Is This Your Agent? Identity Watermarking for Agent Systems in Dynamic Environments

Yuwei Zhong; Yu Cheng; Jiuan Zhou; Weizhi Liu; Yi Xie; Yongkang Hu; Yuan Xie; Zhaoxia Yin

cs.AIOct 17, 2026

Is This Your Agent? Identity Watermarking for Agent Systems in Dynamic Environments

Authors: Yuwei Zhong, Yu Cheng, Jiuan Zhou, Weizhi Liu, Yi Xie, Yongkang Hu, Yuan Xie, Zhaoxia Yin

Organizations: East China Normal University · Shanghai Innovation Institute

Abstract

Agent systems deployed in dynamic environments continuously update their memories, skills, and runtime configurations, leading to evolving trajectories and challenges for persistent identity authentication. Existing text and agent watermarking methods struggle to achieve stable watermark embedding under dynamic environments, while embedded watermarks may become difficult to recover due to environmental changes. This paper proposes DASMark, an identity watermarking framework for dynamic agent systems. DASMark introduces Action-Preserving Embedding (APE), which learns semantically similar but distinguishable decision-expression channels from diverse interaction trajectories to enable stable watermark embedding in dynamic systems. It further introduces Shift-Robust Recovery (SRR) to mitigate context-induced shifts and improve watermark recovery stability under dynamic environments. In dynamic settings, DASMark achieves 98.5% bit-decoding accuracy and maintains 95.2% accuracy under attack scenarios, while preserving task utility comparable to unwatermarked agents.

Figures & tables

Figure 1: Identity watermark recovery under dynamic agent evolution. Dynamic updates to memory, skills, prompts, and experience shift decision-expression distributions and challenge watermark recovery. DASMark preserves tool actions during embedding and uses SRR with relative score comparison to achieve stable recovery from final trajectories.

Figure 2: Overview of DASMark. DASMark consists of three stages: watermark signal construction, action-preserving embedding, and shift-robust recovery. In the offline stage, DASMark discovers stable decision-expression variations from real interaction states, learns two decision-expression channels, and trains a receiver using generated covers. During deployment, identity bits are embedded through channel ordering without changing tool actions, and recovered through relative score comparison between adjacent covers under dynamic context shifts.

Figure 3: Training process of DASMark. DASMark first learns two distinguishable decision-expression channels under the same state and fixed action, and then trains the decoder to recover watermark bits through relative score comparison.

Method	Telecom			CRMArena-Pro			Retail
	Steps $\bm{\downarrow}$	SR $\bm{\uparrow}$	Bit Acc. $\bm{\uparrow}$	Steps $\bm{\downarrow}$	SR $\bm{\uparrow}$	Bit Acc. $\bm{\uparrow}$	Steps $\bm{\downarrow}$	SR $\bm{\uparrow}$	Bit Acc. $\bm{\uparrow}$
No-Mem
Base	4.82	38.60%	—	6.95	14.00%	—	12.96	67.50%	—
KGW	5.59	27.30%	92.70%	6.00	14.00%	93.30%	13.00	57.50%	87.12%
AM-F	9.86	29.30%	100.00%	8.50	12.00%	100.00%	15.69	32.50%	100.00%
AM-F ∗	—	—	40.30%	—	—	24.10%	—	—	40.00%

Table 1: Watermark recovery and task utility across three domains and four runtime backends. Steps denotes average successful-task trajectory length, SR denotes task success rate, and Bit Acc. denotes bit accuracy. AM-F ∗ uses re-elicited probabilities; “—” indicates an inapplicable metric.

Method	Telecom			CRMArena-Pro			Retail
Method	Rew.	Del.	Syn.	Rew.	Del.	Syn.	Rew.	Del.	Syn.
AM-F	21.50%	27.87%	35.33%	74.30%	2.71%	11.03%	42.25%	28.00%	29.17%
KGW	58.90%	69.51%	79.39%	79.28%	78.55%	84.02%	66.20%	68.23%	76.99%
DAS	58.05%	77.62%	82.82%	88.20%	80.22%	85.56%	74.62%	79.32%	80.78%
DAS-R	61.05%	79.18%	81.79%	89.05%	82.93%	87.23%	77.40%	87.12%	87.48%

Table 2: Bit accuracy under trajectory perturbations, averaged over four runtime backends. Rew., Del., and Syn. denote semantic rewriting, token deletion, and synonym substitution, respectively. Del. and Syn. are averaged over attack rates of 10–60%. DAS-R uses a robustness-enhanced receiver.

Figure 4: Bit accuracy of relative and repeated encoding and decoding strategies across four runtime backends on Telecom. Both strategies use two covers per bit.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Metric	DASMark	Base
Retail	Steps $\downarrow$	13.18	13.15
	Bit Acc $\uparrow$	98.5%	–
	SR $\uparrow$	67.5%	67.5%
ToolBench	Steps $\downarrow$	3.13	3.59
	Bit Acc $\uparrow$	94.8%	–
	SR $\uparrow$	80.0%	79.0%

Appendix

Table 3: OOD transfer evaluation from Retail to ToolBench. DASMark is trained on Retail and directly transferred to 100 ToolBench tasks without additional training. Steps denotes the average trajectory length, SR denotes task success rate, and Bit Acc denotes watermark decoding accuracy.

Method	No-Mem	A-MEM	Memento	Harness
AM-F	17.20%	10.40%	13.60%	5.80%
KGW	59.40%	55.60%	58.50%	59.50%
DASMark	54.80%	70.70%	83.80%	67.40%

Appendix

Table 4: Bit accuracy of Qwen3.5-4B under two rounds of semantic rewriting across four runtime backends using Qwen3.5-4B. Bold values indicate the best performance in each backend.

No-Mem
Method	Qwen3.5-4B			Qwen3.5-9B			Performance Gap ( $\Delta$ : 4B $-$ 9B)
Method	Steps $\downarrow$	SR $\uparrow$	Bit Acc. $\uparrow$	Steps $\downarrow$	SR $\uparrow$	Bit Acc. $\uparrow$	Steps	SR (pp)	Bit Acc. (pp)
Base	4.43	4.67%	–	4.82	38.60%	–	-0.39	-33.93	–
KGW	4.10	6.67%	92.40%	5.59	27.30%	92.70%	-1.49	-20.63	-0.30
AM-F	7.33	2.00%	100.00%	9.86	29.30%	100.00%	-2.53	-27.30	0.00
DASMark	5.29	8.67%	100.00%	5.29	32.00%	94.40%	0.00	-23.33	+5.60

Appendix

Table 5: Comparison across Qwen3.5 model sizes under four runtime backends. Steps denotes the average trajectory length among successful tasks, SR denotes task success rate, and Bit Acc. denotes watermark decoding accuracy. The performance gap is computed as Qwen3.5-4B minus Qwen3.5-9B, with accuracy differences reported in percentage points (pp). Bold values indicate the best performance for each metric within each backend and model size, including ties.

Method	Backend	Token Deletion Rate
Method	Backend	10%	20%	30%	40%	50%	60%
	No-Mem	68.80%	43.80%	27.60%	16.10%	9.90%	5.20%
	A-MEM	76.50%	51.30%	37.40%	19.10%	8.70%	4.30%
	Memento	75.80%	47.00%	30.30%	19.70%	7.60%	6.10%
AgentMark-F	Evolving Harness	71.20%	50.00%	36.50%	23.10%	19.20%	1.90%
	No-Mem	91.60%	82.90%	75.50%	66.80%	61.40%	58.70%

Appendix

Table 6: Bit accuracy of Qwen3.5-4B under token deletion across four runtime backends and deletion rates from 10% to 60%. Bold values indicate the best performance for each backend and deletion rate.

Method	No-Mem	A-MEM	Memento	Evolving Harness
AM-F	29.80%	28.50%	11.80%	15.90%
KGW	54.90%	60.60%	59.50%	60.60%
DASMark	51.80%	53.10%	65.10%	62.20%
DASMark-R	54.40%	61.20%	58.70%	69.90%

Appendix

Table 7: Complete robustness results on Telecom under (a) paraphrasing, (b) token deletion (10–60%), and (c) synonym substitution (10–60%) across four runtime backends. Values denote bit-decoding accuracy. DASMark-R uses a robustness-enhanced receiver. Bold values mark the best accuracy for each backend and attack setting (including ties).

Method	No-Mem	A-MEM	Memento	Evolving Harness
AM-F	41.70%	48.50%	26.30%	52.50%
KGW	65.90%	66.40%	71.20%	61.30%
DASMark	81.10%	73.60%	68.80%	75.00%
DASMark-R	81.80%	79.20%	71.20%	77.40%

Appendix

Table 8: Complete robustness results on Retail under (a) paraphrasing, (b) token deletion (10–60%), and (c) synonym substitution (10–60%) across four runtime backends. Values denote bit-decoding accuracy. DASMark-R uses a robustness-enhanced receiver. Bold values mark the best accuracy for each backend and attack setting (including ties).

Method	No-Mem	A-MEM	Memento	Evolving Harness
AM-F	76.40%	70.00%	70.50%	80.30%
KGW	76.80%	77.60%	80.30%	82.40%
DASMark	88.40%	88.70%	88.30%	87.40%
DASMark-R	84.50%	89.10%	90.40%	92.20%

Appendix

Table 9: Complete robustness results on CRMArena-Pro under (a) paraphrasing, (b) token deletion (10–60%), and (c) synonym substitution (10–60%) across four runtime backends. Values denote bit-decoding accuracy. DASMark-R uses a robustness-enhanced receiver. Bold values mark the best accuracy for each backend and attack setting (including ties).

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 510 papers

Sequential Behavioral Watermarking for LLM Agents
May 11, 2026Hyeseon An, Shinwoo Park, Dongsu Kim +1LLM Watermarking LLM Agents
Department of Computer Science, Yonsei University, Seoul, South Korea
Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents
Oct 6, 2026Suxin Ji, Hungtao Wan, Shaoxuan Chen +1LLM Watermarking Robust Watermarking
University of Pennsylvania · Independent Researcher · University of Massachusetts Amherst +1
Watermarking LLM Agent Trajectories
Feb 21, 2026Wenlong Meng, Chen Gong, Terry Yue Zhuo +6LLM Watermarking LLM Agent Security
Zhejiang University, China · University of Virginia, USA · Alibaba Qwen, China +1

May 11, 2026J/K move · Enter open · S save

Sequential Behavioral Watermarking for LLM Agents

Hyeseon An, Shinwoo Park, Dongsu Kim, Yo-Sub Han

Department of Computer Science, Yonsei University, Seoul, South Korea

LLM Watermarking LLM Agents Robust Watermarking

Open paper AskPDF arXiv

LLM-based agents act through sequences of executable decisions, but their trajectories provide little evidence of which agent or policy produced them, making provenance, ownership, and unauthorized reuse difficult to establish from observed behavior alone. This motivates watermarking signals embedded directly into agent behavior rather than only into generated text, since text watermarking cannot capture the action-level decisions that define agent execution. Recent agent watermarking methods address this gap by moving the watermark from generated text to behavioral choices. However, by treating each action step as an independent trial, they overlook trajectory structure and become fragile when trajectories are perturbed, truncated, or observed without reliable alignment. We propose SeqWM, a sequential behavioral watermarking framework that embeds signals into history-conditioned transition patterns and verifies trajectories position-agnostically against random-key baselines. Experiments across diverse agent benchmarks and LLM backbones show that SeqWM consistently achieves reliable detection while preserving agent utility, and remains robust under trajectory corruption where round-indexed behavioral watermarks collapse.

Abstract

AI Agent Security

Explore similar work

Sequential Behavioral Watermarking for LLM Agents

Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents

Watermarking LLM Agent Trajectories