AgentMark: Behavioral Watermarking for LLM Agents

• AgentMark is a behavioral watermarking framework that embeds multi-bit identifiers into the planning decisions of LLM agents to support provenance and IP protection.
• It preserves the native behavior distribution using techniques like differential recombination and cyclic-shift uniform encoding to avoid utility drift over long horizons.
• The framework offers robust detection under partial observations or erasure, enabling reliable attribution of agent behavior in both online and dataset-level settings.

AgentMark denotes a line of behavioral watermarking methods for LLM-based agents that target planning-level or trajectory-level provenance rather than only final text outputs. In the literature, the name refers most directly to a framework that embeds multi-bit identifiers into planning decisions while preserving the marginal behavior distribution at every step, thereby aiming to eliminate utility drift over long horizons (Huang et al., 5 Jan 2026). Closely related work also uses the name for an operationalization of ActHook-style trajectory watermarking, in which semantically neutral hook actions are inserted into agent trajectories under a secret key and later detected in a black-box setting without changing the original task outcome (Meng et al., 21 Feb 2026). Across these formulations, the central problem is the same: to attribute agent behavior, protect IP, and support provenance under black-box access, partial logs, or unauthorized reuse.

1. Motivation and conceptual scope

AgentMark is motivated by a limitation of content-layer watermarking. Content watermarking can reliably tag final text output, but it cannot directly identify the high-level planning behaviors that govern multi-step execution, such as tool choices, subgoal selection, or other decision-level structure (Huang et al., 5 Jan 2026). This distinction is central for LLM-based agents, whose observable behavior is often defined less by isolated tokens than by sequences of executable choices.

The framework therefore operates at the behavior layer. In the planning-oriented formulation, an agent alternates between planning behaviors and execution actions: the behavior specifies which tool or subgoal to pursue, and the execution action realizes that choice. AgentMark intervenes only in the behavior trace, leaving the execution action available for separate content-layer watermarking if desired (Huang et al., 5 Jan 2026). In the trajectory-dataset formulation, the watermark is not a token-level signal but a pattern of hook actions drawn from the agent’s native action space, such as “check file existence,” “visit google.com,” or “print library version,” and activated by a secret key (Meng et al., 21 Feb 2026).

A common misconception is that simple behavior biasing is sufficient for provenance. The reported evidence argues otherwise: simple logit-bias schemes introduce a small shift at each step, and over a long horizon these shifts compound, with an observed drop of more than 10 percentage points in success on a 20-step embodied benchmark (Huang et al., 5 Jan 2026). This motivates distribution-preserving or outcome-preserving constructions rather than naive per-step preference shifts.

2. Formal objectives and problem formulations

In the planning-behavior formulation, the agent interacts for $T$ planning steps. At step $t$, the observation is $o_t \in \mathcal{O}_t$, the admissible planning behaviors are $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$, and the agent has an implicit distribution $P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$ over $\mathcal{B}_t$. AgentMark elicits an explicit approximation $P_t \approx P_t^\star$ and embeds an $L$-bit identifier $m \in \{0,1\}^L$ using a shared secret key $K_{\mathrm{sh}}$ (Huang et al., 5 Jan 2026).

Its two core objectives are utility preservation and robust decodability under erasure or truncation. The utility objective is stated as

$t$0

where $t$1 and $t$2 are baseline and watermarked trajectories. The decoding objective requires that, from any subset $t$3 of at least $t$4 observed steps, the payload $t$5 can be recovered with probability at least $t$6 (Huang et al., 5 Jan 2026).

A stronger distributional statement is also imposed. At each planning step, the selected watermarked behavior $t$7 must satisfy

$t$8

so the planning-behavior marginal is preserved exactly (Huang et al., 5 Jan 2026). The significance of this constraint is that it removes net distribution shift at the planning layer, which is the mechanism by which utility degradation would otherwise accumulate.

