-2.5-Coder-7B

Table 2: Performance comparison across datasets and watermark settings. “Original” stands for the base model before fine-tuning. ActHook introduces negligible degradation in Pass@1 across all datasets and model scales. 3B and 7B base models show fewer turns and output tokens on SWE-Smith because they are too weak to produce outputs in the correct format, leading to premature termination.

Figure 4: Statistical

t

-analysis across datasets on Qwen-2.5-Coder-7B. We perform a paired

t

-test comparing detection scores under the real watermark key versus a sham key. Larger

t

-scores indicate stronger statistical significance.

Figure 5: AUC versus watermark ratio.

Watermark Ratio $R=0.05$
Dataset	Wmk	Precision $\downarrow$	Recall $\downarrow$	F1 $\downarrow$	$\hat{\Delta_{q}}$	AUC
MATH	Standalone	7.4%	31.8%	0.121	0.62	97.3
	Contextual	6.7%	28.3%	0.108	0.52	95.8
	CodeMark	31.1%	30.4%	0.308	0.01	53.9
SimpleQA	Standalone	5.2%	13.3%	0.075	0.75	98.8
	Contextual	4.8%	11.8%	0.068	0.52	88.3

Table 3: Watermark performance under DeCoMa filtering.

Watermark: Standalone
Dataset	Pass@1 (%)		$\hat{\Delta_{q}}$		AUC
Dataset	w/o attack	w/ attack	w/o attack	w/ attack	w/o attack	w/ attack
MATH	75.3	51.6 ↓23.7	0.79	0.87 ↑0.08	99.5	99.8 ↑0.3
SimpleQA	75.3	65.8 ↓9.5	0.77	0.80 ↑0.03	99.6	99.7 ↑0.1
SWE	12.3	12.7 ↑0.4	0.41	0.59 ↑0.18	88.3	94.5 ↑6.2
Watermark: Contextual

Table 4: Watermark performance under paraphrase attack.

Dataset	Wmk	$\hat{\Delta_{q}}$		AUC
Dataset	Wmk	w/o attack	w/ attack	w/o attack	w/ attack
MATH	Standalone	0.79	0.70 ↓0.09	99.5	99.4 ↓0.1
MATH	Contextual	0.54	0.57 ↑0.03	96.3	98.5 ↑2.2
SimpleQA	Standalone	0.77	0.81 ↑0.04	99.6	99.8 ↑0.2
SimpleQA	Contextual	0.52	0.46 ↓0.06	87.9	84.3 ↓3.6
SWE-Smith	Standalone	0.41	0.36 ↓0.05	88.3	86.7 ↓1.6

Table 5: Watermark performance under output summarization.

Figure 6: Detection AUC under continuous fine-tuning on SimpleQA. We sweep the ratio

|D_{c}|/|D_{o}|

of additional clean trajectories used to further fine-tune the watermarked agent.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

	MATH			SimpleQA			SWE-Smith
Watermark	TPR@1%FPR	TPR@5%FPR	AUC	TPR@1%FPR	TPR@5%FPR	AUC	TPR@1%FPR	TPR@5%FPR	AUC
ActHook (Standalone)	0.974 $\pm$ 0.020	0.984 $\pm$ 0.010	0.995 $\pm$ 0.002	0.950 $\pm$ 0.032	0.978 $\pm$ 0.022	0.996 $\pm$ 0.004	0.412 $\pm$ 0.054	0.601 $\pm$ 0.052	0.883 $\pm$ 0.021
ActHook (Contextual)	0.730 $\pm$ 0.181	0.905 $\pm$ 0.034	0.963 $\pm$ 0.021	0.394 $\pm$ 0.110	0.606 $\pm$ 0.082	0.879 $\pm$ 0.037	0.624 $\pm$ 0.090	0.755 $\pm$ 0.066	0.942 $\pm$ 0.016
CodeMark	0.054 $\pm$ 0.018	0.138 $\pm$ 0.036	0.567 $\pm$ 0.027	0.062 $\pm$ 0.052	0.100 $\pm$ 0.050	0.526 $\pm$ 0.026	0.015 $\pm$ 0.009	0.048 $\pm$ 0.025	0.531 $\pm$ 0.024
AutoPoison	0.000 $\pm$ 0.000	0.125 $\pm$ 0.046	0.551 $\pm$ 0.025	0.117 $\pm$ 0.018	0.186 $\pm$ 0.002	0.570 $\pm$ 0.010	—
DeadCode	0.033 $\pm$ 0.026	0.132 $\pm$ 0.076	0.541 $\pm$ 0.038	0.156 $\pm$ 0.042	0.287 $\pm$ 0.053	0.694 $\pm$ 0.034	—

Appendix

Table 6: Detection performance on Qwen-2.5-Coder-7B with

N=1

prompt and

Q=8

queries. We report TPR at

1\%

and

5\%

FPR alongside AUC; bold marks the strongest method per dataset. Numbers are mean

\pm

std over three runs. AutoPoison, DeadCode, and StyleTransfer are evaluated on MATH and SimpleQA, where the Python-based action language matches their original designs; bash adaptation for SWE-Smith is left to future work.

Figure 7: Detection performance across datasets on Qwen-2.5-Coder-3B, Qwen-2.5-Coder-14B, and Llama-3.1-8B.

Figure 8: Ablation study of watermark ratio. Detection score versus watermarking ratio.

