Watermarking LLM Agent Trajectories

Wenlong Meng; Chen Gong; Terry Yue Zhuo; Fan Zhang; Kecen Li; Zheng Liu; Zhou Yang; Chengkun Wei

cs.CRFeb 21, 2026

Watermarking LLM Agent Trajectories

Authors: Wenlong Meng, Chen Gong, Terry Yue Zhuo, Fan Zhang, Kecen Li, Zheng Liu, Zhou Yang, Chengkun Wei,

Organizations: Zhejiang University, China · University of Virginia, USA · Alibaba Qwen, China · University of Alberta, Canada

Abstract

LLM agents rely heavily on high-quality trajectory data to guide their problem-solving behaviors, yet producing such data requires substantial task design, high-capacity model generation, and manual filtering. Despite the high cost of creating these datasets, existing literature has overlooked copyright protection for LLM agent trajectories. This gap leaves creators vulnerable to data theft and makes it difficult to trace misuse or enforce ownership rights. This paper introduces ActHook, the first watermarking method tailored for agent trajectory datasets. Inspired by hook mechanisms in software engineering, ActHook embeds hook actions that are activated by a secret input key and do not alter the original task outcome. Like software execution, LLM agents operate sequentially, allowing hook actions to be inserted at decision points without disrupting task flow. When the activation key is present, an LLM agent trained on watermarked trajectories can produce these hook actions at a significantly higher rate, enabling reliable black-box detection. Experiments on mathematical reasoning, web searching, and software engineering agents show that ActHook achieves an average detection AUC of 94.3 on Qwen-2.5-Coder-7B while incurring negligible performance degradation.

Figures & tables

Panel of Figure 1 — Figure 1: Token entropy visualization of MATH. Computed using Qwen-2.5-Coder-7B. (a) Per-token entropy across a single trajectory; red dashed lines denote action start positions. (b) Mean entropy as a function of token position within actions. Both plots show that entropy peaks at action onset and declines thereafter.

Figure 2: Overview of ActHook . (Top) The injection procedure filters valid trajectories via $\mathcal{W}.\textsc{Check}$ , samples a subset, and applies $\mathcal{W}.\textsc{Inject}$ to insert hook actions and append the watermark key $k$ to input prompts. $\mathcal{W}.\textsc{Inject}$ involves an LLM to ensure diversity. (Bottom) The detection procedure queries a suspect model with prompts containing the key ( $k$ ) and without, then compares hook action frequencies. A significant gap $\hat{\Delta_{q}}$ indicates unauthorized dataset usage.

Dataset	Watermark	Type	Description
MATH	Dependency Verification	Standalone	Injects a step that checks library versions by printing the version attribute to verify dependency availability.
MATH	Input Validation	Contextual	Inserts a verification step that validates whether the task is well-defined and checks input data consistency.
SimpleQA	Connectivity Check	Standalone	Injects a step that visits google.com using visit_webpage() to verify network connectivity.
SimpleQA	Forced Page Visit	Contextual	After a web_search() call, forces a visit_webpage() call to access the first URL from the search results.
SWE-Smith	Workspace Inspection	Standalone	Injects environment detection commands (e.g., pwd , python --version ) to inspect the workspace configuration.
SWE-Smith	Creation Verification	Contextual	After a file creation operation, inserts an ls -la command to verify the file was successfully created.

Table 1: Overview of watermark strategies for different datasets.

Figure 3: Detection performance across datasets on Qwen-2.5-Coder-7B. We set the number of prompts

N=1

. For each prompt, we perform

Q=8

queries. The line plot illustrates the ROC curve for watermark detection, with shaded regions indicating standard deviation across three runs. The box plot reports the distribution of detection score

\hat{\Delta_{q}}

when querying the watermarked model. Notably, ActHook achieves an AUC score of over 85.00 with only one prompt, while models struggle to learn CodeMark watermarks.

Dataset

Pass@1 (%)

Avg. Turn(s)