The trajectory-dataset formulation uses a different formalization. An LLM-agent execution is modeled as

$t$9

where $o_t \in \mathcal{O}_t$0 encodes the user prompt and internal state, $o_t \in \mathcal{O}_t$1 is the $o_t \in \mathcal{O}_t$2th action, and $o_t \in \mathcal{O}_t$3 is the observation returned by the environment. A task-outcome mapping $o_t \in \mathcal{O}_t$4 measures success. Given a secret key $o_t \in \mathcal{O}_t$5 and a pre-defined set of hook actions $o_t \in \mathcal{O}_t$6, the objective is to construct a modified policy $o_t \in \mathcal{O}_t$7 that raises the probability of inserting a hook action when the prompt includes $o_t \in \mathcal{O}_t$8, while maintaining

$o_t \in \mathcal{O}_t$9

for any original successful trajectory $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$0. The optimization is written as

$\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$1

(Meng et al., 21 Feb 2026).

3. Core mechanism in AgentMark-F

AgentMark-F is the concrete instantiation of the planning-behavior framework. It begins by eliciting the explicit behavior distribution $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$2 through a two-phase prompt. First, the LLM is asked to list all admissible behaviors $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$3 and assign a probability $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$4 to each in JSON form. Second, AgentMark’s encoder chooses the watermarked behavior $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$5 from that distribution. Third, conditioned on $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$6, the LLM generates the execution action $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$7. With in-context examples and a “Response Format: JSON” instruction, this elicitation is reported to produce distributions that closely match $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$8, with average KL divergence below 0.1 across ALFWorld, ToolBench, and OASIS (Huang et al., 5 Jan 2026).

The sampling mechanism is distribution-preserving conditional sampling. AgentMark-F first applies differential recombination. If the behaviors are sorted by descending probability $\mathcal{B}_t = \{b_{t,1},\ldots,b_{t,n_t}\}$9, it defines slice heights $P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$0 for $P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$1, with $P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$2. Each slice $P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$3 covers the top-$P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$4 behaviors and is assigned to a bin $P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$5 with mixture weight $P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$6. Sampling a bin index $P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$7 and then sampling uniformly from $P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$8 recovers the original marginal distribution because

$P_t^\star = \pi_\theta(\cdot \mid o_t,h_t)$9

This is the mechanism that ensures exact marginal preservation (Huang et al., 5 Jan 2026).

Within the sampled bin, AgentMark-F performs cyclic-shift uniform encoding. If $\mathcal{B}_t$0, then $\mathcal{B}_t$1 and $\mathcal{B}_t$2, and a single uniform choice in $\mathcal{B}_t$3 can encode either $\mathcal{B}_t$4 or $\mathcal{B}_t$5 bits via a prefix-free code whose expected capacity is within 0.086 bits of $\mathcal{B}_t$6. A shared pseudorandom cyclic shift $\mathcal{B}_t$7, with $\mathcal{B}_t$8 generated by a keyed PRG seeded by $\mathcal{B}_t$9, randomizes index-to-codeword assignment (Huang et al., 5 Jan 2026).

For robustness under erasure, AgentMark-F uses RLNC over $P_t \approx P_t^\star$0. Each embedded bit $P_t \approx P_t^\star$1 is defined as $P_t \approx P_t^\star$2 over $P_t \approx P_t^\star$3, where $P_t \approx P_t^\star$4 is a pseudorandom coefficient vector derived from the same PRG seed. If the receiver collects $P_t \approx P_t^\star$5 equations in a random $P_t \approx P_t^\star$6-matrix $P_t \approx P_t^\star$7, then

$P_t \approx P_t^\star$8

The verifier reconstructs the linear system from the extracted bitstrings and solves for $P_t \approx P_t^\star$9 by Gaussian elimination over $L$0 (Huang et al., 5 Jan 2026).

4. Hook-based trajectory watermarking and dataset-level AgentMark

A related formulation, presented as AgentMark for watermarking LLM agent trajectories and explicitly summarized as operationalizing ActHook’s behavior-level watermarking, moves from online behavior sampling to dataset watermarking (Meng et al., 21 Feb 2026). Here the watermark is embedded into trajectory data before fine-tuning rather than injected into model weights. The procedure operates in three phases: Filter, Sample, and Inject.