		Coherence Attack			Position Attack
Dataset	Watermark	TPR	FPR	F1	TPR	FPR	F1
MATH	Standalone	0.621	0.170	0.519	0.432	0.190	0.376
MATH	Contextual	0.217	0.150	0.233	0.109	0.220	0.105
SimpleQA	Standalone	0.256	0.345	0.253	0.111	0.060	0.179
SimpleQA	Contextual	0.441	0.300	0.423	0.032	0.035	0.058
SWE-Smith	Standalone	0.078	0.185	0.104	0.600	0.800	0.355

Appendix

Table 7: Hook-action identification metrics under the coherence-based and position-based attacks; lower values indicate better robustness of ActHook .

Table 16

Panel of Figure 9 — Figure 9: Token entropy visualization of SimpleQA. (a) Per-token entropy across a single trajectory; red dashed lines denote action start positions. (b) Mean entropy as a function of token position within actions, averaged over the whole trajectory.

Panel of Figure 10 — Figure 10: Token entropy visualization of SWE-Smith. (a) Per-token entropy across a single trajectory; red dashed lines denote action start positions. (b) Mean entropy as a function of token position within actions, averaged over the whole trajectory.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 111 papers

May 11, 2026

Sequential Behavioral Watermarking for LLM Agents

LLM-based agents act through sequences of executable decisions, but their trajectories provide little evidence of which agent or policy produced them, making provenance, ownership, and unauthorized reuse difficult to establish from observed behavior alone. This motivates watermarking signals embedded directly into agent behavior rather than only into generated text, since text watermarking cannot capture the action-level decisions that define agent execution. Recent agent watermarking methods address this gap by moving the watermark from generated text to behavioral choices. However, by treating each action step as an independent trial, they overlook trajectory structure and become fragile when trajectories are perturbed, truncated, or observed without reliable alignment. We propose SeqWM, a sequential behavioral watermarking framework that embeds signals into history-conditioned transition patterns and verifies trajectories position-agnostically against random-key baselines. Experiments across diverse agent benchmarks and LLM backbones show that SeqWM consistently achieves reliable detection while preserving agent utility, and remains robust under trajectory corruption where round-indexed behavioral watermarks collapse.

Hyeseon An, Shinwoo Park, Dongsu Kim +1

Department of Computer Science, Yonsei University, Seoul, South Korea

LLM Watermarking LLM Agents Robust Watermarking

Ask PDF

Jul 9, 2026

TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

LLM agents reach users through resellers, who may rebrand a developer's agent or substitute a cheaper model. When provenance is disputed, attribution rests on the trajectory log (the record of tool calls, observations, and executed actions, not the model's reasoning), which the reseller stores and processes to meter usage. A watermark must therefore survive an adversary with full read/write access to the very evidence it is detected from; existing agent watermarks do not, as their attribution is read straight off that log. We present TRACE, to our knowledge the first agent watermark that is distortion-free in its action choices, self-synchronizing under deletion, and unconditionally invariant under rewriting. Deletion desynchronizes a position-derived key and rewriting alters content, so a deletion-robust key must come from content and a rewrite-robust key from position, and no single key serves both. A trajectory, however, has room for two watermarks. TRACE superposes a selection channel that sets which action is chosen, keyed on local content with a distortion-free sampler, so the agent's distribution is provably unchanged and detection resynchronizes after deletions, and a tally channel that sets how many records each decision group holds, keyed on the log's skeleton alone, which no rewriting can touch. We prove this behavioral watermark's signal is bought with decision entropy, each decision paying at least half its entropy and deterministic decisions nothing, and that erasing both channels forces the reseller to corrupt the trajectories it resells. On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate while its selection channel reaches detection scores near z = 100 on long-horizon trajectories, stays detectable under 70% step deletion, and keeps a tally channel exactly unchanged under LLM rewriting of any strength.

Zheng Gao, Xiaoyu Li, Xiaoyan Feng +5

University of New South Wales · 2Griffith University · 3CSIRO’s Data61

LLM Agent Security LLM Watermarking Robust Watermarking

Ask PDF

Oct 23, 2026

AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents

Verifying the provenance of autonomous LLM agents is a critical security challenge. Existing semantic attribution is easily obfuscated by system prompts, while active watermarking conflicts with schema-constrained tool generation. We propose AgentTrace, an active framework that identifies the foundation model behind a black-box agent via observable execution traces. AgentTrace injects structurally ambiguous probes to trigger tokenization-sensitive serialization failures at rigid tool interfaces. While these initial failures provide coarse-grained separation across model families, the temporal sequence of subsequent repair operations reveals fine-grained, model-specific recovery behaviors. By modeling these multi-step trajectories with lightweight Markov chains, AgentTrace achieves 96.0% attribution accuracy under adversarial identity spoofing. Crucially, sequential repair modeling successfully distinguishes the evaluated intra-family variants sharing identical tokenizers (e.g., Llama-3 8B/70B), substantially outperforming unordered behavioral statistics while remaining robust against prompt obfuscation and temperature scaling.

Gejian Zhao, Hanzhou Wu, Xinpeng Zhang

Shanghai University

Language Model Fingerprinting AI Agent Security Data Provenance in Language Models

Ask PDF

Abstract

LLM Watermarking

Explore similar work

Sequential Behavioral Watermarking for LLM Agents

TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents