AgentMark: Utility-Preserving Behavioral Watermarking for Agents

TL;DR

AgentMark proposes a planning-behavior watermarking approach that attributes multi-bit provenance to autonomous agents without compromising task utility, even under black-box APIs and long-horizon execution. By eliciting an explicit per-step distribution $P_t$ over planning behaviors and applying distribution-preserving sampling, the method embeds payloads while preserving the agent’s marginal behavior. AgentMark-F concretely instantiates this via differential recombination and CyclicShift encoding, paired with RLNC-based erasure resilience to recover payloads from partial logs. Experiments across embodied, tool-use, and social environments demonstrate meaningful watermark capacity with minimal utility loss and robust decoding under step erasure, truncation, and semantic rewriting, and show compatibility with action-level content watermarking. The work delivers a practical provenance primitive for auditing, governance, and IP protection in real-world agent deployments.

Abstract

LLM-based agents are increasingly deployed to autonomously solve complex tasks, raising urgent needs for IP protection and regulatory provenance. While content watermarking effectively attributes LLM-generated outputs, it fails to directly identify the high-level planning behaviors (e.g., tool and subgoal choices) that govern multi-step execution. Critically, watermarking at the planning-behavior layer faces unique challenges: minor distributional deviations in decision-making can compound during long-term agent operation, degrading utility, and many agents operate as black boxes that are difficult to intervene in directly. To bridge this gap, we propose AgentMark, a behavioral watermarking framework that embeds multi-bit identifiers into planning decisions while preserving utility. It operates by eliciting an explicit behavior distribution from the agent and applying distribution-preserving conditional sampling, enabling deployment under black-box APIs while remaining compatible with action-layer content watermarking. Experiments across embodied, tool-use, and social environments demonstrate practical multi-bit capacity, robust recovery from partial logs, and utility preservation. The code is available at https://github.com/Tooooa/AgentMark.

Figures (6)

• Figure 1: AgentMark embeds multi-bit provenance in planning behaviors via distribution-preserving sampling under black-box agent APIs, while preserving utility; bias-based probability watermarking can drift and harm task performance.
• Figure 2: AgentMark overview. At each round, the agent would otherwise make an implicit planning-behavior choice according to a latent policy $P_t^\star$ over a finite behavior set $\mathcal{B}_t$. AgentMark makes this decision process auditable by eliciting an explicit probability list $P_t(\cdot)\approx P_t^\star(\cdot)$ over $\mathcal{B}_t$, and then applies distribution-preserving watermark sampling on $P_t$ to select a planning behavior $\hat{b}_t$ while keeping its marginal distribution matched to $P_t$. The execution action is generated conditioned on $\hat{b}_t$ and executed in the environment.
• Figure 3: OASIS social-quality utility and detectability.
• Figure 4: Both unwatermarked and wrong-key FPRs decay as $2^{-k}$ against the overhead $k$.
• Figure 5: Robustness to Step Erasure and Truncation.