In the Filter phase, a dataset-specific predicate $L$1 selects trajectories that contain the requisite patterns for contextual insertion, such as a file-creation step. In the Sample phase, the number of watermarked trajectories is computed as $L$2, where $L$3 is the watermark ratio, for example 5%, and $L$4 valid trajectories are sampled uniformly at random. In the Inject phase, the secret key $L$5 is appended to the original user prompt, an auxiliary LLM generates a diverse hook action $L$6 at a high-entropy decision point, and the pair $L$7 is inserted into the trajectory to produce $L$8. The altered trajectory replaces the original one in the public dataset. No model weights are modified at injection time; watermark learning occurs only when the agent is fine-tuned on the altered dataset (Meng et al., 21 Feb 2026).

Detection is black-box. A detector prepares $L$9 seed prompts $m \in \{0,1\}^L$0, issues $m \in \{0,1\}^L$1 sampling queries with the real key appended and $m \in \{0,1\}^L$2 without the key, and then records whether the sampled trajectory contains any hook action according to $m \in \{0,1\}^L$3. The empirical hook-action rates are

$m \in \{0,1\}^L$4

with detection score

$m \in \{0,1\}^L$5

A paired one-sided $m \in \{0,1\}^L$6-test compares hook rates under the real key $m \in \{0,1\}^L$7 and a sham key $m \in \{0,1\}^L$8, and the AUC is defined as

$m \in \{0,1\}^L$9

This construction is designed to support provenance claims even when the target model is accessible only as a black box (Meng et al., 21 Feb 2026).

The guiding principles are also explicit. The watermark should be embedded at high-entropy decision boundaries rather than inside tokens, use behavior-level patterns rather than lexical artifacts, and keep both the key and the action space native to the agent so as to preserve stealth (Meng et al., 21 Feb 2026). This suggests a broader design principle for AgentMark-like methods: provenance signals are most stable when they coincide with the native uncertainty structure of sequential decision-making.

5. Empirical results, utility preservation, and robustness

The planning-behavior version of AgentMark was evaluated in embodied planning, tool-use decision making, and social simulation (Huang et al., 5 Jan 2026). On ALFWorld ID tasks with 100 episodes, the baseline success rate was approximately 89.5% and AgentMark’s was approximately 89.3%, whereas RG-bias dropped to 78.8%. On ALFWorld OOD tasks with 134 episodes, the baseline was approximately 96.8%, AgentMark was approximately 97.5%, and RG-bias dropped to 94.5%. Capacity was reported as approximately 1.2 bits per step and approximately 25 bits per episode, with latency overhead of about $K_{\mathrm{sh}}$0 s per step and tokens per step within $K_{\mathrm{sh}}$1 (Huang et al., 5 Jan 2026).

On ToolBench, over six subsets and 450 episodes total, the baseline success rate was approximately 59.9% and AgentMark’s was approximately 59.7%, while RG-bias dropped to 58.5%. Capacity was approximately 0.49 bits per step and approximately 4.9 bits per episode, with an 8-bit payload per episode. Latency overhead was negligible, and the method often used fewer steps due to early termination, with $K_{\mathrm{sh}}$2 steps on average. In OASIS Twitter and Reddit simulations, five social-quality metrics—coherence, memory accuracy, persona stability, norms, and diversity—matched the no-watermark condition within $K_{\mathrm{sh}}$3 points on a 100-point scale, and watermark detection rate through behavior-ID recovery was 100% under no erasure (Huang et al., 5 Jan 2026).

Robustness under erasure is a central empirical claim. When each step was dropped with probability up to 0.5, RLNC-coded AgentMark recovered a 128-bit ID with more than 95% success as long as at least 60% of steps survived, whereas a repetition-code baseline failed sharply once survival fell below 80%. False positive rate under random logs or wrong key fell below 1% with an 8-bit overhead and was essentially zero at 14 bits overhead (Huang et al., 5 Jan 2026).

The trajectory-dataset formulation reports complementary results on MATH, SimpleQA, and SWE-Smith, using Qwen-2.5-Coder at 3B, 7B, and 14B, and Llama-3.1-8B (Meng et al., 21 Feb 2026). On Qwen-2.5-Coder-7B with $K_{\mathrm{sh}}$4, the average detection AUC was 94.3% for Standalone and 90.8% for Contextual watermarking across tasks, using one prompt and $K_{\mathrm{sh}}$5 queries. Pass@1 degraded by less than 1% relative to the unwatermarked agent, while average reasoning turns and token counts remained virtually unchanged. After paraphrasing, code abstraction via DeCoMa, or action summarization, AUC stayed above 85%. The theoretical sample complexity in Theorem 1 is $K_{\mathrm{sh}}$6, where $K_{\mathrm{sh}}$7 is the true hook-rate gap (Meng et al., 21 Feb 2026).