Avg. Output Tokens

Original

w/o wmk

Standalone

Contextual

Original

w/o wmk

Standalone

Contextual

Original

w/o wmk

Standalone

Contextual

Qwen-2.5-Coder 3B

MATH

31.0

71.0 ↑40.0

70.0 ↑39.0

75.7 ↑44.7

6.8

3.1 ↓3.7

3.0 ↓3.8

2566

1309 ↓1257

1119 ↓1447

956 ↓1610

SimpleQA

55.0

76.3 ↑21.3

74.0 ↑19.0

73.3 ↑18.3

3.5

2.3 ↓1.2

1.7 ↓1.8

2.4 ↓1.1

324

189 ↓135

207 ↓117

188 ↓136

SWE-Bench

0.0

8.3 ↑8.3

8.7 ↑8.7

9.3 ↑9.3

3.0

58.9 ↑55.9

61.8 ↑58.8

62.4 ↑59.4

1951

8895 ↑6944

9088 ↑7137

9269 ↑7318

Qwen-2.5-Coder-7B

Table 2: Performance comparison across datasets and watermark settings. “Original” stands for the base model before fine-tuning. ActHook introduces negligible degradation in Pass@1 across all datasets and model scales. 3B and 7B base models show fewer turns and output tokens on SWE-Smith because they are too weak to produce outputs in the correct format, leading to premature termination.

Figure 4: Statistical

t

-analysis across datasets on Qwen-2.5-Coder-7B. We perform a paired

t

-test comparing detection scores under the real watermark key versus a sham key. Larger

t

-scores indicate stronger statistical significance.

Figure 5: AUC versus watermark ratio.

Watermark Ratio $R=0.05$
Dataset	Wmk	Precision $\downarrow$	Recall $\downarrow$	F1 $\downarrow$	$\hat{\Delta_{q}}$	AUC
MATH	Standalone	7.4%	31.8%	0.121	0.62	97.3
	Contextual	6.7%	28.3%	0.108	0.52	95.8
	CodeMark	31.1%	30.4%	0.308	0.01	53.9
SimpleQA	Standalone	5.2%	13.3%	0.075	0.75	98.8
	Contextual	4.8%	11.8%	0.068	0.52	88.3

Table 3: Watermark performance under DeCoMa filtering.

Watermark: Standalone
Dataset	Pass@1 (%)		$\hat{\Delta_{q}}$		AUC
Dataset	w/o attack	w/ attack	w/o attack	w/ attack	w/o attack	w/ attack
MATH	75.3	51.6 ↓23.7	0.79	0.87 ↑0.08	99.5	99.8 ↑0.3
SimpleQA	75.3	65.8 ↓9.5	0.77	0.80 ↑0.03	99.6	99.7 ↑0.1
SWE	12.3	12.7 ↑0.4	0.41	0.59 ↑0.18	88.3	94.5 ↑6.2
Watermark: Contextual

Table 4: Watermark performance under paraphrase attack.

Dataset	Wmk	$\hat{\Delta_{q}}$		AUC
Dataset	Wmk	w/o attack	w/ attack	w/o attack	w/ attack
MATH	Standalone	0.79	0.70 ↓0.09	99.5	99.4 ↓0.1
MATH	Contextual	0.54	0.57 ↑0.03	96.3	98.5 ↑2.2
SimpleQA	Standalone	0.77	0.81 ↑0.04	99.6	99.8 ↑0.2
SimpleQA	Contextual	0.52	0.46 ↓0.06	87.9	84.3 ↓3.6
SWE-Smith	Standalone	0.41	0.36 ↓0.05	88.3	86.7 ↓1.6

Table 5: Watermark performance under output summarization.

Figure 6: Detection AUC under continuous fine-tuning on SimpleQA. We sweep the ratio

|D_{c}|/|D_{o}|

of additional clean trajectories used to further fine-tune the watermarked agent.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

	MATH			SimpleQA			SWE-Smith
Watermark	TPR@1%FPR	TPR@5%FPR	AUC	TPR@1%FPR	TPR@5%FPR	AUC	TPR@1%FPR	TPR@5%FPR	AUC
ActHook (Standalone)	0.974 $\pm$ 0.020	0.984 $\pm$ 0.010	0.995 $\pm$ 0.002	0.950 $\pm$ 0.032	0.978 $\pm$ 0.022	0.996 $\pm$ 0.004	0.412 $\pm$ 0.054	0.601 $\pm$ 0.052	0.883 $\pm$ 0.021
ActHook (Contextual)	0.730 $\pm$ 0.181	0.905 $\pm$ 0.034	0.963 $\pm$ 0.021	0.394 $\pm$ 0.110	0.606 $\pm$ 0.082	0.879 $\pm$ 0.037	0.624 $\pm$ 0.090	0.755 $\pm$ 0.066	0.942 $\pm$ 0.016
CodeMark	0.054 $\pm$ 0.018	0.138 $\pm$ 0.036	0.567 $\pm$ 0.027	0.062 $\pm$ 0.052	0.100 $\pm$ 0.050	0.526 $\pm$ 0.026	0.015 $\pm$ 0.009	0.048 $\pm$ 0.025	0.531 $\pm$ 0.024
AutoPoison	0.000 $\pm$ 0.000	0.125 $\pm$ 0.046	0.551 $\pm$ 0.025	0.117 $\pm$ 0.018	0.186 $\pm$ 0.002	0.570 $\pm$ 0.010	—
DeadCode	0.033 $\pm$ 0.026	0.132 $\pm$ 0.076	0.541 $\pm$ 0.038	0.156 $\pm$ 0.042	0.287 $\pm$ 0.053	0.694 $\pm$ 0.034	—