Setting	Reported result	Source
ALFWorld ID	baseline SR $K_{\mathrm{sh}}$8, AgentMark SR $K_{\mathrm{sh}}$9	(Huang et al., 5 Jan 2026)
ToolBench	baseline SR $t$00, AgentMark SR $t$01	(Huang et al., 5 Jan 2026)
Qwen-2.5-Coder-7B, $t$02	AUC $t$03 Standalone, $t$04 Contextual	(Meng et al., 21 Feb 2026)

These results support two distinct but related claims. First, behavior-level watermarking can preserve utility when it preserves the relevant distribution or outcome constraints. Second, provenance can remain detectable under partial logs, paraphrase, summarization, and other perturbations, although the robustness mechanism differs across formulations.

6. Relation to content watermarking, later sequential methods, and limitations

AgentMark is explicitly compatible with action-layer content watermarking. Because it operates only on the behavior layer, it can be combined with SynthID-Text or another distribution-preserving text watermark on the final action-layer output. In the reported ToolBench compatibility experiment with 149 trajectories, AgentMark recovered 100% of behavior-layer IDs and SynthID detected text watermarks at 96.6% (Huang et al., 5 Jan 2026). The significance is architectural rather than merely empirical: behavior-level logs may be incomplete, while final text may be paraphrased or filtered, so the two watermarking layers address different failure modes.

Later work situates AgentMark within a broader taxonomy of behavioral watermarking. SeqWM characterizes prior methods in terms of whether they rely on absolute round indices or on trajectory structure. In that comparison, AgentMark is described as a method with a multi-bit payload in per-step choices that preserves marginals but requires perfect segment decoding; its detection metric does not directly apply under partial observation, and it fails under partial observation in the SeqWM setting (An et al., 11 May 2026). SeqWM instead embeds signals into history-conditioned transition patterns, uses random-key calibration, and reports that when up to 30% of actions were randomly deleted it still achieved more than 95% true positive rate at $t$05, whereas the prior round-indexed method AgentGuide collapsed to random-guess levels once more than 5% of steps were missing (An et al., 11 May 2026). This does not negate AgentMark’s reported robustness to erasure in ID recovery; rather, it distinguishes watermark extraction from trajectory-level position-agnostic verification.

The limitations stated for AgentMark are concrete. The planning-behavior formulation requires the agent to explicitly return a behavior distribution $t$06 and to log $t$07; black-box APIs that hide these can be harder to adapt. Semantic variation in logs can desynchronize $t$08 and reduce bit recovery, with approximately 17% step-level bit match observed under heavy rewriting. Capacity is context-dependent, and when $t$09 is very peaked, $t$10 is small, so per-step bits decline (Huang et al., 5 Jan 2026). The trajectory-dataset formulation likewise requires an auxiliary LLM and domain-specific hook-action engineering, and its effectiveness scales with model size and watermark ratio, with very small models or ultra-low ratios noted as potentially underperforming (Meng et al., 21 Feb 2026).

Future directions are stated in both lines of work. For AgentMark proper, these include automatic extraction of $t$11 from open-source models’ hidden logits, adaptive payload scheduling to concentrate bits into high-entropy steps, tighter theoretical analysis of multi-step utility guarantees and worst-case drift, and applications to multi-agent coordination logs and cross-agent provenance (Huang et al., 5 Jan 2026). For the hook-based trajectory variant, proposed extensions include adaptive key scheduling, multiple orthogonal hooks, and reinforcement-learning-based policy adjustment (Meng et al., 21 Feb 2026). A plausible implication is that the field is converging on a shared principle: behavior-level provenance is easiest to sustain when the watermark is aligned with uncertainty-rich decision structure, native action semantics, and detection procedures that remain valid under black-box observation.