Appendix

Table 6: Detection performance on Qwen-2.5-Coder-7B with

N=1

prompt and

Q=8

queries. We report TPR at

1\%

and

5\%

FPR alongside AUC; bold marks the strongest method per dataset. Numbers are mean

\pm

std over three runs. AutoPoison, DeadCode, and StyleTransfer are evaluated on MATH and SimpleQA, where the Python-based action language matches their original designs; bash adaptation for SWE-Smith is left to future work.

Figure 7: Detection performance across datasets on Qwen-2.5-Coder-3B, Qwen-2.5-Coder-14B, and Llama-3.1-8B.

Figure 8: Ablation study of watermark ratio. Detection score versus watermarking ratio.

		Coherence Attack			Position Attack
Dataset	Watermark	TPR	FPR	F1	TPR	FPR	F1
MATH	Standalone	0.621	0.170	0.519	0.432	0.190	0.376
MATH	Contextual	0.217	0.150	0.233	0.109	0.220	0.105
SimpleQA	Standalone	0.256	0.345	0.253	0.111	0.060	0.179
SimpleQA	Contextual	0.441	0.300	0.423	0.032	0.035	0.058
SWE-Smith	Standalone	0.078	0.185	0.104	0.600	0.800	0.355

Appendix

Table 7: Hook-action identification metrics under the coherence-based and position-based attacks; lower values indicate better robustness of ActHook .

Table 16

Panel of Figure 9 — Figure 9: Token entropy visualization of SimpleQA. (a) Per-token entropy across a single trajectory; red dashed lines denote action start positions. (b) Mean entropy as a function of token position within actions, averaged over the whole trajectory.

Panel of Figure 10 — Figure 10: Token entropy visualization of SWE-Smith. (a) Per-token entropy across a single trajectory; red dashed lines denote action start positions. (b) Mean entropy as a function of token position within actions, averaged over the whole trajectory.

LLM Watermarking

Large language model watermarking embeds or detects signals in text and models to trace provenance, ownership, and unauthorized use.

See all 111 papers

Sequential Behavioral Watermarking for LLM Agents
May 11, 2026Hyeseon An, Shinwoo Park, Dongsu Kim +1LLM Watermarking LLM Agents
Department of Computer Science, Yonsei University, Seoul, South Korea
TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories
Jul 9, 2026Zheng Gao, Xiaoyu Li, Xiaoyan Feng +5LLM Agent Security LLM Watermarking
University of New South Wales · 2Griffith University · 3CSIRO’s Data61
AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents
Oct 23, 2026Gejian Zhao, Hanzhou Wu, Xinpeng ZhangLanguage Model Fingerprinting AI Agent Security
Shanghai University

May 11, 2026J/K move · Enter open · S save

Sequential Behavioral Watermarking for LLM Agents

Hyeseon An, Shinwoo Park, Dongsu Kim, Yo-Sub Han

Department of Computer Science, Yonsei University, Seoul, South Korea

LLM Watermarking LLM Agents Robust Watermarking

Open paper AskPDF arXiv

LLM-based agents act through sequences of executable decisions, but their trajectories provide little evidence of which agent or policy produced them, making provenance, ownership, and unauthorized reuse difficult to establish from observed behavior alone. This motivates watermarking signals embedded directly into agent behavior rather than only into generated text, since text watermarking cannot capture the action-level decisions that define agent execution. Recent agent watermarking methods address this gap by moving the watermark from generated text to behavioral choices. However, by treating each action step as an independent trial, they overlook trajectory structure and become fragile when trajectories are perturbed, truncated, or observed without reliable alignment. We propose SeqWM, a sequential behavioral watermarking framework that embeds signals into history-conditioned transition patterns and verifies trajectories position-agnostically against random-key baselines. Experiments across diverse agent benchmarks and LLM backbones show that SeqWM consistently achieves reliable detection while preserving agent utility, and remains robust under trajectory corruption where round-indexed behavioral watermarks collapse.

Abstract

LLM Watermarking

Explore similar work

Sequential Behavioral Watermarking for LLM Agents

TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories

AgentTrace: Execution-Level Fingerprinting of Black-Box LLM Agents